Software Security Fundamentals

Flashcards covering key vocabulary and concepts from a lecture on software security, including vulnerabilities, web application risks, and security best practices.

Computer Software

Compiled code of instructions (.exe) usually installed to run on server or client.

Software Vulnerabilities

Weaknesses or flaws present in code that can impact performance and security, allowing threats to exploit or gain access.

Software Patching

Ensuring systems have up-to-date patches and is an effective software security practice.

Access Management

Enforcing the principle of Least Privilege for users, systems and applications to allow the minimum access privileges required to perform their job functions.

Secure Configuration

Ensuring IT system is secured by a security baseline according to security policy that is aligned to security standard adopted and approved by CISO.

Web Application

Application software that runs on a web server and is accessed through a web browser.

OWASP (Open Web Application Security Project Foundation)

A non-profit organization aimed at spreading awareness of software security.

Injection

Category name for attacks involving malicious code or scripts being 'injected' into applications or systems. Includes SQL Injection and Cross-Site Scripting (XSS)

SQL Injection

An attack where a hacker can change the app's code that contains the SQL query part, leading to unauthorized access, modification, or deletion of data in the database.

Cross-Site Scripting (XSS)

A security vulnerability found in websites and web applications that accept user input, where attackers attach malicious code that executes when a victim loads the website.

Input validation

Verifying whether the type of input submitted by a user is allowed, ensuring it is the accepted type, length, and format.

Cookie

A small text file that a Web server stores on your computer to track user preferences or store login information.

Session

A server-side storage of information that stores information of the user’s interaction with the website or web application

Cross-Site Request Forgery (CSRF or XSRF)

An attack against cookie-based authentication where the attacker leads the user to perform an action that sends an HTTP request to a website on behalf of the user.

XSRF Prevention

Requires the use of a challenge token or an unpredictable token in the body or URL of each HTTP request.