Cissp Software Development Security

Front 1

Key objective of application security

Back 1

Ensure the confidentiality, integrity and availability of data.

Front 2

Critical for an application security program to be effective

Back 2

Develop the security policy that can be enforced.

Front 3

Von Neumann

Back 3

Architecture that states "There is no inherent difference between data and programming representations in computer memory."

Front 4

Important characteristic of bytecode

Back 4

It is faster than interpreted languages

Front 5

Covert channel

Back 5

Also known as confinement problem is an information flow issue. Two cooperating processes that simultaneously compete for a shared resource in such a way that they can violate the system security policy. Can lead to denial of service and object reuse has to do with disclosure protection when objects in memory are we used by different processes.

Front 6

Covert storage channel

Back 6

Direct or indirect reading of a storage location by one process and a direct or indirect reading of the same storage location by another process. Involves finite resource, such as memory location or sector on a disk that is shared by two subjects at different security levels.

Front 7

Covert timing channels

Back 7

Depends upon being able to influence the rate that some other processes able to acquire resources, such as the CPU, memory, or i/o devices.

Front 8

Cross-site scripting

Back 8

Enables attackers to inject client-side script into web pages viewed by other users.

Front 9

Social engineering

Back 9

The art of influencing people to divulge sensitive information about themselves or their organization by either corrosion in or masquerading as a valid entity.

Front 10

Time of check time of use TOC/TOU

Back 10

The common type of attack that occurs when some control changes between the time that the system security functions check the contents of variables and the time the variables actually are used during operation.

Front 11

Bounds checking

Back 11

The most effective defense against a buffer overflow attack.

Front 12

Disallowing dynamic construction of queries

Back 12

A defense against injection attacks and encoding the output mitigates scripting attacks

Front 13

Phases of a software acquisition

Back 13

Planning, contracting, monitoring and acceptance, follow on

Front 14

Software librarian

Back 14

Ensures and enforce the separation of duties by ensuring that programmers don't have access to production code.

Front 15

Certification

Back 15

Technical evaluation of assurance to ensure that security requirements have been met. The process of evaluating the security stance of the software or system against a predetermined set of security standards or policy.

Front 16

Cleanroom

Back 16

Defect prevention rather than defect removal. Write code correctly the first time, rather than trying to find the problems once they are there.

Front 17

CASE

Back 17

Technique for using computers and computer utilities to help with systematic analysis, design, development, implementation, and maintenance of software.

Front 18

The spiral software development model

Back 18

Uses Deming PDCA models at each phase of the waterfall method

Front 19

Untrusted code, which is not signed, is restricted from accessing system resources

Back 19

Sandboxing security protection mechanism

Front 20

Sandboxing

Back 20

Provide the protective area for program execution. Limits are placed on the amount of memory and processor resources that it can consume. If it program exceeds these limits, the web browser terminates the process and logs an error code. Ensure the safety of browser performance.

Front 21

Non-repudiation

Back 21

Security control mechanism in which the user or process cannot deny its action.

Front 22

Obfuscation

Back 22

Process of rendering source code to be unreadable and unintelligible as a protection against reversing and IP issues.

Front 23

Trojan

Back 23

Program that pretends to do one thing while performing another, unwanted action. Does not reproduce itself but pretends to be performing a legitimate action, while acting/performing malicious operations in the background.

Front 24

Salami scam

Back 24

A variant on the concept of logic bombs, it is a plot to take insignificant pennies from a user's bank account and move them to an attacker's bank account.

Front 25

Views

Back 25

A feature that allows for virtual tables in database, these virtual tables are created from one or more real tables in the database. Can be set up for each user on the system so that the user can then only view those virtual blades. Can achieve role-based access control.

Front 26

Aggregation and inference

Back 26

2 most dangerous types of attacks against a database containing disparit non sensitive information

Front 27

Aggregation

Back 27

The ability to combine non-sensitive data from separate sources to create sensitive information. The combined data sensitivity can be greater than the classification of individual parts.

Front 28

Inference

Back 28

Is the ability to deduce sensitive or restricted information from observing available information. For example reviewing patients medications that have been prescribed a user may be able to determine the illness.

Front 29

Consistency

Back 29

A property that ensures only valid or legal transactions that do not violate any user-defined integrity constraints in a database management system DBMS technology. Occurs when a database is transformed from one valid state to another valid state. A transaction is allowed only that follows user-defined integrity constraints. No legal transactions are not allowed, and if and integrity constraint cannot be satisfied, the transaction is rolled back to its previous valid state and the user is informed that the transaction has failed.

Front 30

ACID test

Back 30

Atomicity, consistency, isolation, and durability is an important DBMS concept

Front 31

Atomicity

Back 31

Is when all the parts of the transactions execution are either all committed or all rolled back - do it all or not at all. Essentially all changes take effect or none do.

Front 32

Isolation

Back 32

Is the process guarantees the results of the transaction are invisible to the other transactions until the transaction is complete.

Front 33

Durability

Back 33

Insurance the results of the completed transaction are permanent and can survive future systems and media failures, that is, once they are done, they cannot be undone. This is similar to transaction persistence.

Front 34

Expert systems are comprised

Back 34

Of knowledge base comprising modeled human experience and inference engine

Front 35

Best defense against session hijacking and man in the middle attacks

Back 35

Unique and random identification - present a challenge for the attacker to guess what the next identifier may be.