Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
CH1ClassifyingVulner
Software Vulnerability Fundamentals_Introduction : The Art of Software Security
| Question | Answer |
|---|---|
| What is a vulnerability class? | A set of software vulnerabilities that share a unifying commonality, pattern, or concept. |
| What are vulnerability classes, and do they follow a single, clean taxonomy? | Def:Mentaldevicesused2conceptualize/understand/communicatesoftwareflaws Taxonomy:Nosingle/clean/nonoverlappingclassificationsysexists Overlap:singlevulnerabilitybelong2multiclasses Variables:Classificationdependsonauditorsterminology/sys/perspective |
| How are vulnerabilities categorized in this book? | No rigid, formal taxonomy. Pragmatic, consistent fashion. Tailored to fit the material. |
| Why are some software vulnerabilities best tackled from different architectural perspectives (e.g., component interactions vs. system call sequences)? | Vulnerability nature varies. Perspectives reveal specific flaws. High-level views show component errors. Low-level views expose system-call issues. |
| What is the primary purpose of this book regarding security literature? | To explain terms, concepts, and taxonomies so you can keep them in context. |
| What are the three vulnerability classes mapped to the Software Development Life Cycle (SDLC) phases? | Design vulnerabilities: SDLC phases 1, 2, and 3. Implementation vulnerabilities: SDLC phases 4 and 5. Operational vulnerabilities: SDLC phase 6. |
| What are the three main categories of software security vulnerabilities? | Design: Architectural or specification flaws. Implementation: Low-level technical flaws in construction. Operational: Deployment or configuration flaws in an environment. |
| What is a software design vulnerability? | A problem caused by a fundamental mistake or oversight in a software's design. |
| Why is software with a design flaw insecure, even if it runs exactly as written? | It was designed to do the wrong thing. Coding is correct. Logic is flawed. |
| What causes flaws related to production environment assumptions and risk exposure? | Flaw Type: Architectural or Design Flaws Root Cause: Incorrect assumptions about the deployment environment Risk Factors: Misjudging exposure levels of production program components |
| What are design flaws also referred to as? | High-level vulnerabilities Architectural flaws Problems with program requirements or constraints |
| What drives the design of a software system in the SDLC? | The definition of software requirements. |
| What are software requirements? | A list of objectives a software system must meet to accomplish the goals of its creators. |
| What does an engineer typically construct after receiving a set of requirements? | Design specifications |
| What do software specifications focus on? | They focus on how to create the software. They show how to meet the project goals. |
| What two main things do software system requirements address? | What system must accomplish:specific tasks/functions it performs (Ex:Allow user2retrieve a transaction file from a server). capabilities it must have: The performance levels or limits it must support (Ex: Support 100 simultaneous downloads per hour). |
| What are specifications in programming? | The plans for how a program should be constructed to meet the requirements. |
| What three main types of information are typically included in software system specifications? | Component descriptions: Overview of the different parts. Implementation and functionality: How they work and what they do. Component interaction: How the different parts work together. |
| What technical documentation formats are used to detail specifications? | Architecture diagrams Logic diagrams Process flowcharts Interface and protocol specifications Class hierarchies |
| What two distinct issues do people usually lump together when they speak of a "design flaw" in software? | Software requirements (what the system should do) Software specifications (how the system should do it) |
| What distinction is often missed when people discuss a software "design flaw"? | The distinction between a problem with requirements versus a problem with specifications. Why it is missed: High-level issues can often be explained as either an oversight in requirements or a mistake in specifications. |
| Give an example using TELNET vs. SSH of how people often fail to make a distinction between a problem with requirements and a problem with specifications because it is difficult to separate them | TELNET: Suffers from a design flaw because uses unencrypted communication, leaving usernames/passwords vulnerable to sniffing/session hijacking. SSH: Fixes design flaw by serving same purpose but encrypting all communications to stop sniffing threats. |
| What is an implementation vulnerability? | A security flaw where the code performs its intended function, but the way it executes introduces a security risk. |
| When do implementation vulnerabilities occur, and where do they often carry over? | Occur during: The SDLC implementation phase. Carry over into: The integration and testing phase. |
| What are the two main causes of security vulnerabilities during software implementation? (implementation vulnerabilities) | Design deviation: Code alters the original design to fix technical discrepancies. Platform/Language nuances: Technical artifacts and specific quirks of the development environment. |
| What is another name for implementation vulnerabilities? | Low-level flaws Technical flaws |
| Why does the code review process include many examples of implementation vulnerabilities? | Identifying technical flaws is a primary charge of code review. |
| What are two well-publicized examples of implementation vulnerabilities? | Buffer overflows SQL injection |
| How can implementation vulnerabilities in specific TELNET daemon implementations lead to unauthorized root access? | enviorment var:Uncleansed user var exploitUNIXdynamiclinking2elevateprivileges Memoryflaws:Bufferoverflows/formatstringattackstargetunauthenticateddaemons Remoteexe:Attackersissuecommandsasprivilegedusers Impact:Exploitingflawsgrantsimmediaterootprompt |
| Operational Vulnerabilities (Definition) | Security problems arising from: Operational procedures General use of software Specific deployment environments |
| What distinguishes operational vulnerabilities from source code vulnerabilities? | Not in source code. Rooted in environment interactions. |
| What do operational vulnerabilities include? | Operational vulnerabilities include: Issues with software configuration in its environment Issues with supporting software and computer configurations Issues caused by automated and manual processes around the system |
| What operational vulnerabilities involve directly targeting the human users of a system? | Social engineering Theft |
| When do operational vulnerabilities occur in the Software Development Life Cycle (SDLC)? | Primary phase: Operation and maintenance phase. Overlapping phase: Integration and testing phase. |
| What operational security vulnerability exists in the daily data-update procedure for the automated securities trading system? | Flawed process: Admins log in daily via TELNET to update trading weights. Core vulnerability:TELNET lacks encryption. Primary risks: Exposes the system to sniffing and connection hijacking Impact:Increases the risk of potential fraud and system attacks |
| Why is the boundary between design vulnerabilities and implementation vulnerabilities often blurred in the SDLC? | Overlapping root causes:Unanticipated implementation issues often stem from a design that failed to address prob. Micro-designing:Programmers continuously design lower-level components (classes/funct/loops) while implementing a high-level specification |
| definition of a design vulnerability | In general, when people refer to design vulnerabilities, they mean high-level issues with program architecture, requirements, base interfaces, and key algorithms. |
| definition of an implementation vulnerability: | Security issues n design of low lvl prog pieces(partsofindividualfunctions/classes)rconsidered2bimplementationvulnerabilities.Implementationvulnerabilitiesincludemorecomplexlogicelementsthatrntnormallyaddressed ndesignspecissuesrcalledlogicvulnerabilities |
| Why is the boundary between operational vulnerabilities and design/implementation vulnerabilities often blurred? | No clear distinction exists between them. Insecure installation can be viewed as both. Environment issues are often blamed on design. Applications should handle environmental risks safely. |
| definition of an operational vulnerability | used 4 issues that deal with unsafe dev/configuration of software/unsound management/administration practices surrounding software, issues with supporting components(application/Web servers/direct attacks on the software’s users. |
| Are the definitions of design, implementation, and operational vulnerabilities an infallible, formal system for labeling software flaws? | No. They overlap and leave room for interpretation. They are simply a useful way to approach and study software vulnerabilities. |
Created by:
user-1830624
Popular Computers sets