Cissp Application Security

Front 1

SSE-CMMI, WASCI, BSI, ISO/IEC

Back 1

Organization standards

Front 2

Versioning, Technologist, Protection Code, Protection of project - Scope-creep VS. Statement of work, Process integrity

Back 2

Software Configuration Management

Front 3

Project, Management based Methodology, CMMI, SLC vs/ SDLC

Back 3

System Lifecycle

Front 4

stops when in production

Back 4

System development lifecycle

Front 5

this should be protected from tampering, prirating, accidental loss, and protection against

Back 5

Source Code

Front 6

these are hiring controls, changes in employment, protection of privacy from employees (privacy impact rating)

Back 6

Personnel Security

Front 7

never test on these systems or use real data

Back 7

Production System

Front 8

Waterfall, Spiral Method, Clean-room, Structured Programming Development, Iterative Development, Joint Analysis Development, Prototyping

Back 8

Software Development Methods

Front 9

comes from manufacturating, requirements set in stone, step by step with sign offs per step

Back 9

Waterfall Method

Front 10

starts from middle and works out, may be scope creep

Back 10

Spiral Method

Front 11

QA every step as finished

Back 11

Clean Room

Front 12

doing a portion, building and verifying reqs

Back 12

Prototyping

Front 13

translates an assemply language program to machine language

Back 13

Assembler Language

Front 14

translates a high level language into machine language

Back 14

Compiler

Front 15

instead of compiling a program at once this interprets in statement by statement

Back 15

Interpreter

Front 16

technique that exploits a security vulnerability occurring in the database layer of an application

Back 16

SQL Injection

Front 17

a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users

Back 17

Cross-Site Scripting XSS

Front 18

pointers that do not point to a valid object of the appropriate type

Back 18

Dangling Pointer

Front 19

invalid hyperlink, secure web applications, javaScript attacks vs. sandbox

Back 19

Secure Coding Issues

Front 20

validate all input and output, fail secure, fail safe, make it simple, defense in depth, only as secure as your weakest link

Back 20

Application Security Principles

Front 21

Classes, objects, message, inheritance, polymorphism, polyinstantiation

Back 21

Object-Oriented Programming Concepts

Front 22

multiple instances, reduces inference attack,

Back 22

polyinstantiation

Front 23

DCOM (Microsoft), SOAP, CORBRA, EJB (Java)

Back 23

Distributed Programming

Front 24

these all impact what in application security?
CIA

Back 24

transaction processing

Front 25

injection, input manipulation/malicious file execution/ information disclosure, hijacking, infrastructure, race condition

Back 25

malware and attack types

Front 26

these are?
keystroke logging, adware and spyware, spam, phishing, botnets, remote access trojans (RAT), URL manipulation, maintenance hooks (backdoor or trapdoor)

Back 26

malware

Front 27

is a software bug caused by changes in a system between the checking of a condition (such as a security credential) and the use of the results of that check. It is a kind of race condition

Back 27

time-of-check-to-time-of-use

Front 28

these help what?
eliminate duplication of data, consistency of data, netork access

Back 28

database security

Front 29

these strore records in a single table, parent/child relationship, limited to a single tree, difficult to link

Back 29

Hierarchial Database

Front 30

these repressent there data in the form of network records

Back 30

Network DBMS

Front 31

most frequently used model, data are structured in tables, columns are variables (attributes) rows contain the specific instances (records)

Back 31

Relational Database

Front 32

these are methods of identifying patterns in data, KDD and AI techniques

Back 32

Knowledge Discovery in Databases

Front 33

looking at one piece of information and guessing

Back 33

Inference

Front 34

taking pieces of information to build a picture

Back 34

aggregation

Front 35

these are...
access controls, grants, cascading permisions, lock controls, backup and recovery

Back 35

database controls

Front 36

these are...
constrained views, sensitive data is hidden fromun authorized users, controls located in the front end of the application

Back 36

View-Based Access Controls

Front 37

content-based access control, commit statement, three-phase commit, database rollback, journals, logs, & error controls

Back 37

Transaction Controls

Front 38

Atomicity, Consistency, Isolation, Durability

Back 38

ACID Test

Front 39

all changes take effect or none do

Back 39

Atomicity

Front 40

maintain internal to external

Back 40

Consistency