CSSLP Chapter 1 - Secure Software Concepts

CSSLP Chapter 1 - Secure Software Concepts

What is the iron triangle?

Schedule, Scope, and Cost.

What are the core security concepts?

Confidentiality, Integrity, Availability.

What is authentication?

The security concept that answers the question "Are you who you claim to be."

What is nonrepudiation?

Deniability of actions taken by either a user or software on behalf of a user.

What is a clipping level?

A predetermined, baseline level of allowable errors, such as user errors.

What is economy of mechanism?

Keep it simple. Complexity -> greater vulnerabilities.

What is complete mediation?

A security principle that ensures that authority is not circumvented in subsequent requests of an object by a subject by checking for authorization (rights and privileges) upon every request for the object.

Least Common Mechanisms

The security principle of least common mechanisms disallows the sharing of mechanisms that are common to more than one user or process if the users and processes are at different levels of privilege

What is a vulnerability?

A weakness or flaw that could be accidently triggered or intentionally exploited by an attacker, resulting in the breach or breakdown of the security policy

What is a threat?

A threat is merely the possibility of an unwanted, unintended, or harmful event occurring.

What is a threat agent?

Anyone or anything that has the potential to make a threat materialize is known as the threat source or threat agent.

What is an attack?

When the threat agent actively and intentionally causes a threat to happen, it is referred to as an "attack" and the threat agents are commonly referred to as "attackers."

How do you quantify risk?

Risk is conventionally expressed as the product of the probability of a threat source/agent taking advantage of a vulnerability and the corresponding impact.

What is SLE?

It is calculated as the product of the value of the asset (usually expressed monetarily) and the exposure factor, which is expressed as a percentage of asset loss when a threat is materialized.

What is SLE?

It is calculated as the product of the value of the asset (usually expressed monetarily) and the exposure factor, which is expressed as a percentage of asset loss when a threat is materialized. SLE = ASSET VALUE ($) x EXPOSURE FACTOR (%)

What is exposure factor?

Percentage of asset loss when a threat is materialized.

What is ARO?

The ARO is an expression of the number of incidents from a particular threat that can be expected in a year.

What is ALE?

ALE is an indicator of the magnitude of risk in a year. ALE is a product of SLE x ARO

When should you accept risk?

When the cost of mitigating the risk exceeds the risk of accepting it.

What are the 4 risk management options?

Avoid, Transfer, Mitigate, Accept

What is crossover error rate?

The point at which the false rejection rate equals the false acceptance rate.

What should a security policy specify?

What needs to be protected and the repercussions of noncompliance. Goals and objectives.

What are the benefits of adopting a coding standard?

Consistency in style, improved code readability, and maintainability are some of the nonsecurity related benefits one gets when they follow a coding standard.

What is instrumentation?

Instrumentation is the inline commenting of code that is used to describe the operations undertaken by a code section.

What are the 12 PCI-DSS foundational requirements?

1. Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor supplied defaults for system passwords and other security parameters. 3. Protect stored cardholder data. 4. Encrypt transmissions of cardholder data across open, public networks. 5. Use and regularly update antivirus software. 6. Develop and maintain secure systems and applications. 7. Restrict access to cardholder data by business need to know. 8. Assign a unique ID to each person with computer access. 9. Restrict physical access to cardholder data. 10. Track and monitor all access to network resources and cardholder data. 11. Regularly test security systems and processes. 12. Maintain a policy that addresses information security.

What is NIST SP 800-64?

Security considerations in the System Development LifeCycle.

What is NIST 800-12?

Introduction to Computer Security

What are the categories of information system security controls?

Management, operational, and technology.

What is NIST 800-14?

Generally Accepted Principles and Practices for Securing IT Systems

What is NIST 800-30?

Risk Management Guide for IT

What is NIST 800-100?

Information Security Handbook: A Guide for Managers

What is ISO/IEC 27000:2009?

Information Security Management System (ISMS) Overview and Vocabulary

What is ISO/IEC 27000:2009?

Information Security Management System (ISMS) Overview and Vocabulary

What is ISO/IEC 27001:2005?

Information Security Management Systems

What is ISO/IEC 27002:2005?

Code of Practice for Information Security Management

What is ISO/IEC 27005:2008?

Information Security Risk Management

What is ISO/IEC 27006:2007?

Requirements for Bodies Providing Audit and Certification of Information Security Management Systems

What is ISO/IEC 15408?

Evaluating Criteria for IT Security (Common Criteria)

What are EALs?

Evaluation Assurance Levels

What are SFRs?

In the Common Criteria, they are Security Functional Requirements.

What are SARs?

In Common Criteria, Security Assurance Requirements.

What is a PP?

Protection Profile in the Common Criteria. Used to create a set of reusable, generalized security requirements.

What is CC EAL 1?

Functionally tested

What is CC EAL 2?

Structurally tested

What is CC EAL 3?

Methodically tested and checked

What is CC EAL 4?

Methodically designed, tested, and reviewed

What is CC EAL 5?

Semiformally designed and tested

What is CC EAL 6?

Semiformally verified design and tested

What is CC EAL 7?

Formally verified design and tested

What is ISO/IEC 21827:2008?

System Security Engineering Capability Maturity Model (SSE-CMM)

What is ISO/IEC 9216?

Software Engineering Product Quality

What are the six quality characteristics specified by ISO/IEC 9216?

Functionality, reliability, usability, efficiency, maintainability, and portability

What does FIPS 140-2 specify?

Security Requirement for Cryptographic Modules

What does FIPS 197 specify?

Advanced Encryption Standard

What does FIPS 201 specify?

Personal Identity Verification (PIV) of Federal Employees and Contractors

What is AES?

The AES algorithm is a symmetric block cipher that can be used to encrypt (convert humanly intelligible plaintext to unintelligible form called cipher text) and decrypt (convert cipher text to plaintext).

What are the OWASP top 10?

1. Injection. 2. Cross site scripting. 3. Broken authentication and session management. 4. Insecure direct object references. 5. Cross-site request forgery. 6. Security misconfiguration. 7. Failure to restrict URL access. 8. Unvalidated redirects and forwards. 9. Insecure cryptographic storage. 10. Insufficient transport layer protection.

What is OCTAVE?

Operationally Critical Threat, Asset, and Vulnerability Evaluation

Who developed OCTAVE?

Carnegie Mellon

What are the phases of Octave?

1. Build asset-based threat profiles. 2. Identify infrastructure vulnerabilities. 3. Develop security strategy and plans.

What is STRIDE?

A threat modeling methodology (Howard & LeBlanc, 2003) that is performed in the design phase of software development in which threats are grouped into six broad categories.

What are the 6 categories of threats in STRIDE?

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

What is DREAD?

A risk calculation or rating methodology

What are the five dimensions of DREAD?

Damage Potential, Reproducibility, Exploitability, Affected users, Discoverability

What is OSSTMM?

Open Source Security Testing Methodology Manual

What is OSSTMM?

Open Source Security Testing Methodology Manual

What is a STAR? What produces it?

A Security Test Audit Report. Produced by OSSTMM.

What is FHM?

The Flaw Hypothesis Method (FHM) is, as the name suggests, a vulnerability prediction and analysis method that uses comprehensive penetration testing to test the strength of the security of the software.

What are the phases of FHM?

Phase 1: Hypothesizing potential flaws in software. Phase 2: Confirmation of flaws by conducting actual simulation penetration tests and desk checking tests. Phase 3: Generalization of confirmed flaws to uncover other possibilities of weaknesses in the software. Phase 4: Addressing the discovered flaws in the software to mitigate risk.

What are the phases of FHM?

Phase 1: Hypothesizing potential flaws in software. Phase 2: Confirmation of flaws by conducting actual simulation penetration tests and desk checking tests. Phase 3: Generalization of confirmed flaws to uncover other possibilities of weaknesses in the software. Phase 4: Addressing the discovered flaws in the software to mitigate risk.

What is Six Sigma?

A methodology that measures quality with a target of no more than 3.4 defects per million opportunities.

What are the key submethodologies in Six Sigma?

DMAIC (define, measure, analyze, improve, and control), which is used for incremental improvement of existing processes that are below Six Sigma quality. DMADV (define, measure, analyze, design, and verify), which is used to develop new processes for Six Sigma products and services.

What is CMMI?

Capability Maturity Model Integration

What is SCAMPI?

Standard CMMI Appraisal Method for Process Improvement

What are the 5 CMMI levels?

Initial (Level 1): ad hoc, poorly controlled, reactive, unpredictable. Repeatable (Level 2): reactive, project-level, repeatable and managed by basic tracking of cost and schedule. Defined (Level 3): organizational processes established and continuously improved, characterized and proactive. Managed Quantitatively (Level 4): processes measured against metrics and controlled. Optimizing (Level 5): continuous process improvement through innovative technologies and incremental improvements.

What is the Zachman Framework?

A 6x6 matrix that factors in six reification transformations (strategist, owner, designer, builder, implementer, and workers) along the rows and six communication interrogatives (what, how, where, who, when, and why) as columns.

Describe SABSA.

Sherwood Applied Business Security Architecture. A framework for developing risk-based enterprise security architectures and for delivering security solutions that support business initiatives, based on the premise that security requirements are determined from the analysis of business requirements. Layers: Business/Contextual, Architect/Conceptual, Designer/Logical, Builder/Physical, Tradesman/Component, Facilities manager/Operational.

Describe SABSA.

Sherwood Applied Business Security Architecture. A framework for developing risk-based enterprise security architectures and for delivering security solutions that support business initiatives, based on the premise that security requirements are determined from the analysis of business requirements. Layers: Business/Contextual, Architect/Conceptual, Designer/Logical, Builder/Physical, Tradesman/Component, Facilities manager/Operational.

What is SOX?

Sarbanes-Oxley Act, enacted in 2002 to improve quality and transparency in financial reporting and independent audits and accounting services for public companies.

BASEL II

European Financial Regulatory Act that was originally developed to protect against financial operations risks and fraud.

Gramm-Leach-Bliley Act (GLBA)

A financial privacy act that aims to protect consumers' personal financial information (PFI) contained in financial institutions.

HIPAA

Health Insurance Portability and Accountability Act

Data Protection Act

Declares that personal data protection is a fundamental human right and requires that personal data no longer necessary for the purposes they were collected must either be deleted or modified so they no longer identify the individual.

Computer Misuse Act

Computer misuse such as hacking, unauthorized access, unauthorized modification of contents, and disruptive activities like the introduction of viruses are designated as criminal offenses.

California State Bill 1386

SB 1386 requires that personal information be destroyed when it is no longer needed by the collecting entity.

What kind of model is Bell-LaPadula?

Confidentiality

List the Confidentiality Models.

Bell-LaPadula

What kind of model is Biba?

Integrity

What kind of model is Clark and Wilson?

Integrity

What kind of model is Brewer and Nash?

Access Control

What kind of model is Clark and Wilson?

Integrity

What kind of model is Brewer and Nash?

Access Control

What is BLP primarily concerned with?

The Bell-LaPadula model is primarily concerned with disclosure.

What is the simple security property?

If you have read capability, you can read data at your level of secrecy or lower, but not higher. AKA "no read up".

What is the star (*) security property?

If you have write capability, you can write data at your level of secrecy or higher, but not lower. "No write down".

What is the strong star security property?

If you have both read and write capability, you can only read and write at your level of secrecy.

What is the Biba model primarily concerned with?

Modification or alteration of data.

What other model is Biba considered equivalent to as far as integrity goes?

Bell-LaPadula

What is the invocation property?

It's the difference between Biba and Bell-LaPadula. Subjects can't send messages to objects with higher integrity.

Describe the Clark and Wilson Model.

A security model that uses access triples, which require that a subject may only modify an object through a trusted program or application.