Seng 460: Software Development Security (1)

Front 1

What does the SDLC do?

Back 1

- helps ensure functionality, cost, quality, delivery schedule and requirements are met.

Front 2

Name the full SDLC.

Back 2

1. Requirements gathering

2. Design

3. Development

4. Testing/Validation

5. Release/Maintenance

Front 3

What is Requirements gathering?

Back 3

Determines why, what, whom the software is created for.

Front 4

What is Design?

Back 4

- Deals with how the software will accomplish goals.

Front 5

What is Development?

Back 5

-Implements software code to meet specifications laid out in the design phase

Front 6

What is Testing/Validation?

Back 6

- Validates software product to ensure goals are met and works as planned

Front 7

What is Release/Maintenance?

Back 7

-Deploys the software product and ensure that it is properly configured, patched and monitored.

Front 8

What are some software models?

Back 8

- Build and Fix Model

- Waterfall

- V-shaped

- Prototype Model

- Incremental Model

- Agile

Front 9

Build and Fix Model. Go!

Back 9

- Development takes place immediately (no planing)

- Problems dealt with as they occur

Front 10

Waterfall Model. Go!

Back 10

-linear-sequential life-cycle approach.

- phase by phase

Front 11

V-shaped Model

Back 11

- Extension of waterfall model.

- Emphasizes verification and validation

- develops test plans at different development levels

Front 12

What is Verification vs. Validation?

Back 12

- Verification: Determines if the product accurately represents and meets the specification

- Validation: Determines if the product provides the necessary solution for the intended problem.

Front 13

Prototype Model. Go!

Back 13

A sample of software code or a model (prototype) is developed before investing time and and resources.

Front 14

What is Rapid Prototyping?

Back 14

quickly develop a prototype to see if their ideas are feasible and move forward.

Front 15

What is Evolutionary prototyping?

Back 15

can be continually improved upon until it reaches the final product stage.

Front 16

What is Operational prototyping?

Back 16

-an extension of the evolutionary prototype

- developed and improved within production environment.

Front 17

What is incremental model?

Back 17

- multi-waterfall cycles

- each cycle results in a deliverable that is an operational product.

Front 18

What is he Agile model ? Go

Back 18

- focuses on individual interaction

- emphasizes right software product over comprehensive and laborious documentation

- Promotes customer collaboration

Front 19

What are some Programming Languages and Generations?

Back 19

• Generation one: machine language

- Computer Architecture Specific

- 1001011010, etc.

• Generation two: assembly language

- Computer Architecture Specific

- ADD, PUSH, POP, etc.

• Generation three: high-level language

- Computer Architecture Independent

- C, C++, etc.

• Generation four: very high-level language

- Some are platform-Independent

- JAVA, C#, etc.

• Generation five: natural language

- The goal is to create software that can solve problems by itself instead of a programmerhaving to develop code to deal with individual and specific problems.

- Some languages based on advanced knowledge-based processing and artificialintelligence

Front 20

What are some Software Programming Tools?

Back 20

- Assembler:

>assembly language code into machine code

- Compiler

>Convert high-level language into the necessary machine level-format (.exe, dll, etc) for specific processors to understand

- Interpreter

>a tool to convert intermediate, platform-independent format (JAVA bytecode) into a machine-level

Front 21

What are some Software Programming Concepts?

Back 21

- Procedural Programming

- Object-Oriented Programming (OOP)

Front 22

What does - Object-Oriented Programming (OOP) try to do and avoid?

Back 22

- Cohesion

- Coupling

Front 23

What is Cohesion?

Back 23

- A measurement that indicates how many different types of tasks a module needs to carry out.

High cohesion is expected in OOP

Front 24

What is Coupling?

Back 24

- A measurement that indicates how much interaction one module requires for carrying out its tasks.

Low coupling is expected in OOP

Front 25

What are some types of Software Testing?

Back 25

- Unit testing

- Integration testing

- System testing

- Security Testing

- Acceptance testing

- Regression testing

Front 26

What is Unit Testing?

Back 26

-individual component is in a controlled environment

- Validating data structure, logic and boundary conditions

Front 27

What in Integration testing?

Back 27

- Verifying components work together as outlined in design.

Front 28

What is System testing?

Back 28

- end-to-end testing

- tests a full integrated system to verify that it meets its requirements

Front 29

What is security testing?

Back 29

- Focus on security perspectives of the overall system

Front 30

What is acceptance testing?

Back 30

-Ensuring the code meets customers requirements

Front 31

What is Regression testing?

Back 31

After a change to a system takes place, retesting to ensure functionality, performance and protection

Front 32

What is Software Change Control? and what is the process?

Back 32

- the process of controlling the changes that take place during the life cycle.

1. Make a formal request

2. Analyze the request

3. Record the change request

4. Submit the change request for approval

5. Develop the change

6. Report results to management

Front 33

What is software versioning?

Back 33

- deals with keeping track of file revisions so it is possible to "roll back" to a previous version

Front 34

When Evaluating a Software Development Process there is a Capability Maturity Model Integration (CMMI) what is it?

Back 34

- a model which describes procedures, principles and practices of software development maturity.

- vendors use this model to help improve their processes

- customers use the model to asses vendors practices.

Front 35

What are the levels of the CMMI? Draw the model

Back 35

Front 36

Why are security issues created in software development?

Back 36

Software Vendors

- Time-to-time market contraints (no time for security)

- Not very easy to show return on security investments

Software Development

- With complex systems, false assumptions are made when building individual components

- Do not have complete insight into vulnerability issues

- implement hidden features for self-testing which can create security issues is not cleaned up.

Software Operations

- Disable security controls/features for usability and performance

Front 37

What are some Secure Software Development Approaches?

Back 37

- Requirements gathering

- Design

- Development

- Testing/Validation

- Release/Maintenance

Front 38

What is included in the Requirements gathering portion?

Back 38

- Security requirements

Front 39

What is included in the design portion?

Back 39

- Attack surface analysis

- Threat modeling

Front 40

What is included in the development portion?

Back 40

- Computer-aided Software Engineering (CASE)

- Static Code Vulnerability Scan

Front 41

What is included in the testing/validation portion?

Back 41

- dynamic vulnerability scan

- manual security testing

Front 42

What is included in the release/Maintenance

Back 42

- Final security review

Front 43

What is an Attack Surface Analysis?

Back 43

- aim to identify and reduce the amount of code and functionality accessible to untrusted users.

- attempts to enumerate the list of features that an attacker will try to exploit.

t

Front 44

What is an attack surface ?

Back 44

What is available to be used by an attacker against the product itself.

Front 45

What is an attack bias?

Back 45

-potential attack points that are assigned a value between 0 and 1 based on their assume severity

Front 46

What is a relative attack surface quotient (RASQ)?

Back 46

- a relative attackability or likely opportunities for attack against software in comparison to a baseline (introduce by Microsoft)

Front 47

How is RASQ be calculated?

Back 47

- the product of the number of attack bias

Front 48

What can RASQ be used for?

Back 48

- can be used as a measurement to determine the improvement of code quality and security between version of software.

Front 49

What is Threat Modeling?

Back 49

- a systematic approach used to understand how different threats could be realized and how a successful compromise could take place.

Front 50

What are the steps of threat modeling? Draw the diagram

Back 50

Front 51

What is an attack tree? What phase of Threat modeling is this part of?

Back 51

- a hierarchical treelike structure, which has either an attacker's objective or a type of attack at its root node.

- part of Model phase

Front 52

What is STRIDE? what phase is this part of?

Back 52

STRIDE - part of model phase

Spoofing

Tampering

Repudiation

Information disclosure

Denial of service

Elevation of priveldge

Front 53

What is DREAD? What phase is this part pf?

Back 53

DREAD - Measurement Phase

Damage

Reproducibility

Exploitability

Affected users

Discoverability

a risk calculation/ranking.

numerica range preferred small (1 to 3)

Front 54

What are some best practices for Software Development Approaches?

Back 54

- Web Application Security Consortium (WASC) - best pract for web apps

- Open Web Application Security Project (OWASP) - monitor web attacks

- Build Security In (BSI)

- International Electrotechnical Commission (IEC) - par of ISO/IEC 27000 series