Candi's Csslp Domain 3

Front 1

What is the first objective of designing in security to the SDLC and what is the second objective?

Back 1

First- minimize vulnerabilities

Second- develop layered defenses for the vulnerabilities that remain

Front 2

What is the code within a system that can be accessed by unauthorized parties?

Back 2

Attack surface

Front 3

What is a means of measuring and determining the risks associated with the implementation of design and development?

Back 3

Attack surface evaluation

Front 4

When considering the attack surface of a product, what are these? Open sockets, services, active web handlers, dynamic web pages, null sessions, weak ACLs

Back 4

Ways it can be 'accessed'

Front 5

What is a representation of the potential vulnerability associated with software?

Back 5

Attack surface

Front 6

When should you calculate the attack surface?

Back 6

Throughout the development process

Front 7

When should attack surface minimization be considered?

Back 7

During design

Front 8

What are the 5 steps of the threat model development?

Back 8

1. Define security objectives for the system

2. System decomposition

3. Threat identification

4. Mitigation analysis

5. Validation of threat model

Front 9

What are these used for? UML (unified modeling language), use cases, misuse cases, DFD (data flow diagrams)

Back 9

System decomposition

Front 10

For the purposes of threat modeling, with the target being manipulation of information, which modeling system is best choice for documenting threats?

Back 10

DFD (data flow diagram)

Front 11

Users and Other systems are what type of DFD element in threat modeling?

Back 11

External entities

Front 12

Files, DBs, registries, and shared memory are what type of DFD element in threat modeling?

Back 12

Data stores

Front 13

Users, file systems and process boundaries are what type of DFD element in threat modeling?

Back 13

Trust boundaries

Front 14

Function calls, network traffic and remote procedure calls are what type of DFD element in threat modeling?

Back 14

Data flows

Front 15

What is it where items share the same privileges, access and identifiers and represent points where an attacker can interject into the system?

Back 15

Trust boundary

Front 16

What security control/property addresses spoofing?

Back 16

Authentication

Front 17

What security control/property addresses tampering?

Back 17

Integrity

Front 18

What security control/property addresses repudiation?

Back 18

Non-repudiation

Front 19

What security control/property addresses information disclosure?

Back 19

Confidentiality

Front 20

What security control/property addresses denial of service?

Back 20

Availability

Front 21

What security control/property addresses elevation of privilege?

Back 21

Authorization

Front 22

What are the 4 types of threat mitigation?

Back 22

1. Redesign to eliminate the vulnerability

2. Applywa standard mitigation

3. Invent a new mitigation

4. Accept the vulnerability

Front 23

What is a graphical representation of an attack?

Back 23

Attack tree

Front 24

What is at the beginning of an attack tree (root node)?

Back 24

Attack objective

Front 25

Reproducibility + exploitability + discoverability = ?

Back 25

Probability

Front 26

Damage potential + affected users = ?

Back 26

Impact

Front 27

When should threat model validation occur?

Back 27

At gates situated throughout the SDL

Front 28

What are the primary mechanisms that enterprises use to manage security?

Back 28

Security controls

Front 29

An increasing value for the attack surface during development indicates what?

Back 29

An increase in resources you can address

Front 30

Is it possible to identify all threats to a system?

Back 30

No

Front 31

True or False. The primary purpose of security reviews is to assess the effectiveness of the SDL?

Back 31

True, with that effectiveness having the desired security effects. The security review does not directly assess the quality of security actions and mitigations.

Front 32

Hashing helps with what part of CIA?

Back 32

Integrity

Front 33

Encryption helps with what part of CIA?

Back 33

Confidentiality

Front 34

Recovery mechanisms help with what part of CIA?

Back 34

Availability

Front 35

What 3 elements work together to manage interconnectivity for an application?

Back 35

Session mgmt, Exception mgmt, Configuration mgmt

Front 36

True or False. Out of band management interfaces are less prone to interference from DoS attacks against an app, reducing operational risk.

Back 36

True

Front 37

Economy of mechanism means to limit complexity to make security manageable or...

Back 37

to keep things simple

Front 38

In the n-tier architecture model, what does the n stand for?

Back 38

The number levels of applications doing the work

Front 39

What type of architecture has both parties (systems) sharing the work (equal levels of processing)?

Back 39

Peer-to-peer

Front 40

What technology manages throughput and guarantees communication delivery?

Back 40

Message queuing

Front 41

What distributed architecture has these characteristics? Platform neutrality, interoperability, discoverability, modularity and reusability, contract-based interfaces

Back 41

SOA (service oriented architecture)

Front 42

What are machine-readable interfaces for communicating between elements over the internet?

Back 42

Web services

Front 43

What is the XML format of the machine-readable description of the web service interface?

Back 43

WSDL (web service description language)

Front 44

What describes functionality offered by a web service including how the service can be called, what parameters it expects, and what data structures it returns?

Back 44

WSDL (web service description language)

Front 45

What is a form of architecture that uses the Web as a transfer mechanism and the client as a processing device?

Back 45

Rich internet applications

Front 46

What has the objective to create an application with the characteristics of a desktop application, but is delivered across the Internet (Facebook is an example)?

Back 46

RIA (rich internet applications)

Front 47

When it comes to client-side exploits and peer-to-peer operations, what is one universal truth?

Back 47

Never trust input without validation

Front 48

True or False. Developers do not need to worry too much about their app sending data across a network because the network takes care of the security.

Back 48

False

Front 49

What is a low speed protocol for radio frequency communication over very short distances - no more than a couple inches, used in mobile devices and payment systems?

Back 49

Near-field communication

Front 50

What are these characteristics describing? On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service

Back 50

Cloud computing

Front 51

Which cloud platform can a customer deploy and operate arbitrary sw without worrying about the specifics of the environment?

Back 51

IaaS

Front 52

Platform neutral, interoperability and modular with contract-based interfaces describes what?

Back 52

SOA (service oriented architecture)

Front 53

What does URL stand for?

Back 53

Uniform resource locator

Front 54

What is an industrial strength password synchronization system?

Back 54

SSO (single sign on)

Front 55

True or False. Only system administrators should be able to see passwords.

Back 55

False. Passwords are secrets and should never be accessible by anyone, including system administrators

Front 56

What allows secrets to remain secret and still be used?

Back 56

Cryptography

Front 57

What are the 2 main parties in a authentication system?

Back 57

RP (relying party) & IdP (identity provider)

Front 58

Fill in the blanks. The user wishes access to a ________ and has credentials established on an ________.

Back 58

The user wishes access to a relying party and has credentials established on an identity provider.

Front 59

Between OpenID and OAuth, which is for authentication and which is for authorization?

Back 59

OpenID is for authentication & OAuth is for authorization

Front 60

What is the standard for managing digital certificates?

Back 60

X.509

Front 61

What are the 2 most popular SSO methods?

Back 61

Kerberos and SAML (security assertion markup language)

Front 62

What is similar to a firewall in that it mediates traffic flows, but acts more like a middleman where traffic from untrusted sources stops and is validated against rules before it is allowed to continue?

Back 62

Proxie

Front 63

True or False. PCI DSS required either a web application firewall between the server and users OR application code reviews are performed.

Back 63

True

Front 64

What is the de facto standard for logging in a Linux/Unix environment?

Back 64

Syslog

Front 65

What exists as a last line of defense for protecting data?

Back 65

DLP

Front 66

What are the 3 entities in DRM (digital rights management)?

Back 66

Users, content, rights

Front 67

What is the machine-readable form that is XML based and defines the license, permissions and restrictions of DRM?

Back 67

REL (rights expression language)

Front 68

What is the HW, firmware and SW components of a system that are critical to security?

Back 68

TCB (Trusted Computing Base)

Front 69

What is a HW implementation of a set of cryptographic functions on a motherboard?

Back 69

TPM (Trusted Platform Module)

Front 70

What is the application of a digital signature to computer code?

Back 70

Code signing

Front 71

What is used to I decided and join tables in a DB?

Back 71

Primary keys. (Primary keys cannot be encrypted therefore you should not use PII or PHI information as keys in a DB)

Front 72

What can you employ when you have data with different sensitivity levels in the same db?

Back 72

Data segregation

Front 73

What can you use to automate anything in a db?

Back 73

Triggers (e.g. change to a record can trigger a script)

Front 74

What are programmatically designed extracts of data in a series of tables?

Back 74

Views

Front 75

True or False. DBs have their own internal access control mechanism similar to ACL-based controls for file systems.

Back 75

True

Front 76

What 2 processes convert source code into processor code instantiating it on the target computer?

Back 76

Compilers and interpreters

Front 77

What are the 2 subprocesses involved in compiled languages?

Back 77

Compiling and linking

Front 78

What 2 forms does linking of compiled code come in?

Back 78

Static and dynamic

Front 79

What are 2 popular hybrid languages that leverage both compiled and interpreted languages?

Back 79

Java and MSFT .Net

Front 80

What is the intermediate system called in Java?

Back 80

JVM (java virtual machine)

Front 81

What is the intermediate system for .Net?

Back 81

CLR (common language runtime)

Front 82

What are dedicated systems where the HW and SW are coupled for a specific purpose?

Back 82

Embedded systems

Front 83

What are specialized computer systems used for automated control of equipment?

Back 83

Control systems

Front 84

What is SW code held on the device? (Aka wired in SW)

Back 84

Firmware

Front 85

What is the process of combining functions, libraries, and dependencies into a single operational unit?

Back 85

Linking