CISSP - Domain 8

44 flashcards · Computer Science · by Jaysen Lewis

1. When looking at log entries in regards to URL encoding, what are the characters "." and "/" replaced by?

   . is replaced by %252E / is replaced by %252F

2. What are the 5 Stages of the Software Capability Maturity Model (SW-CMM)?

   Initial: Chaos. Disorganized, no process Repeatable: Lifecycle management process is introduced, Repeatable results. S/W project planning, tracking, QA etc. Defined: S/W developers operate with formal procedures. Integrated. More organized. Managed: Detailed understanding of development. Quantitative process & Quality Management. Reuse of code. Optimized: Sophisticated S/W development process is there. Feedback oriented. Change Management "Initially, Repeating Definitions MakesMe Optimistic" Pr…

3. What are the different Software Development Methodologies?

   1) Waterfall Rigid, hard to add new business requirements mid-development Prioritizes fast delivery over requirements/ changes 2) Spiral Model Repeat the cycle until you get to a solid product. 3) Agile Welcomes changes late in development Promotes face-to-face interacting Constant pace

4. Know the 5 steps of the "IDEAL" Maturity Model:

   Initiating Diagnosing Establishing Action Learning

5. Be familiar the OWASP SAMM Maturity Model

   via owaspsamm.org

6. What are the 3 key elements of Change Management?

   Request Control - Manage requests from customers Change Control - RFC, Review, Approval, Implementation Release Control - Moves code from DEV to PROD.

7. Be familiar with the Code Environments:

8. All changes and configuration management activities should be logged in a permanent log known as ___________?

   SCM - A Software Configuration Management repository/ log

9. What is IaC?

   Infrastructure as Code Scripts the creation of resources, servers, cloud infrastructure etc. Highly automated infrastructure changes Easily redeployable infra Modify the code, not the target

10. Know the basics about Interpreted vs. Compiled Code Languages:

11. Know the different options for reverse engineering compiled code:

    Sandboxing Observe code in an instrumented environment in an attempt to observe how it functions Use a Decompiler Convert machine language back into source code Difficult to interpret

12. What is the difference between Commercial Off-the-Shelf Software (COTS) vs. Software as a Service (SaaS)?

    COTS = Purchased from 3rd party vendors & run on systems that are managed by the customer. SaaS = Software developed by vendors that runs in the cloud on vendor-managed devices. (Think of HCP)

13. What is regression testing?

    Checking for unexpected side-effects when releasing new modifications. Verifies that the software behaves as designed even after new changes.

14. What is the most formal code review process?

    Fagan Inspection. Burdensome and not really followed too much. Many code reviews are based on it though.

15. What is the difference between software model validation & software verification?

16. Know the difference between Static and Dynamic Code Testing:

    Static Tests do not execute code and use automatic techniques to check for security flaws. Dynamic Tests execute code and are as close to real-world scenarios as possible.

17. What do Synthetic transactions do?

    Synthetic transactions are scripted sets of inputs and instructions to be given to code where the testers know what output the code should produce for each input. Testing software can automatically cycle through these synthetic transactions, performing regression testing to verify that code is functioning properly across a wide range of tests

18. What is Fuzzing?

    Fuzzing or Fuzz Testing provides many different types of valid and invalid input to software in an attempt to make that software enter an unpredictable state or disclose confidential information. "Lets give it bad input and see if it breaks."

19. What are the Pros & Cons of using a Code Repo (repository) like Github?

    Pros: Secure storage of software source code files Coordinate & track changes among multiple developers Add auto or manual approval workflows to code changes Perform version control Promotes code re-use Avoid "Dead Code" (orphaned code). Cons: Public code repos can create potential disclosure issues. Unintentional Exposure of Secrets

20. Be familiar with the OWASP Top 10:

    Latest is 2021: https://owasp.org/Top10/

21. What is a SQL Injection attack and what can you do to prevent it?

    Hijacking a simple SQL query to "inject" a userpass database with comments that allow an attacker to flip the password of a user Single quotes (') are critical to SQL Injection attacks On the exam, lookout for attackers using ' to escape a SQL statement 3 ways to Prevent: Use Input Validation (Web-App/ Server Side) Example: Input should never contain a single quote NOTE: Client-side input validation can be bypassed by attackers easily -so be sure to use Server-Side. Use of Parameterized SQL (Pr…

22. What is a Cross-Site Request Forgery (CSRF or XSRF) attack and how you defend against it?

    Client-Side attack Takes advantage of users logged into multiple sites at once (via browser tabs) and tricks the user's browser into sending illegitimate "cross-site" malicious requests without the user's knowledge Often using fake image tags to execute the desired malicious command Defense: Re-architect web apps to use cryptographically strong tokens for transactions. Prevent HTTP Get Requests Advise users to logout of sites when finished (User Education). Enforce Idle Auto-Logout

23. What is a Cross-Site Scripting (XSS) attack and how can it be defended against?

    When an attacker embeds malicious scripts into a 3rd party websites to be ran in browsers by innocent visitors. Typically leveraging the "<script></script>" tags in html code. Defense: Use Input Validation & Restrictions Example: don't allow HTML with the <script> tags.

24. What are some of the best forms of Application Hardening?

    Prompt Patching Proper Authentication Encrypt sensitive data Validate User Input, or only allow specific input Avoid & Remediate known exploits Deploy obfuscation & camoflage

25. What is a Server-Side Request Forgery (SSRF) attack and how can you defend against it?

    Server-Side attack, similar to XSRF Tampers with metadata Manipulates servers into retrieving malicious data from what-it-thinks is a legitimate/trust source.

26. How can you defend against directory traversal attacks?

    Input Validation Linux example: Don't allow the use of ".." periods in user requests Restrictive File Access Controls

27. How can you secure cookies (prevent eavesdropping, cookie guessing, session replay attacks or session hijacking)?

    Make cookies are sent using encryption by specifying the "Secure" attribute.

28. How can you prevent code execution attacks?

    limit admin access patch, patch, patch

29. How can you reduce the likelihood of Privilege Escalation attacks?

    perform input validation patching enforce least privilege, limit admin access Use Data Execution Prevention (DEP) and ASLR technologies

30. Know the 2 methods of driver manipulation:

31. How can you protect against driver manipulation attacks?

    Use code signing

32. Know the different memory-related vulnerabilities/ attacks:

    Memory Leak Fails to release memory for reuse Memory (Buffer) Overflow Allows arbitrary code execution Null Pointer Dereferencing DLL Injection Tricks an application into loading malicious code

33. What are race conditions?

    Timing-related weakness with simultaneous transactions. A race condition occurs when the proper functioning of a security control depends upon the timing of activities performed by the computer or the user. If the timing doesn't occur as expected the software may behave in an unexpected manner causing a significant security vulnerability. Time-of-Check to Time-of-Use (TOC/TOU) vulnerability is a good example. Defense: Locks to prevent simultaneous transactions

34. Input validation should always be performed on the: A) Client side B) Server side

    B) Server side Client-side validation is fine, but can easily be bypassed an attacker.

35. What type of attack tries to write data to areas of memory that are reserved for other purposes?

    Buffer overflow

36. What is output encoding?

    Takes a potentially vulnerable character and replace it with an equivalent string that produces the same result for the end user, but doesn't have the risk of maliciously manipulating the application. HTML encoding & URL encoding are 2 common types of encoding.

37. What does code signing accomplish?

    Applies digital signatures (via digital certs) to software and allows users to be sure that the software is legitimate/ trusted.

38. What does database normalization do?

    Database Normalization has requirements & design rules that improve database design and has security advantages. 1NF 2NF 3NF Although practical, it's still up for debate whether to use these for all databases.

39. What do stored procedures (for databases) do?

    Protects against SQL Injection

40. What is Deidentification?

    Deidentification is the process of moving through a dataset and removing data that may be individually-identifying. It's better to enforce anonymity, masking or data obfuscation.

41. Know the different roles of Cloud Computing:

42. What are MSSPs?

    Vendors that provide security services for other organizations are known as Managed Security Service Providers. Relationships with MSSPs should be carefully documented.

43. What is the Cloud Reference Architecture?

    ISO 17789

44. Understand the different Security Responsibilities when it comes to IaaS, PaaS and SaaS