FREEMANSHARP

What is a denial-of-service attack? An attack that prevent the system from receiving, processing, or responding to legitimate traffic or requests for resources and objects What is spoofing attack? The attacker pretends to be someone or something other than whom they are. They can spoof identities, IP addresses, email addresses, and phone numbers. They often replace the valid source and /or destination IP address and node numbers with false ones. What are countermeasures to spoofi...

Confidentiality means that the private and sensitive data handled by the application cannot be read by anyone who is not explicitly authorized to view it. Intregrity means that the data processed by an application is not modified by any unauthorized channels or any unauthorized persons. Availability the system's ability to remain operational even in the face of failure or attack. Cleartext or Plaintext information that is not encrypted. Ciphertext information th...

Design & Development (A3) Stage A3 Policy compliance analysis Security test plan composition Static Analysis Threat model updating Design security analysis and review Privacy implementation assessment During this phase, any policy that exists outside the domain of the SDL policy is reviewed and might include policies from outside the development organization that set security and privacy requirements and guidelines to be adhered to when developing software or applications. What is t...

Define maintenance updating software systems to improve or correct them Define incident response plan the documented steps to follow when system attack or failure occurs What 8 elements should an incident response plan document? - monitoring duties for production software - a definition for incidents; - a contact for incidents; - emergency contact for priority incidents; - a clear escalation chain - software shutdown procedures - attack specific procedures - security docs...

What is the Secure Development Lifecycle? Secure Development Lifecycle. The SDL is the sum of tools, people, models, methodologies, blueprints, metrics that help make systems/software secure. It is focused on baking security into the software/system. What is the TCSDL The trustworthy Computing Security Development Lifecycle was designed by Microsoft and adopted for the development of software needed to withstand attacks. Explain BSIMM. Building Security in Maturity Model is a softwa...

Prioritize security over other requirements. Which one of the following is not a principle of Agile development? Foreign key Which one of the following key types is used to enforce referential integrity between database tables? Gantt What type of chart provides a graphical illustration of a schedule that helps to plan, coordinate, and track project tasks? Isolation What transaction management principle ensures that two transactions do not interfere with each other as the...

Which one of the following types of attacks relies on the difference between the timing of two events? TOCTOU What technique may be used to limit the effectiveness of rainbow table attacks? Salting What character should always be treated carefully when encountered as user input on a web form? ' What type of virus utilizes more than one propagation technique to maximize the number of penetrated systems? Multipartite virus What advanced virus technique modifies the...

Complete Mediation Every request by a subject to access an object in a computer system must undergo a valid and effective authorization procedure Entails: (a) identification of the entity making the access request; (b) verification that the request has not changed since its initiation; (c) application of the appropriate authorization procedures; and (d) reexamination of previously authorized requests by the same entity. Open Design an open-access control system design that has been eva...

Protecting the software and the systems on which it runs after release, after dev is complete Application security Three core elements of security Confidentiality, integrity, and availability (the C.I.A. model Tools that look for a fixed set of patterns or rules in the code in a manner similar to virus-checking programs Static analysis tools Ensures that the user has the appropriate role and privilege to view data Authorization Ensures that the user is who he or s...

Confidentiality In information security, confidentiality "is the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes" Integrity In information security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire life-cycle. This means that data cannot be modified in an unauthorized or undetected manner. This can be also used to validate databases to make sure none of the data is cor...

ISO/IEC 27034-1:2011 A standard for application security which offers a concise, internationally recognized way to get transparency into a vendor/supplier's software security management process ISO/IEC 27034 standard provides guidance to help organizations embed security within their processes that help secure applications running in the environment, including application life cycle processes. Trustworthy Computing Security Development Lifecycle The most widely used security develop...

Which due diligence activity for supply chain security should occur in the initiation phase of the software acquisition life cycle? -Facilitating knowledge transfer between suppliers -Lessening the risk of disseminating information during disposal -Mitigating supply chain security risk by providing user guidance -Developing a request for proposal (RFP) that includes supply chain security risk management -Developing a request for proposal (RFP) that includes supply chain security risk manage...

Open Design Security Principle security of a mechanism should not depend on the secrecy of its design or implementation Strategic attacks user general targeting against a broad industry. highly repeatable and Tactical attacks surgical by nature, have highly specific targeting, and are technologically sophisticated User specific attacks can be strategic, tactical, or personal in nature, and target personal devices that may be either consumer or enterprise owned. So...

Which statement is true of a software development life cycle? A Workload testing should be performed while designing the functional requirements. B Parallel testing verifies whether more than one system is available for redundancy. C A software programmer should be the only person to develop the software, test it, and submit it to production D Unit testing should be performed by the developer and the quality assurance team. Answer D is correct. Unit testing should be performed by t...

access control The restriction of persons or programs that may access specific information. There are two default policies for this: allow by exception or deny by exception. Access Control List (ACL) The list of persons or programs that are allowed (or, in the case of blacklisting, not allowed) to access a particular resource. Access List Traffic-Based Security plan (ALTBS) A network with no other security measures in place besides a router-based access control list. Acti...

CIA Triad Confidentiality, Integrity, Availability Confidentiality Confidentiality is the concept of the measures used to ensure the protection of the secrecy of data, objects, or resources. Concepts, conditions, and aspects of confidentiality include the following: Sensitivity Discretion Criticality Concealment Secrecy Privacy Seclusion Isolation Integrity Integrity is the concept of protecting the reliability and correctness of data. Concepts, conditions, and a...

Which due diligence activity for supply chain security should occur in the initiation phase of the software acquisition life cycle? Developing a request for proposal (RFP) that includes supply chain security risk management Which due diligence activity for supply chain security investigates the means by which data sets are shared and assessed? A document exchange and review Identification of the entity making the access request Verification that the request has not changed since...

Which due diligence activity for supply chain security should occur in the initiation phase of the software acquisition life cycle? A Developing a request for proposal (RFP) that includes supply chain security risk management B Lessening the risk of disseminating information during disposal C Facilitating knowledge transfer between suppliers D Mitigating supply chain security risk by providing user guidance A Which due diligence activity for supply chain security investigates the m...

Confidentiality Information is not made available or disclosed to unauthorized individuals, entities, or processes. Ensures unauthorized persons are not able to read private and sensitive data. It is achieved through cryptography. Integrity Ensures unauthorized persons or channels are not able to modify the data. It is accomplished through the use of a message digest or digital signatures. Availability The computing systems used to store and process information, the security con...

What are the types of cybercrime investigation approaches? Civil Criminal Administrative Punative Describe civil cybercrime investigation Describe Criminal cybercrime investigation Describe administrative cybercrime investigation Describe Punitive cybercrime investigation What type of cybercrime investigation is being used when warnings for policy violations are performed? Administrative cybercrime investigation What is Enterprise Theory of Investig...