Information Security in SDLC Quiz

<p>Code review pinpoints security issues in a system’s features and design, while threat modeling offers security risk analysis. (C)</p> Signup and view all the answers

<p>It is a multistep process that is used to develop, implement, and retire information systems. (B)</p> Signup and view all the answers

<p>Unexpected ordering of events that conflict over shared resources. (C)</p> Signup and view all the answers

<p>Failure to validate user input before querying a database. (A)</p> Signup and view all the answers

<p>Corrupting a DNS server to redirect a domain to a malicious IP address. (B)</p> Signup and view all the answers

<p>The insecure delivery of the key to the other party. (C)</p> Signup and view all the answers

<p>It makes tracking a user's interactions over multiple exchanges difficult. (D)</p> Signup and view all the answers

<p>It makes a system more vulnerable to unauthorized access and breaches. (D)</p> Signup and view all the answers

<p>The program could have been specifically made by attackers to intercept private keys. (C)</p> Signup and view all the answers

<p>By intercepting keys physically or digitally while in transit. (C)</p> Signup and view all the answers

<p>To identify security flaws and root causes within an application (A)</p> Signup and view all the answers

<p>Specifying the acceptable types and number of characters, and limiting reuse of old passwords (B)</p> Signup and view all the answers

<p>They do not analyze the source code, making it harder to find all vulnerabilities (B)</p> Signup and view all the answers

<p>To ensure only one secure method of performing a task and ensuring security (D)</p> Signup and view all the answers

<p>The application has built-in mechanisms to protect against security breaches (A)</p> Signup and view all the answers

<p>Users tend to take the less secure 'easy way' (B)</p> Signup and view all the answers

<p>No added application vulnerabilities related to the developed code (C)</p> Signup and view all the answers

<p>Human effort and technological support (B)</p> Signup and view all the answers

<p>A resource that has value, such as company information or reputation. (A)</p> Signup and view all the answers

<p>Protecting against unauthorized disclosure of information. (D)</p> Signup and view all the answers

<p>Online reputation, trade secrets, and intellectual property. (C)</p> Signup and view all the answers

<p>Preventing unauthorized changes to information. (B)</p> Signup and view all the answers

<p>The ability of authorized users to access a system when needed. (A)</p> Signup and view all the answers

<p>Defining the company's financial strategy. (D)</p> Signup and view all the answers

<p>Client data to protect, compliance requirements and quality of service. (B)</p> Signup and view all the answers

<p>Ensuring unlimited access to all resources for all users. (C)</p> Signup and view all the answers

<p>To identify potential vulnerabilities and threats before they are exploited. (A)</p> Signup and view all the answers

<p>To discover security vulnerabilities and coding errors. (A)</p> Signup and view all the answers

<p>Repudiation (B)</p> Signup and view all the answers

<p>Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (D)</p> Signup and view all the answers

<p>Ease of use might create a vulnerability for attackers. (A)</p> Signup and view all the answers

<p>Integrating security practices throughout all phases of development. (A)</p> Signup and view all the answers

<p>Users tampering with data. (A)</p> Signup and view all the answers

<p>To reduce the impacts of identified threats by implementing security controls. (A)</p> Signup and view all the answers

<p>HIPAA (A)</p> Signup and view all the answers

<p>Phishing attacks and social engineering. (B)</p> Signup and view all the answers

<p>To rate, compare, and prioritize the severity of risks. (D)</p> Signup and view all the answers

<p>They allow an attacker to take control of systems. (C)</p> Signup and view all the answers

<p>Distributed Denial of Service (DDoS). (A)</p> Signup and view all the answers

The overall process of developing, implementing, and retiring information systems through a series of phases like initiation, analysis, design, implementation, maintenance, and disposal.

Different methods and models used to guide the SDLC process, each with its own unique phases and steps.

The process of integrating security considerations into every stage of the SDLC, ensuring information protection throughout the system's life.

A systematic examination of application code to identify vulnerabilities and security flaws, aiming to uncover design issues and root causes.

A structured approach to analyzing the security of an application by identifying, quantifying, and addressing potential risks.

A program fails when the order of actions by different parts of the program leads to conflicting use of the same shared resource.

Attackers exploit vulnerabilities in how websites handle user input to gain unauthorized access to a database.

A type of attack where attackers modify the DNS system to redirect users to fake websites, often to steal personal information.

A security problem where a shared secret key is not securely distributed, leading to potential compromise.

Using hidden URLs or forms on websites that are not properly authenticated can lead to security vulnerabilities.

Not requiring strong passwords and allowing multiple wrong attempts can make a system vulnerable to attack.

Assets are resources that have value, which can be tangible or intangible, and can be different for different perspectives.

Security objectives are goals that aim to protect data and applications from unauthorized access, changes, and disruptions. They ensure the confidentiality, integrity, and availability of information.

Confidentiality protects sensitive information from being accessed by unauthorized individuals.

Integrity ensures that data is accurate and hasn't been tampered with.

Availability guarantees that systems and data are accessible when needed, even during attacks.

An application overview identifies key functionality, characteristics, clients, deployment scenarios, roles, usage scenarios, technologies, and security mechanisms.

Threat modeling is an iterative process that involves identifying, understanding, and mitigating potential threats to an application.

Threat modeling is a continuous process that should be done iteratively. You can start with basic information and add more detail as your design evolves.

A systematic examination of application source code to identify security flaws, design issues, and root causes, aiming to ensure proper security and logical controls are present and working as intended.

Code reviews aim to identify potential security flaws by carefully examining how the application is designed and implemented. This includes analyzing its features, functionalities, and how it interacts with external components.

It ensures the application is built with security in mind, making it 'self-defending' against common attacks. This helps to prevent vulnerabilities from being introduced in the first place.

Traditional testing methods might miss certain flaws. A deep dive into the code is often needed to uncover hidden vulnerabilities and determine the best mitigation techniques.

Code review involves a blend of human expertise and technology support. This can range from a single person manually reviewing code to sophisticated tools designed for code analysis.

A penetration test should ideally discover minimal new security vulnerabilities after a thorough code review, indicating the effectiveness of the process.

Code reviews are conducted to ensure that developers are adhering to secure coding practices and minimizing security risks within the application.

By identifying and mitigating vulnerabilities early, it can reduce the likelihood and impact of security incidents. It's a crucial aspect of secure development.

An attacker attempts to impersonate a legitimate user or system to gain unauthorized access. For example, an attacker might send a fake email pretending to be from a trusted source to trick a user into revealing sensitive information.

A type of attack where the attacker attempts to modify or corrupt data before it is processed or stored. For example, an attacker might change prices in an online store or alter the contents of a database.

A security issue where an attacker can access data without being detected, leaving no trace of their actions.

An attacker gains access to sensitive information that they are not authorized to see. This can include medical records, financial data, or other confidential information.

A security issue where a system is unavailable to users. This attack can target websites, servers, or other systems to make them unusable.

An attacker gains higher privileges than they are assigned. This could allow the attacker to access restricted data or control the system without authorization.

A method used to rank and prioritize security risks based on a combination of factors including Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. This helps security teams focus on the most critical issues.

A systematic process designed to find and address potential security vulnerabilities in software during its development lifecycle. It involves integrating security considerations into each phase, from planning to deployment and beyond.

A type of code review that aims to identify potential security vulnerabilities and weaknesses in application code. It involves a rigorous examination of the codebase to ensure adherence to security best practices and standards.