Cissp: S/w Dev Security - Brown

Front 1

An agile development method that uses pairs of programmers who work off a detailed specification.

Back 1

Extreme Programming (XP)

Front 2

A "black box" that combines code and data and sends and receives messages.

Back 2

Object

Front 3

Changes the older procedural programming methodology and treats a program as a
series of connected objects that communicate via messages.

Back 3

Object-Oriented Programming

Front 4

Programming languages that use subroutines, procedures, and functions.

Back 4

Procedural Languages

Front 5

A software development model designed to control risk.

Back 5

Spiral Model

Front 6

A development model that focuses on security in every phase.

Back 6

Systems Development Life Cycle (SDLC)

Front 7

An application development model that uses rigid phases; when one phase ends, the next begins.

Back 7

Waterfall Model

Front 8

Software that is executed directly by the CPU. CPU
dependent;

Back 8

Machine code (also called machine language)

Front 9

Low-level computer programming language. Instructions are short mnemonics,
such as "ADD," "SUB" (subtract), and "JMP" (jump), that match to machine language instructions.

Back 9

Assembly language

Front 10

Converts assembly language into machine language.

Back 10

An assembler

Front 11

Take source code, such as C or Basic, and compile it into machine code.

Back 11

Compilers

Front 12

Code compiled on the fly each
time the program is run. Differ from compiled languages

Back 12

Interpreted languages / Interpreted code (such as shell)

Front 13

Interpreted code exists as an intermediary form (converted from source code) but still must be converted into machine code before it may run on the CPU.

Back 13

Bytecode (such as Java bytecode)

Front 14

Use subroutines, procedures, and functions. Examples: Basic, C, Fortran, and Pascal.

Back 14

Procedural languages (also called procedure-oriented languages)

Front 15

Attempt to model the real world through the use of
objects that combine methods and data. Examples include C++, Ruby, and Python.

Back 15

Object-oriented languages

Front 16

Computer languages that are designed to increase a programmer's efficiency by automating the creation of computer programming code. Tend to be Graphical User Interface (GUI) focused and creation of databases, reports, and
websites.

Back 16

Fourth-generation programming languages (4GL)

Front 17

- First-generation language—Machine code
- Second-generation language—Assembly
- Third-generation language—COBOL, C, Basic
- Fourth-generation language—ColdFusion®, Progress 4GL, Oracle® Reports

Back 17

4 Generations of Prog languages

Front 18

Uses programs to assist in the creation and maintenance of other computer programs.

Back 18

Computer-aided software engineering (CASE)

Front 19

1. Tools:
2. Workbenches:
3. Environments:

Back 19

Three types of CASE software

Front 20

Starts with the broadest and highest level requirements (the concept of the final program)
and works down toward the low-level technical implementation details.

Back 20

Top-down (TD) programming (e.g. Procedural languages)

Front 21

Starts with the low-level technical implementation details and works up to the concept of the complete program.

Back 21

Bottom-up programming; is the reverse of TD; (e.g. Object-oriented)

Front 22

Software typically released in executable form; the source code is kept confidential. Examples
include Oracle® and Microsoft® Windows® 7.

Back 22

Closed source software

Front 23

Publishes source code publicly. Examples include
Ubuntu® Linux® and the Apache web server.

Back 23

Open source Software

Front 24

A linear application development model that uses rigid phases; when one phase ends, the next
begins. Limited customer interaction. Predates software design and was initially used in manufacturing. includes the following steps: System requirements, Software Requirements, Analysis, Program Design, Coding, Testing, and Operations

Back 24

Waterfall model

Front 25

Exam
Warning

Back 25

The specific names of the phases of Royce's unmodified waterfall model are not specifically testable; learn the overall flow. Also, Royce omitted a critical final step: destruction. No development process that leads to an operational system with sensitive production data is truly complete until that system has been retired, the data archived, and the remaining data on those physical systems securely destroyed.

Front 26

Highly overlapping steps; it can be thought of as a real-world successor to the waterfall model (and is sometimes called the _____________ waterfall model).

Back 26

Sashimi model

Hint 26

named after the Japanese delicacy sashimi, which has overlapping
layers of fish

Front 27

Evolved as a reaction to rigid software development models such as the waterfall model. More flexibility, fast turnaround with smaller milestones,
strong communication within the team, and more customer involvement.

Back 27

Agile software development
(e.g. SCRUM; XP)

Front 28

Software development model designed to control risk. Boehm created the model. risk-driven approach to the software process rather than a primarily document-driven or code-driven process.

Back 28

Spiral model

Front 29

Rapidly develops software via the use of prototypes, dummy GUIs, back-end databases. Goal is quickly meeting the business needs of the system; technical concerns are secondary. The customer is heavily involved in the process.

Back 29

Rapid Application Development (RAD)

Front 30

Security in every phase. This model is broader than many application development models,
focusing on the entire system, from selection and development through operational requirements to secure disposal. Many variants but most follow (or are based on) the National Institute of Standards and Technology (NIST) XXXX process.

Back 30

Software Development Life Cycle or Systems Development Life Cycle (SDLC),

Front 31

Security is part of every step of secure SDLC. "secure" or "security" appears somewhere in every step of NIST's SDLC, from project initiation to disposal.

Back 31

NIST Special Publication 800-14

Hint 31

Any step that omits security is the wrong answer. Any SDLC plan that omits secure disposal as the final lifecycle step is also the wrong answer

Front 32

The process of having a third party store an archive of computer software. This is often
negotiated as part of a contract with a proprietary software vendor.

Back 32

Software escrow

Front 33

Programs as a series of connected objects that communicate via messages. Attempts to model the real world. Contains data and
methods (the functions they perform); provides encapsulation (also called data hiding)

Back 33

Object-oriented programming (OOP)

Hint 33

Examples of OOP languages include Java, C++, Smalltalk, and Ruby.

Front 34

In OOP, many instances of an object with different inputs and outputs.

Back 34

Polyinstantiation

Front 35

In OOP, the capability of an action or method to do different things based on the object that it is acting upon

Back 35

Polymorphism

Front 36

Used to locate objects; they act as object search engines. Are middleware; they connect programs to programs. (e.g. COM, DCOM, and CORBA)

Back 36

Object Request Brokers (ORBs)

Front 37

Locates objects on a local system; used by developers to create reusable software components, link components
together to build applications, and take advantage of Windows services.

Back 37

COM (Component Object Model)

Front 38

Can locate objects over a network. Extends COM to support communication among
objects on different computers—on a LAN, a WAN, or even the Internet

Back 38

DCOM (Distributed Component Object Model).

Front 39

An open vendor-neutral networked object broker framework; Objects
communicate via a message interface, described by the interface definition language (IDL). low-level details
are encapsulated (hidden) from the client.

Back 39

Common Object Request Broker Architecture (CORBA)

Front 40

Seeks to understand (analyze) a problem domain (the challenge you are trying to address) and
identifies all objects and their interaction.

Back 40

Object-Oriented Analysis (OOA); with OOD is OOAD

Front 41

Develops (designs) the solution.

Back 41

Object-oriented design (OOD); with OOA is OOAD

Front 42

Types of Software Vulnerabilities

Back 42

- Hard-coded Credentials
- Buffer Overflow
- SQL Injection
- Directory Path Traversal
-

Front 43

Backdoor username/passwords left by programmers in production code

Back 43

Hard-coded Credentials

Front 44

Occurs when a programmer does not perform variable bounds checking

Back 44

Buffer Overflow

Front 45

Common type of attack that occurs when some control changes between the time that the system security functions check the contents of variables and the time the variables actually are used during operations.

Back 45

TOC/TOU: Time-of-check/time-of-use

Front 46

Manipulation of a back-end SQL server via a front-end Web server

Back 46

SQL Injection

Front 47

Escaping from the root of a Web server (such as/var/www) into the regular file system by referencing directories such as "…/…"

Back 47

Directory Path Traversal

Front 48

Altering normal _ _ _ URLs and variables

Back 48

PHP Remote File Inclusion (RFI)

Front 49

Web attack that leverages third-party execution of Web scripting languages such as JavaScript within the security context of a trusted site. Executes a script in a trusted context:

Back 49

Cross-Site Scripting (XSS)

Front 50

Web attack that leverages third-party redirect of static content within the security context of a trusted site. Tricks a user into processing a URL

Back 50

Cross-Site Request Forgery (CSRF, or sometimes XSRF)

Front 51

Vulnerabilities that allow an attacker with (typically limited) access to be able to access additional resources. (e.g. normal Unix user into root access)

Back 51

Privilege escalation vulnerabilities

Front 52

Shortcuts in a system that allow a user to bypass security checks.

Back 52

Backdoors

Front 53

Software Testing Methods

Back 53

- Static testing
- Dynamic testing
- White box software
- Black box

Front 54

Tests the code passively; that is, the code is not running. includes walkthroughs, syntax checking, andcode reviews.

Back 54

Static testing

Front 55

Tests the code while executing it.

Back 55

Dynamic testing

Front 56

Testing gives the tester access to program source code, data structures, variables, etc.

Back 56

White box software

Front 57

Testing gives the tester no internal details: The software is treated as a black box that receives inputs.

Back 57

Black box

Front 58

Used to map customer's
requirements to the software testing plan: It "traces" the "requirements," and ensures that they are being met.

Back 58

A Traceability Matrix (sometimes called a Requirements Traceability Matrix, or RTM)

Front 59

Software Testing Levels

Back 59

- Unit Testing
- Installation Testing
- Integration Testing
- Regression Testing
- Acceptance Testing

Front 60

Low-level tests of software components, such as functions, procedures, or objects

Back 60

Unit Testing

Front 61

Testing software as it is installed and first operated

Back 61

Installation Testing

Front 62

Testing multiple software components as they are combined into a working system; subsets may be tested, or Big Bang integration testing tests all integrated software components

Back 62

Integration Testing

Front 63

Testing software after updates, modifications, or patches

Back 63

Regression Testing

Front 64

Testing to ensure the software meets the customer's operational requirements; when this testing
is done directly by the customer, it is called User Acceptance Testing

Back 64

Acceptance Testing

Front 65

Type of black box testing that enters random, malformed data as inputs into software programs to determine if they will crash.

Back 65

Fuzzing (also called fuzz testing)

Front 66

A black-box testing method that seeks to identify and test all unique combinations of software inputs. (e.g. pairwise testing (also called all pairs testing).

Back 66

Combinatorial software

Front 67

Maturity framework for evaluating and improving the software development process. Goal is to develop a methodical framework for creating quality software that allows measurable and repeatable results.

Back 67

Software Capability Maturity Model (CMM)

Front 68

Five levels of CMM

Back 68

1. Initial
2. Repeatable
3. Defined
4. Managed
5. Optimizing

Front 69

Software process is characterized as ad hoc and occasionally even chaotic. Few processes are defined, and success depends on individual effort.

Back 69

Initial

Front 70

Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications.

Back 70

Repeatable

Front 71

The software process for both management and engineering activities is documented, standardized, and
integrated into a standard software process for the organization. Projects use an approved, tailored version of the
organization's standard software process for developing and maintaining software.

Back 71

Defined

Front 72

Detailed measures of the software process and product quality are collected, analyzed, and used to control
the process. Both the software process and products are quantitatively understood and controlled.

Back 72

Managed

Front 73

Continual process improvement is enabled by quantitative feedback from the process and from piloting
innovative ideas and technologies

Back 73

Optimizing

Front 74

Formal database types

Back 74

- Relational (two dimensional)
- hierarchical
- object-oriented.

Flat File could also be considered, but not formal db.

Front 75

Key in a related database table that matches a primary key in the parent database.

Back 75

A foreign key

Front 76

Every foreign key in a secondary table matches a primary key in the parent table;

Back 76

Referential integrity

Front 77

Database term for a row in a relational database.

Back 77

Tuple

Front 78

Each tuple has a unique primary key that is not null

Back 78

Entity integrity

Front 79

Each attribute (column) value is consistent with the attribute data type.

Back 79

Semantic integrity

Front 80

Seeks to make the data in a database table logically concise, organized, and consistent.

Back 80

Database normalization

Front 81

Three rules of DB normalization

Back 81

- First normal form (1NF)—Divide data into tables.
- Second normal form (2NF)—Move data that is partially dependent on the primary key to another table
- Third normal form (3NF)—Remove data that is not dependent on the primary key.

Front 82

Results of a database query; may be used to provide a constrained user interface.

Back 82

Database view

Front 83

Description of the database tables. Contains database view information, information about authorized database administrators, and user
accounts, including their names and privileges, auditing information, and others.

Back 83

Data dictionary contains

Front 84

Data about data.

Back 84

metadata (e.g. Data Dictionary)

Front 85

Database query languages have at least two subsets of commands

Back 85

1 - data definition language (DDL) 2 - data manipulation language (DML)

Front 86

Used to create, modify, and delete tables. DML is used to query and update data
stored in the tables.

Back 86

DDL - data definition language

Front 87

Used to query and update data
stored in the tables.

Back 87

DML - data manipulation language

Front 88

Databases forms a tree (e.g. global Domain Name Service (DNS) servers form a global tree.

Back 88

Hierarchical databases

Front 89

combine data with functions (code) in an object-oriented framework. Object-oriented programming (OOP) is used to manipulate the objects (and their data), managed by an object database management system (ODBMS).

Back 89

object-oriented databases

Front 90

Log of all database transactions

Back 90

database journal

Front 91

Mirrors a live database, allowing simultaneous reads and writes to multiple replicated databases by
clients. Pose additional integrity challenges.

Back 91

Database replication

Front 92

Mirrors all changes made to a primary database, but clients do not access the shadow. Is
one way (i.e., data flows from primary to shadow); it serves as a live data backup of the primary.

Back 92

Shadow database

Front 93

Large collection of data. This requires large, scalable storage solutions. The storage must be high performance and allow analysis and searches of the data.

Back 93

Data warehouse is

Front 94

Used to search for patterns.

Back 94

Data mining

Front 95

Science of programming electronic computers to "think" more intelligently,

Back 95

Artificial intelligence (AI)

Front 96

Consist of two main components. The first is a knowledge base that consists of "if/then" statements. These
statements contain rules that the expert system uses to make decisions. The second component is an inference engine that follows the tree formed by the knowledge base and fires a rule when there is a match.

Back 96

Expert systems

Front 97

Consists of "if/then" statements. Statements contain rules that the expert system uses to make decisions.

Back 97

Knowledge base

Front 98

Follows the tree formed by the knowledge base and fires a rule when there is a match.

Back 98

Inference engine

Front 99

Simulate neural networks found in humans and animals. This multilayer neural network is capable of making a single decision based on thousands or more inputs. used for "fuzzy" solutions, where exactness is not always required (or possible), such as predicting the weather.

Back 99

Artificial neural networks (ANN)

Front 100

Based on a number of probability and statistical methods; is commonly used to identify spam.

Back 100

Bayesian filtering

Front 101

Refers to creating entire software programs (usually in the
form of Lisp source code); genetic algorithms refer to creating shorter pieces of code (represented as strings called chromosomes); creates random programs and assigns them a task of solving a problem.

Back 101

Genetic programming