WGU C706 Secure Software Design Study Guide
2022
1.Confidentiality: Information is not made available or disclosed to
unauthorized individuals, entities, or processes. Ensures unauthorized
persons are not able to read private and sensitive data. It is achieved
through cryptography.
2.Integrity: Ensures unauthorized persons or channels are not able to
modify the data. It is accomplished through the use of a message
digest or digital signatures.
3.Availability: The computing systems used to store and process
information, the security controls used to protect information, and the
communication channels used to access information must be
functioning correctly. Ensures system remains operational even in the
event of a failure or an attack. It is achieved by providing redundancy
or fault tolerance for a failure of a system and its components.
4.Ensure Confidentiality: Public Key Infrastructure (PKI) and
Cryptography\/En- cryption
5.Ensure Availability: Offsite back-up and Redundancy
6.Ensure Integrity: Hashing, Message Digest (MD5), non repudiation
and digital signatures<\/p>\n\n\n\n
7.Software Architect: Moves analysis to implementation and analyzes
the re- quirements and use cases as activities to perform as part of
the development process; can also develop class diagrams.
8.Security Practitioner Roles: Release Manager,
Architect, Developer, Business Analyst\/Project
Manager
9.Release Manager: Deployment
10.Architect: Design
11.Developer: Coding
12.Business Analyst\/Project Manager: Requirements Gathering
13.Red Team: Teams of people familiar with the infrastructure of the
company and the languages of the software being developed. Their
mission is to kill the system as the developers build it.
14.Static Analysis: A method of computer program debugging that is
done by examining the code without executing the program. The
process provides an understanding of the code structure, and can help
to ensure that the code adheres to industry standards. It’s also
referred as code review.
15.MD5 Hash: A widely used hash function producing a 128-bit hash
value. Initially designed to be used as a cryptographic hash function,
it has been found<\/p>\n\n\n\n
to suffer from extensive vulnerabilities. It can still be used as a
checksum to verify data integrity, but only against unintentional
corruption.
16.SHA-256 (Secure Hash Algorithm): One of a number of cryptographic
hash functions. A cryptographic hash is like a signature for a text or a
data file. Generates an almost-unique, fixed size 32-byte
(32 X 8) hash. Hash is a one-way function – it cannot be decrypted.
17.Advanced Encryption Standard (AES): A symmetric encryption
algorithm. The algorithm was developed by two Belgian
cryptographers Joan Daemen and Vincent Rijmen. Designed to be
efficient in both hardware and software, and supports a block length
of 128 bits and key lengths of 128, 192, and 256 bits.
18.Algorithms used to verify integrity: MD5 Hash, SHA-256
19.Algorithm used to verify confidentiality: Advanced Encryption
Standard (AES)
20.Stochastic: unintentional or accidental
21.safety-relevant faults: stochastic (i.e., unintentional or accidental)
22.security-relevant faults: “Sponsored,” i.e., intentionally created and
activated through conscious and intentional human agency.
23.Fuzz Testing: Used to see if the system has solid exception handling
to the input it receives. Is the use of malformed or random input into a
system in order to intentionally produce failure. This is a very easy
process of feeding garbage to the system when it expects a formatted<\/p>\n\n\n\n
Confidentiality
Information is not made available or disclosed to unauthorized individuals, entities, or processes. Ensures unauthorized persons are not able to read private and sensitive data. It is achieved through cryptography.<\/p>\n\n\n\n
Integrity
Ensures unauthorized persons or channels are not able to modify the data. It is accomplished through the use of a message digest or digital signatures.<\/p>\n\n\n\n
Availability
The computing systems used to store and process information, the security controls used to protect information, and the communication channels used to access information must be functioning correctly. Ensures system remains operational even in the event of a failure or an attack. It is achieved by providing redundancy or fault tolerance for a failure of a system and its components.<\/p>\n\n\n\n
Ensure Confidentiality
Public Key Infrastructure (PKI) and Cryptography\/Encryption<\/p>\n\n\n\n
Ensure Availability
Offsite back-up and Redundancy<\/p>\n\n\n\n
Ensure Integrity
Hashing, Message Digest (MD5), non repudiation and digital signatures<\/p>\n\n\n\n
Software Architect
Moves analysis to implementation and analyzes the requirements and use cases as activities to perform as part of the development process; can also develop class diagrams.<\/p>\n\n\n\n
Security Practitioner Roles
Release Manager,
Architect, Developer, Business Analyst\/Project Manager<\/p>\n\n\n\n
Release Manager
Deployment<\/p>\n\n\n\n
Architect
Design<\/p>\n\n\n\n
Developer
Coding<\/p>\n\n\n\n
Business Analyst\/Project Manager
Requirements Gathering<\/p>\n\n\n\n
Red Team
Teams of people familiar with the infrastructure of the company and the languages of the software being developed. Their mission is to kill the system as the developers build it.<\/p>\n\n\n\n
Static Analysis
A method of computer program debugging that is done by examining the code without executing the program. The process provides an understanding of the code structure, and can help to ensure that the code adheres to industry standards. It’s also referred as code review.<\/p>\n\n\n\n
MD5 Hash
A widely used hash function producing a 128-bit hash value. Initially designed to be used as a cryptographic hash function, it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption.<\/p>\n\n\n\n
SHA-256 (Secure Hash Algorithm)
One of a number of cryptographic hash functions. A cryptographic hash is like a signature for a text or a data file. Generates an almost-unique, fixed size 32-byte
(32 X 8) hash. Hash is a one-way function – it cannot be decrypted.<\/p>\n\n\n\n
Advanced Encryption Standard (AES)
A symmetric encryption algorithm. The algorithm was developed by two Belgian cryptographers Joan Daemen and Vincent Rijmen. Designed to be efficient in both hardware and software, and supports a block length of 128 bits and key lengths of 128, 192, and 256 bits.<\/p>\n\n\n\n
Algorithms used to verify integrity
MD5 Hash, SHA-256<\/p>\n\n\n\n
Algorithm used to verify confidentiality
Advanced Encryption Standard (AES)<\/p>\n\n\n\n
Stochastic
unintentional or accidental<\/p>\n\n\n\n
safety-relevant faults
stochastic (i.e., unintentional or accidental)<\/p>\n\n\n\n
security-relevant faults
“Sponsored,” i.e., intentionally created and activated through conscious and intentional human agency.<\/p>\n\n\n\n
Fuzz Testing
Used to see if the system has solid exception handling to the input it receives. Is the use of malformed or random input into a system in order to intentionally produce failure. This is a very easy process of feeding garbage to the system when it expects a formatted input, and it is always a good idea to feed as much garbage as possible to an input field.<\/p>\n\n\n\n
Three (3) Tier
Removes the business logic from the client end of the system. It generally places the business logic on a separate server from the client. The data access portion of the system resides separately from both the client and the business logic platform.<\/p>\n\n\n\n
T-MAP
Defines a set of threat-relevant attributes for each layer or node. These can be classified as probability-relevant, size-of-loss relevant, or descriptive. These are primarily derived from Common Vulnerability Scoring System (CVSS). USC’s Threat Modeling based on Attacking Path analysis is a risk management approach that quantifies total severity weights of relevant attacking paths for COTS-based systems. Its strengths lie in its ability to maintain sensitivity to an organization’s business value priorities and IT environment, to prioritize and estimate security investment effectiveness and evaluate performance, and to communicate executive-friendly vulnerability details as threat profiles to help evaluate cost efficiency.<\/p>\n\n\n\n
Trike
An open source conceptual framework, methodology, and tool set designed to auto-generate repeatable threat models. Its methodology enables the risk analyst to accurately and completely describe the security characteristics of the system, from high-level architecture to low-level implementation of details. It also requires building a defensive model of the subject system.<\/p>\n\n\n\n
SDL Threat Modeling Tool
This free tool builds on Microsoft Visio and provides a tool for constructing graphic representations for the system without requiring expertise in security and also has the capability of graphically representing a software system and identifying vulnerabilities.<\/p>\n\n\n\n
Vulnerability Mapping
Used to determine the most likely locations within the system in development where an attacker will strike. This is done on the design phase of the SDLC.<\/p>\n\n\n\n
V3
The highest level of vulnerability. This is a very likely target for an attacker, such as free text input in a form. These are the highest priory for a security plan for the system and these should all be mitigated and accounted for by established control systems in development.<\/p>\n\n\n\n
V2
A moderate level vulnerability. These are possible but not probable targets. These will include inter-process communications on the server or traffic within the trust boundary of the system. Eavesdropping is the most significant risk in this situation. These vulnerabilities should always be mitigated in the system, but in a trade off analysis, strict control may not be necessary as long as a procedure is in place to fail safely and protect any private or confidential data.<\/p>\n\n\n\n
V1
The lowest priority level of vulnerability. These are unlikely venues of attack with little risk if they are exploited. Failing safely is the most important concern at this level, because the data associated with this vulnerability has no value, and the process involved is not mission critical, such as a transmission failure in an HTML header coming from the system; the highest risk is that the customer will
not properly see the page and it would have to be reloaded. These vulnerabilities can be largely ignored, but they should be noted in the system specification in case functionality is altered by a later system update or interaction because this may allow them to become more significant.<\/p>\n\n\n\n
Activity Diagram
Capable of expressing resolution efforts to malformed input and potential attacks in a way other documentation at the system level cannot. The caveat is that these do not contain class calls and references; they only provide a visualization of the process logic.<\/p>\n\n\n\n
Kiviat Diagram
Provides a visual comparison of multiple attributes and can visualize and report the information on a single artifact based on monitored information.<\/p>\n\n\n\n
Identify the Assets
A threat model process that allows the company to identify the part that needs to be protected from unauthorized users.<\/p>\n\n\n\n
Agile Model
Describes a set of principles for software development under which requirements and solutions evolve through the collaborative effort of self-organizing cross-functional teams. It promotes adaptive planning, evolutionary development, early delivery, and continuous improvement, and it encourages rapid and flexible response to change. Supports the definition and continuing evolution of many software development methods, avoids life cycle activities, focuses on built-a- little, test-a-little and field-a-little. It also supports informal communication and Incremental design.<\/p>\n\n\n\n
Types of Vulnerability Mapping
Activity Diagram, Kiviat Diagram, Identify the Assets, Agile Model, V1, V2, V3<\/p>\n\n\n\n
Agile attributes
Cyclical Process. Supports quick prototyping and limits the time spent thinking about the problem as a whole.<\/p>\n\n\n\n
Waterfall attributes
Similar to interactive model and main components are planning, development and deployment.<\/p>\n\n\n\n
Chrystal Clear attributes
Can be applied to teams of up to 6 or 8 co-located developers working on systems that are not life-critical. This family of methodologies focuses on efficiency and habitability as components of project safety. Focuses on people, not processes or artifacts. Roles may be filed by the same people, including a project manager and a business expert.<\/p>\n\n\n\n
Waterfall attributes
A sequential (non-iterative \/ Limited Interaction) design process, used in software development, in which progress is seen as flowing down through the phases of conception, initiation, analysis, design, construction, testing, production\/implementation and maintenance. All the requirements will be specified in the first step, uses a document driven approach (large amount of documentation) and has specific and identifiable stages. It also provides a resource to entry level developers with limited exposure.<\/p>\n\n\n\n
Waterfall Methodology Security concerns
Requirement Analysis: Define Security Features
Design: Misuse cases and vulnerability mapping
Construction and Implementation: Secure Coding practices
Testing: Penetration Assessment
Installation: Final Security Review
Operation or Maintenance: Periodic security review and updates<\/p>\n\n\n\n
Digital Signature
A mathematical scheme for demonstrating the authenticity of a message or document. Gives a recipient reason to believe that the message was created by a known sender, that the sender cannot deny having sent the message (authentication and non-repudiation), and that the message was not altered in transit (integrity). It also can be used as proof of approval by an authorized user.<\/p>\n\n\n\n
Redundancy
The existence of data that is additional to the actual data and permits correction of errors in stored or transmitted data. The additional data can be simply a complete copy of the actual data, or only select pieces of data that allow detection of errors and reconstruction of lost or damaged data up to a certain level. This will make sure that all data will always be available, the data will not be lost and it will be stored at a another location for failover reasons.<\/p>\n\n\n\n
Hashing:
The process of using an algorithm for verifying the integrity or authenticity of a computer file. This can be done by comparing two files bit-by-bit, but requires two copies of the same file, and may miss systematic corruptions which might occur to both files. A more popular approach is to also store checksums (message digests) of files for later comparison.<\/p>\n\n\n\n
Software Assurance
Ensures that the processes, procedures, and products used to produce and sustain the software conform to all requirements and standards specified to govern those processes, procedures, and products. This can be also used to make sure that any web application meets the requirements of what it was designed to do and accessible to all that are authorized whether in the office or at a remote location.<\/p>\n\n\n\n
Sandboxing, isolating trusted processes, and proper handling of errors and exceptions
Help secure a system in a high risk environment where the system is prone to attack.<\/p>\n\n\n\n
DOS or DDOS
A common web server attack in which unsolicited TCP requests overwhelm the web servers’ resources and make it unavailable.<\/p>\n\n\n\n
SQL SELECT query command
Can allow an attacker to access tables within that particular database without requiring elevated and\/or administrator permissions and jeopardizing the structure and relevance of the data that the database contains.<\/p>\n\n\n\n
Scrub all input of malicious code
One method of disallowing a SQL injection attack when handling user fields in a web from that reads or write to a database.<\/p>\n\n\n\n
Characterize the system, view the system as an adversary
The two steps of the threat model that data flow approaches.<\/p>\n\n\n\n
accessing ports that are not secured and\/or locked down, the exploitation of default passwords
The two attacks that can affect both the operating system and databases.<\/p>\n\n\n\n
Acquisition and Implementation
Control domain for the analysis and design phase of the SDLC.<\/p>\n\n\n\n
Monitoring, Delivery and Support
The control domain for the sustainment phase of the SDLC.<\/p>\n\n\n\n
Coding
Takes place in the construction phase of the SDLC.<\/p>\n\n\n\n
Task Refinement
Specific security activities must be identified when integrating security requirements into a work breakdown structure for the new software development effort.<\/p>\n\n\n\n
Release Manager
Conducts the code review process as one of the parts or processes of the software development. Can also deploy the finished product to the various environments at project completion.<\/p>\n\n\n\n
Business Analyst
Has the SDLC role to identify the requirements of an application (example: Web Application), must be able to identify who will be impacted by such an application. Once the application is developed in a test environment, must insure that the user acceptance testing is completed and to standards.<\/p>\n\n\n\n
Tester Role
Has the responsibility to prepare a document plan that will verify that a systems code performs the proper actions that it was designed to do.<\/p>\n\n\n\n
SQL Injection
A technique, used to attack data-driven applications, in which nefarious statements are inserted into an entry field for execution. This can be done from any form or place that allows the attacker to enter any type of information which is somewhat connected to a database.<\/p>\n\n\n\n
Beta version
The focus is reducing impacts to users, often incorporating usability testing and expectation of functionality. This software is often useful for demonstrations and previews within an organization and to prospective customers.<\/p>\n\n\n\n
STRIDE categories
Spoofing Identity,
Tampering with Data, Repudiation,
Information Disclosure, Denial of Service, Elevation of Privilege<\/p>\n\n\n\n
STRIDE
A classification scheme for characterizing\/measuring known threats\/vulnerabilities according to the kinds of exploit that are used (or motivation of the attacker). It also focuses on the end results of possible attacks rather than on the identification of each specific attack.<\/p>\n\n\n\n
Spoofing Identity
A key risk for applications that have many users but provide a single execution context at the application and database level. In particular, users should not be able to become any other user or assume the attributes of another user.<\/p>\n\n\n\n
Tampering with Data
Users can potentially change data delivered to them, return it, and thereby potentially manipulate client-side validation, GET and POST results, cookies, HTTP headers, and so forth. The application should not send data to the user, such as interest rates or periods, which are obtainable only from within the application itself. The application should also carefully check data received from the user and validate that it is sane and applicable before storing or using it.<\/p>\n\n\n\n
Repudiation
Users may dispute transactions if there is insufficient auditing or record keeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his\/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss. Therefore, consider if the application requires controls such as web access logs, audit trails at each tier, or the same user context from top to bottom. Preferably, the application should run with the user’s privileges, not more, but this may not be possible with many off-the-shelf application frameworks.<\/p>\n\n\n\n
Information Disclosure
Users are wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.
Consider if the web browser may leak information. Some web browsers may ignore the no caching directives in HTTP headers or handle them incorrectly. Every secure application has a responsibility to minimize the amount of information stored by the web browser, just in case it leaks or leaves information behind.
In implementing persistent values, the use of hidden fields is insecure by nature. Such storage should not be relied on to secure sensitive information or to provide adequate personal privacy safeguards.<\/p>\n\n\n\n
Denial of Service
The use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users.
For applications that do not have this luxury, every facet of the application should be engineered to perform as little work as possible, to use fast and few database queries, to avoid exposing large files or unique links per user, in order to prevent simple attacks.<\/p>\n\n\n\n
Elevation of Privilege
If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot move to a higher role. Not displaying administrative role links is insufficient. All actions should be gated through an authorization matrix, to ensure that only the permitted roles can access administrative functionality.<\/p>\n\n\n\n
DREAD categories
Damage, Reproducibility, Exploitability\/Vulnerability, Affected users, Discoverability<\/p>\n\n\n\n
DREAD
Part of a system for risk-assessing computer security threats previously used at Microsoft and currently used by OpenStack and many other corporations. It provides a mnemonic for risk rating security threats using five categories.<\/p>\n\n\n\n
DREAD – Damage
How bad would an attack be? Ranks the extent of harm that occurs if a vulnerability is exploited.<\/p>\n\n\n\n
DREAD – Reproducibility
How easy is it to recreate the attack? Ranks how often an attempt at exploiting a vulnerability really works<\/p>\n\n\n\n
DREAD – Exploitability\/Vulnerability
How much work is it to launch the attack? Measures the effort required to launch the attack.<\/p>\n\n\n\n
DREAD – Affected users
how many people will be impacted? Measures the number of installed instances of the system affected by an exploit.<\/p>\n\n\n\n
DREAD – Discoverability
How easy is it to uncover the threat? States the likelihood that a vulnerability will be found by security researchers or hackers.<\/p>\n\n\n\n
DREAD threat assessment
Each category is given a rating on probability and damage potential. For example, 3 for high, 2 for medium, 1 for low and 0 for none. (Rating scales running from 0 to 10 are common) The sum of all ratings for a given exploit can be used to prioritize among different exploits.<\/p>\n\n\n\n
Threat Model
A diagram and description that tells a story of how an attacker could exploit the vulnerability. This is not a step by step process, but a narrative approach to the attack that should help guide the mitigation techniques that need to be put in place to protect the system. It defines the security of an application and reduces the number of vulnerabilities. It has the 2 steps of identifying and prioritizing vulnerabilities.<\/p>\n\n\n\n
Sequence Diagram
A detailed breakdown of the communication that will occur between actors and system objects or components. Bridges the gap between the business analysis and the development analysis; this can be considered a business or development description of system functionality.<\/p>\n\n\n\n
SDLC Management Control Domains
Planning \/ Organization,
Acquisition \/ Implementation, Delivery and Support,
Monitoring<\/p>\n\n\n\n
Planning \/ Organization
Project Definition, User Requirements Definition and Systems Requirement Definition<\/p>\n\n\n\n
Acquisition \/ Implementation
User Requirements Definition, System Requirement Definition, Analysis and Design and System Build \/ Prototype \/ Pilot<\/p>\n\n\n\n
Delivery and Support
Analysis and Design, System Build \/ Prototype \/ Pilot, Implementation and Training and Sustainment<\/p>\n\n\n\n
Monitoring
User Requirements Definition, Systems Requirements Definition, Analysis and Design, System Build \/ Prototype \/ Pilot, Implementation and Training and Sustainment<\/p>\n\n\n\n
Planning\/ Organization
Name the domain(s) for Project Definition<\/p>\n\n\n\n
Name the domain(s) for User Requirements Definition
Planning\/Organization, Acquisition\/Implementation, Monitoring<\/p>\n\n\n\n
Name the domain(s) for System Requirements Definition
Planning\/Organization, Acquisition\/Implementation, Monitoring<\/p>\n\n\n\n
Name the domain(s) for Analysis and Design
Acquisition\/Implementation, Delivery\/Support, Monitoring<\/p>\n\n\n\n
Name the domain(s) for System Build\/Prototype\/Pilot
Acquisition\/Implementation, Delivery\/Support, Monitoring<\/p>\n\n\n\n
Name the domain(s) for Implementation and Training
Delivery\/Support, Monitoring<\/p>\n\n\n\n
Name the domain(s) for Sustainment
Delivery\/Support, Monitoring<\/p>\n\n\n\n
Name the SDLC Phases
Project Definition, User Requirements Definition, System Requirements Definition, Analysis and Design, System Build\/Prototype\/Pilot, Implementation and Training, Sustainment<\/p>\n\n\n\n
Requirements Analysis
A phase of the SDLC that defines security functions that an application should satisfy. The designated employee can also speak with several stakeholders to determine the expected end state of the application.<\/p>\n\n\n\n
Testing Phase
Security should be involved in all phases of the SDLC, but exploitation of vulnerabilities to identify weaknesses should be done in this phase.<\/p>\n\n\n\n
Incident Response Plan
An organized approach to addressing and managing the aftermath of a security breach or compromise on a system or software. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. This will take place at the operation phase of the SDLC.<\/p>\n\n\n\n
Earned Value Management:
BCWS
Budget Cost Work Scheduled<\/p>\n\n\n\n
Earned Value Management:
BCWP
Budget Cost of Work Performed<\/p>\n\n\n\n
Earned Value Management: SV
Scheduled Variance<\/p>\n\n\n\n
Earned Value Management: CV
Cost Variance<\/p>\n\n\n\n
SV equation
BCWP – BCWS<\/p>\n\n\n\n
CV equation
BCWP – ACWP<\/p>\n\n\n\n
Earned Value Management: ACWP
Actual Cost of Work Performed<\/p>\n\n\n\n
Steps in the Work Breakdown Structure (WBS):
1) Examine the set of required external deliverables.
2) Identify and list the steps and tasks needed to produce the required deliverables, including any tasks for additional intermediate deliverables needed to complete the final deliverable.
3) Sequence the identified tasks required to produce the deliverable.
4) Estimate the effort required to perform each task.
5) Estimate the productivity of the resources that will be applied to the tasks.
6) Compute the time needed for each task by dividing the task effort estimates by the resource productivity estimates.
7) Lay out the time needed for each task and “label” each task with its task name and the assigned resources; this layout of sequences of tasks with their associated time and resources essentially forms the initial schedule.<\/p>\n\n\n\n
Capability Maturity Model Integration (CMMI) levels: ML5
Organizational innovations and deployment,
Casual analysis and resolution,
Overall testing to achieve efficiencies<\/p>\n\n\n\n
Capability Maturity Model Integration (CMMI) levels: ML4
Organizational process performance,
Quantitative project management<\/p>\n\n\n\n
Capability Maturity Model Integration (CMMI) levels: ML3
Requirements development,
Technical solution,
Product integration,
Verification,
Validation,
Organizational process focus,
Organizational process definition,
Organizational training,
Integrated project management,
Risk Management,
Integrated teaming,
Integrated supplier management,
Decision analysis and resolution,
Organizational environment for integration<\/p>\n\n\n\n
Capability Maturity Model Integration (CMMI) levels: ML2
Requirements management,
Project planning,
Project monitoring and control,
Supplier agreement management,
Measurement and analysis,
Process and product quality assurance,
Configuration management<\/p>\n\n\n\n
NONE
Capability Maturity Model Integration (CMMI) levels: ML1<\/p>\n\n\n\n
The Processes areas of CMMI: Project Management
1) Project Planning
2) Project Monitoring and control
3) Supplier agreement management
4) Integrated project management
5) Risk Management
6) Integrated teaming
7) Integrated supplier management
8) Quantitative project management<\/p>\n\n\n\n
The Processes areas of CMMI: Engineering
1) Requirements development
2) Requirements Management
3) Technical Solution
4) Product Integration
5) Verification
6) Validation<\/p>\n\n\n\n
The Processes areas of CMMI: Support
1) Configuration Management
2) Process and product quality assurance
3) Measurement and Analysis
4) Organizational environment for integration
5) Decision analysis and resolution
6) Casual analysis and resolution<\/p>\n\n\n\n
The Processes areas of CMMI: Process Management
1) Organizational process focus
2) Organizational process definition
3) Organizational Training
4) Organizational process performance
5) Organizational innovation and deployment<\/p>\n\n\n\n
Rational Unified Process (RUP)
A software development methodology from Rational. Based on UML, it organizes the development of software into four phases, each consisting of one or more executable iterations of the software at that stage of development. It’s also an interactive and incremental model that utilizes the divide and conquer methodology to decompose a complex problem into smaller parts. It’s also heavy with formal, established framework.<\/p>\n\n\n\n
Extreme Programming (XP)
Based on four core values of communication, simplicity, feedback, and courage. It also includes fundamental principles of incremental change, embracing change and quality of work.<\/p>\n\n\n\n
Scrum
A disciplined method that can be combined with other techniques.<\/p>\n\n\n\n
Warm Site
Might be a designated building with servers, computers, and the needed office space, but with no active connections or running servers.<\/p>\n\n\n\n
Data Encryption Standard (DES)
The formal United States national standard crypto-system for securing information; it’s an example of a Feistel cipher using a 56-bit key. It’s now considered breakable.<\/p>\n\n\n\n
3-DES
The formal United States national standard crypto-system for securing information; it’s an example of a Feistel cipher using three separate 56-bit keys.<\/p>\n\n\n\n
Secure Software Assurance (SSA)
Use of established quality assurance practices and fault tolerance techniques; Ability of software to operate dependably, despite the presence of sponsored faults and security as a part of the software specified in the beginning of the software development process.<\/p>\n\n\n\n
White Box Testing
Source code fault injection, direct code analysis and property based testing.<\/p>\n\n\n\n
Black Box Testing
Fuzz testing, byte code, assembler code and binary code scanning.<\/p>\n\n\n\n
Unintentional disclosure
Occurs when your software prints too much information in response to queries or when it prints to public error logs. Internal data can often be the target of the attacker, so what you share via output in development or in production needs to be considered as a possible source of compromise.<\/p>\n\n\n\n
Man in the Middle Attack (MitM, MiM attack, MitMA)
In cryptography and computer security, this is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.<\/p>\n\n\n\n
Attack surface in relation to threat: Network
Sniffing<\/p>\n\n\n\n
Attack surface in relation to threat: Operating System
Rootkit<\/p>\n\n\n\n
Attack surface in relation to threat: Programming Language
Buffer Overflow<\/p>\n\n\n\n
Attack surface in relation to threat: Database Application
Injection<\/p>\n\n\n\n
Quality Assurance
Refers to all activities designed to measure and improve a product , including the whole process, training, preparation of the team, and activities associated with customer feedback.<\/p>\n","protected":false},"excerpt":{"rendered":"
WGU C706 Secure Software Design Study Guide20221.Confidentiality: Information is not made available or disclosed tounauthorized individuals, entities, or processes. Ensures unauthorizedpersons are not able to read private and sensitive data. It is achievedthrough cryptography.2.Integrity: Ensures unauthorized persons or channels are not able tomodify the data. It is accomplished through the use of a messagedigest or […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-111378","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/posts\/111378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/comments?post=111378"}],"version-history":[{"count":0,"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/posts\/111378\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/media?parent=111378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/categories?post=111378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.learnexams.com\/blog\/wp-json\/wp\/v2\/tags?post=111378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}