Save
Upgrade to remove ads
Busy. Please wait.
Log in with Clever
or
show password
Forgot Password?
Don't have an account?  Sign up 
Sign up using Clever
or
Username is available taken
show password


Make sure to remember your password. If you forget it there is no way for StudyStack to send you a reset link. You would need to create a new account. Your email address is only used to allow you to reset your password. See our Privacy Policy and Terms of Service.

Already a StudyStack user? Log In

Reset Password
Enter the associated with your account, and we'll email you a link to reset your password.
focusNode
Didn't know it?
click below
 
Knew it?
click below
Don't Know
Remaining cards (0)
Know
0:00
edit
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

  Normal Size     Small Size show me how

CH1Security Policies

Software Vulnerability Fundamentals_Introduction : The Art of Software Security

QuestionAnswer
What can attackers do by exploiting a vulnerability? Violate the security of a system.
What defines the "security of a system"? A security policy.
How is the "security of a system" conceptualized in relation to its rules, and what constitutes a security violation? Concept: System security is defined by a security policy. Violation: A security breach occurs when that policy is violated.
What is a security policy in a system of software, users, and resources? A simple list of what is allowed and what is forbidden.
What is an example of a security policy violation regarding a calendar service on a staging machine? When unauthenticated users gain access to the calendar service, which violates the policy rule that forbids them from using it.
What can every software system be considered to have, even if it is not formally written down? A security policy.
What constitutes a software system's security policy Either a formal policy (written documents) Or an informal policy (loose expectations of reasonable behavior)
What does the term "security policy" often mean in most software systems, even if it is not explicitly stated? The user community’s consensus on what system behavior is allowed and what system behavior is forbidden.
What are the three forms a security policy can take, ranging from most formal to least formal? Mathematical Specification, Formal Written Document, Informal Expectations
describe the form of security policy that uses mathematical specification Formal constraints. Verified via proof. Very expensive. Used for safety-critical systems.
describe the form of security policy that uses formal written documentation Structured legal/technical clauses. Explicit rules (e.g., encryption). Covers software, sites, or databases.
describe the form of security policy that uses informal expectations Unwritten, ambiguous assumptions. Based on common sense. Lacks strict technical definitions.
What is a formal specification security policy, and what are its limitations? Def:Math proof verifying program code against security constraints. Use case:Highly sensitive, tightly scoped systems. Limitations:Prohibitively expensive and unwieldy. Reality:Rarely used, even n critical infrastructure like medical devices/airplanes
What is a security policy, what is an example of a specific rule it might contain, and where do these rules come from? Def:formal/written doc outlines security rules4sys/org. Ex Rule: cc data mustnever b shared with 3rd parties/sent across networks without strong encryption Where Rules Come From:Software dev policies Site security policies OS policies DBsecurity policies
What is an example of an informal security policy? A collection of people's expectations regarding reasonable program security behavior. Example: "Yeah, giving a criminal organization access to our credit card database is probably bad." Characteristics: Informal, slightly ambiguous, and unwritten.
What is Code Access Security (CAS) in JVM/.NET CLR? Def&Purpose: Validates packages at load/runtime. Checks bytecode integrity. Verifies software originator. Applies code access restrictions. Enables sandbox environments (Java applets).
What is Code Access Security (CAS) two major limitations in JVM/.NET CLR Two Major Caveats: Lack of understanding: Most developers do not understand CAS, so it is rarely used in commercial software. Underlying vulnerability dependence: If the JVM or CLR has bugs, malware can escape the sandbox and run arbitrary code.
What constitutes a software system's security policy in practice, and what is its ultimate foundation? It is mostly informal, built on people's expectations. It borrows from formal development documents. It references site and resource security policies. Security ultimately depends on end users' requirements and expectations.
Created by: user-1830624
Popular Computers sets

 

 



Voices

Use these flashcards to help memorize information. Look at the large card and try to recall what is on the other side. Then click the card to flip it. If you knew the answer, click the green Know box. Otherwise, click the red Don't know box.

When you've placed seven or more cards in the Don't know box, click "retry" to try those cards again.

If you've accidentally put the card in the wrong box, just click on the card to take it out of the box.

You can also use your keyboard to move the cards as follows:

If you are logged in to your account, this website will remember which cards you know and don't know so that they are in the same box the next time you log in.

When you need a break, try one of the other activities listed below the flashcards like Matching, Snowman, or Hungry Bug. Although it may feel like you're playing a game, your brain is still making more connections with the information to help you out.

To see how well you know the information, try the Quiz or Test activity.

Pass complete!
"Know" box contains:
Time elapsed:
Retries:
restart all cards