C706 - SECURE SOFTWARE DESIGN EXAM GUIDE WITH 100% CORRECT ANSWERS|GUARANTEED SUCCESS

Complete Mediation Every request by a subject to access an object in a computer system must undergo a valid and effective authorization procedure Entails: (a) identification of the entity making the access request; (b) verification that the request has not changed since its initiation; (c) application of the appropriate authorization procedures; and (d) reexamination of previously authorized requests by the same entity. Open Design an open-access control system design that has been evaluated and tested by a large number of experts Economy of Mechanism simple and comprehensible design & implementation of protection mechanisms so that unintended access paths don't exist or can be identified & eliminated Least Common Mechanism a minimum number of protective mechanisms should be common to multiple users because shared access paths can provide unauthorized information exchange (covert channels) Psychological acceptability ease of use and intuitiveness of user interface that controls & interacts with the access control mechanisms Weakest link Identifying and adding layers of defense to the weakest mechanisms in the security chain Leveraging Existing Components Reviewing the state and settings of the extant security mechanisms and ensuring that they are operating at their optimum design points to improve the security posture of an information system Fail safe A system should fail to a state where the security of the system & its data are not compromised Confidentiality data is only available to the people intended to access it Integrity data & system resources are only changed in appropriate ways by appropriate people Availability Systems are ready when needed and perform acceptably Authentication Identity of users is established Authorization Users are explicitly allowed or denied access to resources Nonrepudiation Users can't perform an action and later deny performing it Primary dataflow Functional security requirement involving receiving, processing, storing, transmitting, and delivering in report form Logging Nonfunctional security requirement to capture information correctly and a way to store the information to help support later audits Sensitivity Quality of information which could cause harm or damage if disclosed Discresion Act of decision where an operator can influence or control disclosure to minimize harm or damage Criticality level to which information is mission critical Concealment act of hiding or preventing disclosure Secrecy keeping something a secret or preventing the disclosure of information Privacy keeping information confidential that is personally identifiable or might cause harm, embarrassment, or disgrace if revealed Security Through Obscurity attempting to gain protection through hiding, silence, or secrecy Injection vulnerabilities allow an attacker to supply some type of code to the web application as input and trick the web server into executing the code or supplying it to another server to execute Code Injection Attack attacker attempts to insert attacker-written code into the legitimate code created by a web app developer