Software Security Midterm

C.I.A. Triad Goals

The three core principles of information security: Confidentiality, Integrity, and Availability.

Mandatory Access Control (MAC)

An access control model where access rights are assigned based on regulations.

Discretionary Access Control (DAC)

An access control model that allows users to control access to their own resources.

Bell-LaPadula Model

A security model that focuses on maintaining data confidentiality.

Biba Model

A security model that focuses on maintaining data integrity.

Role-Based Access Control (RBAC)

An access control method that assigns permissions to roles rather than individual users.

Administrative RBAC

Role-based access control that includes administrative functions for role management.

NGAC

Next Generation Access Control, which is a flexible way of implementing access control policies.

XACML

eXtensible Access Control Markup Language, a language for defining access control policies.

Relationship-Based Access Control (ReBAC)

Access control based on the relationships between users and resources.

Buffer overflow

An anomaly where a program writes data beyond the boundaries of allocated memory.

Pointer Subterfuge

A technique to manipulate pointer values to gain unauthorized access or execute malicious code.

ARC Injection

A type of code injection that takes advantage of vulnerable applications to execute arbitrary code.

String Vulnerabilities

Security weaknesses in applications that manipulate strings improperly, leading to memory corruption.

Stack smashing

An exploit technique that corrupts the call stack in order to gain control over a program.

Code injection

The technique of inserting malicious code into a program to alter its execution.

Formatted Output

Using formatting to control how data is presented in software applications.

Crashing program

An event where a program stops functioning due to errors or exploits.

Viewing stack content

Examining the call stack to understand program execution flow.

Viewing memory content

Inspecting the memory used by a program to identify vulnerabilities.

Overwriting arbitrary memory

Manipulating memory to change the state of a program unexpectedly.