Secure Software – Questions & Solutions Compilation
Complete mediation Accurate Answer:- Where every request by a
subject to access an object in a computer system must undergo a valid and
effective authorization procedure
Open design Accurate Answer:- An access control system design
evaluated and tested by a large number of experts providing a more secure
authentication method than one that has not been widely assessed
Economy of mechanism Accurate Answer:- This promotes simple and
comprehensible design and implementation of protection mechanisms, so that
unintended access paths do not exist or can be readily identified and
eliminated
Least common mechanism Accurate Answer:- This principle states that
a minimum number of protective mechanisms should be common to multiple
users, as shared access paths can be sources of unauthorized information
exchange
Leveraging existing components Accurate Answer:- In many instances,
the security mechanisms of an information system are not configured
properly or used to their maximum capability. Reviewing the state and
settings of the extant security mechanisms and ensuring that they are
operating at their optimum design points will greatly improve the security
posture of an information system.
Psychological acceptability Accurate Answer:- refers to the ease of use
and intuitiveness of the user interface that controls and interacts with the
access control mechanisms. The user must be able to understand the user
interface and use it without having to interpret complex instructions.
Complete mediation Accurate Answer:- a. identification of the entity
making the access request
b. verification that the request has not changed since its initiation
c. application of the appropriate authorization procedures and
d. reexamination of previously authorized requests by the same entity.
, Analysis phase Accurate Answer:- The phase that determines how PII
will be handled to ensure that it conforms to applicable legal, regulatory, and
policy requirements regarding privacy
Third-party security assessment Accurate Answer:- An extensive
review that will be conducted by your software security architect, a third
party, or a combination of both
Data flow diagram (DFD) Accurate Answer:- The first step of the threat
modeling process; to develop a visual representation of the threat flows,
typically drawn during a whiteboard session
Software security policy Accurate Answer:- A policy intended to define
what needs to be protected and how it will be protected, including reviewing
and incorporating policies from outside the SDL that may impact the
development process
Software security evangelist (SSE) Accurate Answer:- This individual
has two roles, as an SSC in training and as an evangelist for the overall
software product security program promulgated policy, enforcing policy, and
evangelizing the overall SDL process
Software security champion (SSC) Accurate Answer:- There will ideally
be one of these roles per Tier 1 software product within each engineering
software product development group
Final security review Accurate Answer:- During this phase of software
being developed, all of the security activities performed, including threat
modeling, tools output, and performance against requirements defined early
in the process, are assessed again to determine whether the software product
is ready for release and shipping.
Privacy requirement verification Accurate Answer:- This verification is
typically verified concurrently with the final security review and in many
cases is now considered part of the same process
SDL policy compliance Accurate Answer:- This SDL component covers
all projects that have meaningful security and privacy risks and is analyzed in
each phase and updated to cover new threats and practices
Complete mediation Accurate Answer:- Where every request by a
subject to access an object in a computer system must undergo a valid and
effective authorization procedure
Open design Accurate Answer:- An access control system design
evaluated and tested by a large number of experts providing a more secure
authentication method than one that has not been widely assessed
Economy of mechanism Accurate Answer:- This promotes simple and
comprehensible design and implementation of protection mechanisms, so that
unintended access paths do not exist or can be readily identified and
eliminated
Least common mechanism Accurate Answer:- This principle states that
a minimum number of protective mechanisms should be common to multiple
users, as shared access paths can be sources of unauthorized information
exchange
Leveraging existing components Accurate Answer:- In many instances,
the security mechanisms of an information system are not configured
properly or used to their maximum capability. Reviewing the state and
settings of the extant security mechanisms and ensuring that they are
operating at their optimum design points will greatly improve the security
posture of an information system.
Psychological acceptability Accurate Answer:- refers to the ease of use
and intuitiveness of the user interface that controls and interacts with the
access control mechanisms. The user must be able to understand the user
interface and use it without having to interpret complex instructions.
Complete mediation Accurate Answer:- a. identification of the entity
making the access request
b. verification that the request has not changed since its initiation
c. application of the appropriate authorization procedures and
d. reexamination of previously authorized requests by the same entity.
, Analysis phase Accurate Answer:- The phase that determines how PII
will be handled to ensure that it conforms to applicable legal, regulatory, and
policy requirements regarding privacy
Third-party security assessment Accurate Answer:- An extensive
review that will be conducted by your software security architect, a third
party, or a combination of both
Data flow diagram (DFD) Accurate Answer:- The first step of the threat
modeling process; to develop a visual representation of the threat flows,
typically drawn during a whiteboard session
Software security policy Accurate Answer:- A policy intended to define
what needs to be protected and how it will be protected, including reviewing
and incorporating policies from outside the SDL that may impact the
development process
Software security evangelist (SSE) Accurate Answer:- This individual
has two roles, as an SSC in training and as an evangelist for the overall
software product security program promulgated policy, enforcing policy, and
evangelizing the overall SDL process
Software security champion (SSC) Accurate Answer:- There will ideally
be one of these roles per Tier 1 software product within each engineering
software product development group
Final security review Accurate Answer:- During this phase of software
being developed, all of the security activities performed, including threat
modeling, tools output, and performance against requirements defined early
in the process, are assessed again to determine whether the software product
is ready for release and shipping.
Privacy requirement verification Accurate Answer:- This verification is
typically verified concurrently with the final security review and in many
cases is now considered part of the same process
SDL policy compliance Accurate Answer:- This SDL component covers
all projects that have meaningful security and privacy risks and is analyzed in
each phase and updated to cover new threats and practices
