C836 WGU
C836 WGU
Study online at https://quizlet.com/_9yfe2w
1. bounds checking to set a limit on the amount of data we expect to receive to set aside storage for
that data
*required in most programming languages
* prevents buffer overflows
2. race conditions A type of software development vulnerability that occurs when multiple processes
or multiple threads within a process control or share access to a particular re-
source, and the correct handling of that resource depends on the proper ordering
or timing of transactions
3. input validation a type of attack that can occur when we fail to validate the input to our applications
or take steps to filter out unexpected or undesirable content
4. format string at- a type of input validation attacks in which certain print functions within a pro-
tack gramming language can be used to manipulate or view the internal memory of
an application
5. authentication A type of attack that can occur when we fail to use strong authentication mecha-
attack nisms for our applications
6. authorization at- A type of attack that can occur when we fail to use authorization best practices for
tack our applications
7. cryptographic at- A type of attack that can occur when we fail to properly design our security
tack mechanisms when implementing cryptographic controls in our applications
8. client-side attack A type of attack that takes advantage of weaknesses in the software loaded on
client machines or one that uses social engineering techniques to trick us into
going along with the attack
9. XSS (Cross Site an attack carried out by placing code in the form of a scripting language into a
Scripting) web page or other media that is interpreted by a client browser
10.
, C836 WGU
C836 WGU
Study online at https://quizlet.com/_9yfe2w
XSRF (cross-site an attack in which the attacker places a link on a web page in such a way that it
request forgery) will be automatically executed to initiate a particular activity on another web page
or application where the user is currently authenticated
11. SQL Injection At- Attacks against a web site that take advantage of vulnerabilities in poorly coded
tack SQL (a standard and common database software application) applications in or-
der to introduce malicious program code into a company's systems and networks.
12. clickjacking An attack that takes advantage of the graphical display capabilities of our browser
to trick us into clicking on something we might not otherwise
13. server-side at- A type of attack on the web server that can target vulnerabilities such as lack of
tack input validation, improper or inadequate permissions, or extraneous files left on
the server from the development process
14. Protocol is- Name the 4 main categories of database security issues
sues, unauthenti-
cated access, ar-
bitrary code exe-
cution, and privi-
lege escalation
15. web application A type of tool that analyzes web pages or web-based applications and searches for
analysis tool common flaws such as XSS or SQL injection flaws, and improperly set permissions,
extraneous files, outdated software versions, and many more such items
16. protocol issues unauthenticated flaws in network protocols, authenticated flaws in network pro-
tocols, flaws in authentication protocols
17. arbitrary code ex- An attack that exploits an applications vulnerability into allowing the attacker to
ecution execute commands on a user's computer.
* arbitrary code execution in intrinsic or securable SQL elements
18.
, C836 WGU
C836 WGU
Study online at https://quizlet.com/_9yfe2w
Privilege Escala- An attack that exploits a vulnerability in software to gain access to resources that
tion the user normally would be restricted from accessing.
* via SQL injection or local issues
19. validating user a security best practice for all software
inputs * the most effective way of mitigating SQL injection attacks
20. Nikto (and Wikto) A web server analysis tool that performs checks for many common server-side
vulnerabilities & creates an index of all the files and directories it can see on the
target web server (a process known as spidering)
21. burp suite A well-known GUI web analysis tool that offers a free and professional version; the
pro version includes advanced tools for conducting more in-depth attacks
22. fuzzer A type of tool that works by bombarding our applications with all manner of data
and inputs from a wide variety of sources, in the hope that we can cause the
application to fail or to perform in unexpected ways
23. MiniFuzz File A tool developed by Microsoft to find flaws in file-handling source code
Fuzzer
24. BinScope Binary A tool developed by Microsoft to examine source code for general good practices
Analyzer
25. SDL Regex Fuzzer A tool developed by Microsoft for testing certain pattern-matching expressions for
potential vulnerabilities
26. good sources of CERT, NIST 800, BSI, an organization's internal coding guidelines
secure coding
guidelines
27. OS hardening the process of reducing the number of available avenues through which our OS
might be attacked
C836 WGU
Study online at https://quizlet.com/_9yfe2w
1. bounds checking to set a limit on the amount of data we expect to receive to set aside storage for
that data
*required in most programming languages
* prevents buffer overflows
2. race conditions A type of software development vulnerability that occurs when multiple processes
or multiple threads within a process control or share access to a particular re-
source, and the correct handling of that resource depends on the proper ordering
or timing of transactions
3. input validation a type of attack that can occur when we fail to validate the input to our applications
or take steps to filter out unexpected or undesirable content
4. format string at- a type of input validation attacks in which certain print functions within a pro-
tack gramming language can be used to manipulate or view the internal memory of
an application
5. authentication A type of attack that can occur when we fail to use strong authentication mecha-
attack nisms for our applications
6. authorization at- A type of attack that can occur when we fail to use authorization best practices for
tack our applications
7. cryptographic at- A type of attack that can occur when we fail to properly design our security
tack mechanisms when implementing cryptographic controls in our applications
8. client-side attack A type of attack that takes advantage of weaknesses in the software loaded on
client machines or one that uses social engineering techniques to trick us into
going along with the attack
9. XSS (Cross Site an attack carried out by placing code in the form of a scripting language into a
Scripting) web page or other media that is interpreted by a client browser
10.
, C836 WGU
C836 WGU
Study online at https://quizlet.com/_9yfe2w
XSRF (cross-site an attack in which the attacker places a link on a web page in such a way that it
request forgery) will be automatically executed to initiate a particular activity on another web page
or application where the user is currently authenticated
11. SQL Injection At- Attacks against a web site that take advantage of vulnerabilities in poorly coded
tack SQL (a standard and common database software application) applications in or-
der to introduce malicious program code into a company's systems and networks.
12. clickjacking An attack that takes advantage of the graphical display capabilities of our browser
to trick us into clicking on something we might not otherwise
13. server-side at- A type of attack on the web server that can target vulnerabilities such as lack of
tack input validation, improper or inadequate permissions, or extraneous files left on
the server from the development process
14. Protocol is- Name the 4 main categories of database security issues
sues, unauthenti-
cated access, ar-
bitrary code exe-
cution, and privi-
lege escalation
15. web application A type of tool that analyzes web pages or web-based applications and searches for
analysis tool common flaws such as XSS or SQL injection flaws, and improperly set permissions,
extraneous files, outdated software versions, and many more such items
16. protocol issues unauthenticated flaws in network protocols, authenticated flaws in network pro-
tocols, flaws in authentication protocols
17. arbitrary code ex- An attack that exploits an applications vulnerability into allowing the attacker to
ecution execute commands on a user's computer.
* arbitrary code execution in intrinsic or securable SQL elements
18.
, C836 WGU
C836 WGU
Study online at https://quizlet.com/_9yfe2w
Privilege Escala- An attack that exploits a vulnerability in software to gain access to resources that
tion the user normally would be restricted from accessing.
* via SQL injection or local issues
19. validating user a security best practice for all software
inputs * the most effective way of mitigating SQL injection attacks
20. Nikto (and Wikto) A web server analysis tool that performs checks for many common server-side
vulnerabilities & creates an index of all the files and directories it can see on the
target web server (a process known as spidering)
21. burp suite A well-known GUI web analysis tool that offers a free and professional version; the
pro version includes advanced tools for conducting more in-depth attacks
22. fuzzer A type of tool that works by bombarding our applications with all manner of data
and inputs from a wide variety of sources, in the hope that we can cause the
application to fail or to perform in unexpected ways
23. MiniFuzz File A tool developed by Microsoft to find flaws in file-handling source code
Fuzzer
24. BinScope Binary A tool developed by Microsoft to examine source code for general good practices
Analyzer
25. SDL Regex Fuzzer A tool developed by Microsoft for testing certain pattern-matching expressions for
potential vulnerabilities
26. good sources of CERT, NIST 800, BSI, an organization's internal coding guidelines
secure coding
guidelines
27. OS hardening the process of reducing the number of available avenues through which our OS
might be attacked
