WGU MSCSIA C706 Chapters 1 -4 GRADED A+ EXAM WITH 100% CORRECT ANSWERS

Confidentiality means that the private and sensitive data handled by the application cannot be read by anyone who is not explicitly authorized to view it. Intregrity means that the data processed by an application is not modified by any unauthorized channels or any unauthorized persons. Availability the system's ability to remain operational even in the face of failure or attack. Cleartext or Plaintext information that is not encrypted. Ciphertext information that is encrypted. Encryption in secret key cryptography, a single key is used to run an algorithm to transform plaintext to ciphertext. Confusion states that the key should have a complex relationship to the ciphertext (i.e., each bit of the key affects as many bits of the ciphertext as possible) to prevent an attacker from discovering part of the key from the ciphertext. Diffusion states that the ciphertext should have a complex, nonlinear relationship to the plaintext (each bit of the plaintext affecting as many bits of the ciphertext as possible) such that it cannot be exploited by an attacker. Prevention the assertion that an attack absolutely cannot happen to or through your system. Avoidance is a best attempt at making sure that attacks do not affect your system. Scope creep a software system taking on more and more functionality as it is developed. Waterfall mode SDLC 1. requirements analysis 2. design 3. construction 4. test 5. installation 6. operation 7. maintenance 8. retirement. COTS Commercial Off The Shelf FOSS Free Open Source Software Verification determination of whether the product is being built correctly; this is the part that should be done before the product is viewed by customers. Validation testing of whether the correct product is being built; this is the testing that should be conducted by the end users of a system. Apply defense in depth make sure there are no holes in your application. Minimize the attack surface make sure the only openings in your system are the ones you want. Run with least privilege use the bare minimum privileges when operating your software. Avoid security by obscurity trusting that your software is secure because it is complex or nontraditional is a bad idea. Do not trust services assuming security will be handled by another service is a very bad idea. Establish secure defaults do not trust the end user to turn on security features. Attack exploitation of a vulnerability in a software system that causes the system to fail or otherwise misbehave from what is expected in normal operation. Backdoor method of circumventing normal authentication procedures and allowing unwanted access into a computer system. Cryptography science of transforming information from a humanly readable message to indecipherable information that can only be recovered by persons privy to a secret that transforms the information back into a readable form. Decryption process of turning ciphertext back into plaintext through the use of a key. Spyware type of malicious software that records aspects of an end user's machine and reports it back to a remote location where it can be analyzed and exploited; a common instance of this type of malware is a keylogger. Threat possible exploit of a vulnerability where an attack is the actual use of such an exploit. Threat agent anyone or anything that could potentially harm your software. Threat analysis consideration and ranking of the most likely targets and threat agents for a software system.