Secure Software Design – WGU C706: Questions With
Logical Solutions
Software Security Accurate Answer:- About building security into the
software through a SDL in an SDLC
Application Security Accurate Answer:- Protecting the software and the
systems on which it runs after release
Software Development Lifecycle Accurate Answer:- A software
development process used to reduce software maintenance costs and increase
reliability of software concerning software security related bugs
1: reduce the number of security vulnerabilities and privacy problems
2: reduce the severity of the vulnerabilities that remain
static analysis tools Accurate Answer:- look for a fixed set of patterns or
rules in the code in a manner similar to virus-checking programs
Least Privilege Accurate Answer:- a principle that users be granted the
privilege for some activity only if there is a justifiable need to grant this
authorization
Defense in Depth Accurate Answer:- A defense that uses multiple types
of security devices to protect a network. Also called layered security.
Secure code vs Quality Code Accurate Answer:- Secure code does not
mean quality code
Quality code does not mean secure code
SDL Security Goals Accurate Answer:- Confidentiality
Integrity
Availability
Information security Accurate Answer:- The protection of information
and information systems from unauthorized access, use, disclosure,
,disruption, modification, or destruction in order to provide confidentiality,
integrity, and availability
Confidentiality Accurate Answer:- Preserving authorized restrictions
on information access and disclosure, including means for protecting personal
privacy and proprietary information
Integrity Accurate Answer:- Guarding against improper information
modification or destruction, and includes ensuring information non-
repudiation and authenticity
Availability Accurate Answer:- Ensuring timely and reliable access to
and use of information
Authorization and authentication Accurate Answer:- two properties
that support confidentiality
authorization ensures that the user has the appropriate role and privilege to
view data
authentication ensures that the user is who he or she claims to be and that the
data come from the appropriate place.
Threat Modeling Accurate Answer:- Understand the potential security
threats to the system, determine risk, and establish appropriate mitigations
(What? How bad is it? How can it be fixed?)
the earlier security risks are identified and managed in the software lifecycle,
the better
Attack Surface Accurate Answer:- testing should cover the entry points
and exit points of an application that may be accessible to an attacker
ex. code that is restricted to local access by an administrator has a smaller
attack surface than code exposed to remote access by an anonymous user
Modeling Software Accurate Answer:- A way to envision the
interactions of the proposed software within its intended environment.
,The better the model reflects the intended environment, the more useful the
modeling approach becomes
BSIMM Accurate Answer:- Building Security In Maturity Model.
The BSIMM is a study of real-world software security initiatives organized so
that you can determine where you stand with your software security initiative
and how to evolve your efforts over time
OWASP Software Assurance Maturity Model (SAMM) Accurate Answer:-
flexible and prescriptive framework for building security into a software
development organization
self-assess their security assurance program and then use recommended
roadmaps to improve in a way that is aligned to the specific risks facing the
organization
SAFECode Accurate Answer:- nonprofit organization dedicated to
increasing trust in information and communications technology products and
services through the advancement of effective software assurance methods.
SAFECode is a global, industry-led effort to identify and promote best
practices for developing and delivering more secure and reliable software,
hardware, and services
U.S. Department of Homeland Security Software Assurance Program
Accurate Answer:- seeks to reduce software vulnerabilities, minimize
exploitation, and address ways to improve the routine development and
deployment of trustworthy software products
Common Weakness Enumeration (CWE)
National Institute of Standards and Technology Accurate Answer:-
great value in providing research, information, and tools for both the
government and corporate information security community
NIST SAMATE (Software Assurance Metrics And Tool Evaluation) project is
dedicated to improving software assurance by developing methods to enable
, software tool evaluations, measuring the effectiveness of tools and techniques,
and identifying gaps in tools and methods
The National Vulnerability Database (NVD) is the U.S. government repository
of standards-based vulnerability management data represented using the
Security Content Automation Protocol (SCAP)
MITRE Corporation Common Computer Vulnerabilities and Exposures
Accurate Answer:- a list of information security vulnerabilities and
exposures that aims to provide common names for publicly known problems.
The goal of CVE is to make it easier to share data across separate vulnerability
capabilities with this "common enumeration."
SANS Institute Top Cyber Security Risks Accurate Answer:- a consensus
list of the most critical problem areas in Internet security that require
immediate remediation if present on your systems. Step-by-step instructions
and pointers to additional information useful for correcting these security
flaws are included as part of the list
U.S. Department of Defense Cyber Security and Information Systems
Information Analysis Center (CSIAC) Accurate Answer:- performs the
Basic Center of Operations (BCO) functions necessary to fulfill the mission and
objectives applicable to the DoD(RDT&E) and Acquisition communities' needs
for cyber security, information assurance, knowledge management and
information sharing, software-intensive systems engineering, and modeling
and simulation
CERT, Bugtraq, and SecurityFocus Accurate Answer:- CERT provides
timely alerts on security vulnerabilities as well as a weekly summarized
bulletin on vulnerabilities
Bugtraq is an electronic security mailing list that provides information on
security vulnerabilities as well as security bulletins and announcements from
vendors
Bugtraq is part of the SecurityFocus security portal which is currently owned
by Symantec
Logical Solutions
Software Security Accurate Answer:- About building security into the
software through a SDL in an SDLC
Application Security Accurate Answer:- Protecting the software and the
systems on which it runs after release
Software Development Lifecycle Accurate Answer:- A software
development process used to reduce software maintenance costs and increase
reliability of software concerning software security related bugs
1: reduce the number of security vulnerabilities and privacy problems
2: reduce the severity of the vulnerabilities that remain
static analysis tools Accurate Answer:- look for a fixed set of patterns or
rules in the code in a manner similar to virus-checking programs
Least Privilege Accurate Answer:- a principle that users be granted the
privilege for some activity only if there is a justifiable need to grant this
authorization
Defense in Depth Accurate Answer:- A defense that uses multiple types
of security devices to protect a network. Also called layered security.
Secure code vs Quality Code Accurate Answer:- Secure code does not
mean quality code
Quality code does not mean secure code
SDL Security Goals Accurate Answer:- Confidentiality
Integrity
Availability
Information security Accurate Answer:- The protection of information
and information systems from unauthorized access, use, disclosure,
,disruption, modification, or destruction in order to provide confidentiality,
integrity, and availability
Confidentiality Accurate Answer:- Preserving authorized restrictions
on information access and disclosure, including means for protecting personal
privacy and proprietary information
Integrity Accurate Answer:- Guarding against improper information
modification or destruction, and includes ensuring information non-
repudiation and authenticity
Availability Accurate Answer:- Ensuring timely and reliable access to
and use of information
Authorization and authentication Accurate Answer:- two properties
that support confidentiality
authorization ensures that the user has the appropriate role and privilege to
view data
authentication ensures that the user is who he or she claims to be and that the
data come from the appropriate place.
Threat Modeling Accurate Answer:- Understand the potential security
threats to the system, determine risk, and establish appropriate mitigations
(What? How bad is it? How can it be fixed?)
the earlier security risks are identified and managed in the software lifecycle,
the better
Attack Surface Accurate Answer:- testing should cover the entry points
and exit points of an application that may be accessible to an attacker
ex. code that is restricted to local access by an administrator has a smaller
attack surface than code exposed to remote access by an anonymous user
Modeling Software Accurate Answer:- A way to envision the
interactions of the proposed software within its intended environment.
,The better the model reflects the intended environment, the more useful the
modeling approach becomes
BSIMM Accurate Answer:- Building Security In Maturity Model.
The BSIMM is a study of real-world software security initiatives organized so
that you can determine where you stand with your software security initiative
and how to evolve your efforts over time
OWASP Software Assurance Maturity Model (SAMM) Accurate Answer:-
flexible and prescriptive framework for building security into a software
development organization
self-assess their security assurance program and then use recommended
roadmaps to improve in a way that is aligned to the specific risks facing the
organization
SAFECode Accurate Answer:- nonprofit organization dedicated to
increasing trust in information and communications technology products and
services through the advancement of effective software assurance methods.
SAFECode is a global, industry-led effort to identify and promote best
practices for developing and delivering more secure and reliable software,
hardware, and services
U.S. Department of Homeland Security Software Assurance Program
Accurate Answer:- seeks to reduce software vulnerabilities, minimize
exploitation, and address ways to improve the routine development and
deployment of trustworthy software products
Common Weakness Enumeration (CWE)
National Institute of Standards and Technology Accurate Answer:-
great value in providing research, information, and tools for both the
government and corporate information security community
NIST SAMATE (Software Assurance Metrics And Tool Evaluation) project is
dedicated to improving software assurance by developing methods to enable
, software tool evaluations, measuring the effectiveness of tools and techniques,
and identifying gaps in tools and methods
The National Vulnerability Database (NVD) is the U.S. government repository
of standards-based vulnerability management data represented using the
Security Content Automation Protocol (SCAP)
MITRE Corporation Common Computer Vulnerabilities and Exposures
Accurate Answer:- a list of information security vulnerabilities and
exposures that aims to provide common names for publicly known problems.
The goal of CVE is to make it easier to share data across separate vulnerability
capabilities with this "common enumeration."
SANS Institute Top Cyber Security Risks Accurate Answer:- a consensus
list of the most critical problem areas in Internet security that require
immediate remediation if present on your systems. Step-by-step instructions
and pointers to additional information useful for correcting these security
flaws are included as part of the list
U.S. Department of Defense Cyber Security and Information Systems
Information Analysis Center (CSIAC) Accurate Answer:- performs the
Basic Center of Operations (BCO) functions necessary to fulfill the mission and
objectives applicable to the DoD(RDT&E) and Acquisition communities' needs
for cyber security, information assurance, knowledge management and
information sharing, software-intensive systems engineering, and modeling
and simulation
CERT, Bugtraq, and SecurityFocus Accurate Answer:- CERT provides
timely alerts on security vulnerabilities as well as a weekly summarized
bulletin on vulnerabilities
Bugtraq is an electronic security mailing list that provides information on
security vulnerabilities as well as security bulletins and announcements from
vendors
Bugtraq is part of the SecurityFocus security portal which is currently owned
by Symantec
