DEVSECOPS – SECURING THE CI/CDPIPELINE & CONTINUOUS SECURITY

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson
Download our mobile app to listen on the go
Get App

Questions and Answers

What method did the hackers use to compromise the SolarWinds software supply chain?

  • Unauthorized access to SolarWinds servers
  • Malicious injection into software updates (correct)
  • Social engineering attacks on SolarWinds employees
  • Denial of service attacks on SolarWinds infrastructure

What is the NPM Node Package Manager primarily used for?

  • Managing financial transactions
  • Storing personal documents
  • Organizing email communication
  • Exchanging software packages (correct)

What is the purpose of Scopes in NPM Node Package Manager?

  • Creating data backups
  • Monitoring system performance
  • Grouping similar software development packages (correct)
  • Managing user profiles

How did the attackers achieve unfettered package change under a Scope in NPM?

<p>Using a specially written pull request (D)</p> Signup and view all the answers

What type of vulnerability led to remote code execution in Cloudflare?

<p>Unsafe zip archive extraction (A)</p> Signup and view all the answers

What is the primary goal of security in the pipeline (SIP) according to the text?

<p>Discovering defects and errors in the code (A)</p> Signup and view all the answers

What are some of the important benefits of continuous integration and continuous delivery/deployment (CI/CD)?

<p>Saves time for developers and allows more time for code creation (C)</p> Signup and view all the answers

Why is security often a concern in the CI/CD pipeline?

<p>CI/CD is quick, but security measures are typically slow (D)</p> Signup and view all the answers

How does DevSecOps aim to change the speed and delivery of software security?

<p>By integrating security controls as part of the software being developed (C)</p> Signup and view all the answers

Why is it critical for developers to understand what is happening during software development and deployment in the context of security?

<p>To ensure that security is not compromised in the development and deployment process (B)</p> Signup and view all the answers

What role does DevSecOps play in the development and deployment process?

<p>It aims to integrate security as a design constraint in the software being developed (D)</p> Signup and view all the answers

What does CI/CD save an enormous amount of for developers?

<p>Time (C)</p> Signup and view all the answers

What makes CI/CD pipelines a desirable target for adversaries?

<p>They manage the whole software lifecycle (A)</p> Signup and view all the answers

How can attackers potentially exploit the trust connection between code repositories and servers in CI/CD pipelines?

<p>By exploiting code modifications and commits (A)</p> Signup and view all the answers

Why are containers considered a secure solution for executing programs in CI/CD pipelines?

<p>They are isolated from each other (C)</p> Signup and view all the answers

What is a supply chain assault in the context of CI/CD pipeline security?

<p>An attempt to spoof users through third-party software (D)</p> Signup and view all the answers

What is the significance of the SolarWinds Orion supply chain breach?

<p>It infiltrated networks, systems, and data of thousands of organizations (C)</p> Signup and view all the answers

What made SolarWinds a valuable target for the supply chain assault?

<p>Its privileged access to IT systems and extensive deployment (D)</p> Signup and view all the answers

What is the purpose of a Web Application Firewall (WAF)?

<p>To safeguard web applications by filtering, monitoring, and blocking harmful HTTP/S traffic (B)</p> Signup and view all the answers

Which type of WAF implementation is typically the most expensive and requires physical equipment?

<p>Network-based WAF (A)</p> Signup and view all the answers

What is the main advantage of a cloud-based WAF?

<p>Low upfront cost and continuous updates without additional effort or cost (C)</p> Signup and view all the answers

What does Runtime Application Self-Protection (RASP) technology perform?

<p>A server-based technique that activates when an application is launched to identify and stop real-time attacks (D)</p> Signup and view all the answers

What is the purpose of Continuous esecurity?

<p>To swiftly identify, prioritize, diagnose, and fix performance problems interfering with regular service operation (B)</p> Signup and view all the answers

What does Hypertext Transfer Protocol Secure (HTTPS) refer to?

<p>HTTP over transport layer security (TLS) or HTTP over secure socket layer (SSL) (C)</p> Signup and view all the answers

What is the main purpose of Cloud Security Posture Management (CSPM)?

<p>Automating risk assessment and mitigation across different cloud systems (C)</p> Signup and view all the answers

What is the primary focus of Security Around the Pipeline (SAP)?

<p>Protecting the pipeline from being bypassed (D)</p> Signup and view all the answers

Why is continuous security integration crucial for contemporary systems?

<p>To continually safeguard infrastructure and applications (B)</p> Signup and view all the answers

What is the primary function of Kubernetes in the context of software security?

<p>Simplifying container orchestration technology (D)</p> Signup and view all the answers

Why is it necessary to include continuous security validation into CI/CD pipelines?

<p>To detect holes and misconfigurations in the code (D)</p> Signup and view all the answers

What does Security of the Pipeline (SOP) primarily focus on protecting?

<p>The posture of system processes targeted by malware (D)</p> Signup and view all the answers

What is the primary function of RASP in the context of application security?

<p>To identify and resolve security issues within the application (A)</p> Signup and view all the answers

In which mode does RASP attempt to prevent security issues from occurring?

<p>Protective mode (B)</p> Signup and view all the answers

How do developers implement RASP using function calls found in an app’s source code?

<p>By accessing the RASP technology (D)</p> Signup and view all the answers

What is the ultimate effect of implementing RASP in an application's security?

<p>It combines a firewall with the program’s runtime environment (B)</p> Signup and view all the answers

What is the primary purpose of application security monitoring?

<p>To notify administrators of malicious activity (D)</p> Signup and view all the answers

What capability is unavailable to security solutions that operate 'outside' apps?

<p>Identifying strange activities that contradict business principles (D)</p> Signup and view all the answers

What advantage do application security monitoring solutions have over embedding monitoring code into each application?

<p>They have extensive knowledge and expertise on attacks and abuses (A)</p> Signup and view all the answers

What is the primary function of logging in an application?

<p>To ensure compliance with security laws (C)</p> Signup and view all the answers

What is the primary purpose of Incident Response?

<p>To promptly detect and stop attacks (A)</p> Signup and view all the answers

What is the primary objective when Containment of attackers and incident activity is performed?

<p>To reach this level as soon as possible to limit the amount of damage caused (D)</p> Signup and view all the answers

What is the significance of Incident Response Frameworks?

<p>They assist companies in the creation of standardized response strategies (A)</p> Signup and view all the answers

Why is a risk assessment conducted during the Preparation of processes and systems phase of Incident Response?

<p>To prioritize the protection of high-priority assets (D)</p> Signup and view all the answers

What is the main focus during the Identification of occurrences phase of Incident Response?

<p>To detect and identify any unusual behavior using tools and processes specified during the planning phase (A)</p> Signup and view all the answers

What is typically performed during Short-term containment as part of Incident Response?

<p>Imminent threats are contained in situ (A)</p> Signup and view all the answers

What is the primary function of the National Institute of Standards and Technology (NIST) incident response methodology?

<p>To develop an IR plan and an IR team (B)</p> Signup and view all the answers

1

<p>It provides instructions on how to develop a communication plan and training scenarios. (B)</p> Signup and view all the answers

What is typically performed during Short-term containment as part of Incident Response?

<p>Imminent threats are contained in situ. (A)</p> Signup and view all the answers

What is the primary responsibility of a cloud computing provider according to the shared responsibility model?

<p>Providing services and storage such as the virtualization layer, disks, and networks (B)</p> Signup and view all the answers

What is the primary role of bug bounty programs in proactive security management?

<p>Crowdsourcing security knowledge via a formal program and paying rewards for defects discovered (C)</p> Signup and view all the answers

What is the responsibility of users in the software as a service (SaaS) model of cloud computing?

<p>Protecting the security of the subscriptions and login credentials of their users (A)</p> Signup and view all the answers

What is the primary function of Red teaming exercises in cybersecurity?

<p>Simulating cyberattacks to identify vulnerabilities (D)</p> Signup and view all the answers

Which type of cloud service model places more security responsibilities on the users as they go from SaaS to PaaS and to IaaS?

<p>Infrastructure as a service (IaaS) (A)</p> Signup and view all the answers

What is the purpose of hiring white-hat hackers in bug bounty programs?

<p>Uncovering previously undisclosed vulnerabilities (B)</p> Signup and view all the answers

What is the main responsibility of a company's IT staff and employees in a shared responsibility model for cloud security?

<p>Accountable for the security of that infrastructure, as well as the applications and data that run on it (B)</p> Signup and view all the answers

What is the primary focus of Red Hat’s Ansible Playbook in the context of patching process automation?

<p>Ensuring correct and consistent application of fixes by automating patching process (B)</p> Signup and view all the answers

"Traditional information security checked for security at the conclusion of an application, whereas continuous security tests for security in parallel from start to finish" – Which concept does this statement refer to?

<p>Continuous security (C)</p> Signup and view all the answers

What are the four stages of the incident response framework according to Cichonsk et al. (2012)?

<p>Preparation, Detection and analysis, Containment, Post-incident activity (A)</p> Signup and view all the answers

What is a key contribution to cybersecurity by SANS?

<p>Incident Response Framework (B)</p> Signup and view all the answers

What is the process of revealing security vulnerabilities in computer software or hardware known as?

<p>Vulnerability Disclosures (B)</p> Signup and view all the answers

What do patches modify in an operating system, platform, or application?

<p>Existing software (C)</p> Signup and view all the answers

What is the primary purpose of patch management in systems administration?

<p>To protect against malware and cyberattacks (B)</p> Signup and view all the answers

Which entity implemented the coordinated vulnerability disclosure (CVD) concept?

<p>Microsoft (B)</p> Signup and view all the answers

What does automating patch management help to reduce?

<p>Human errors (D)</p> Signup and view all the answers

What is the primary advantage of combining patch management with automation technologies?

<p>Limited human errors (D)</p> Signup and view all the answers

What type of vulnerabilities do bug bounties and vulnerability rewards programs aim to address?

<p>Software vulnerabilities (A)</p> Signup and view all the answers

Which organization collaborated on security-related research and public education to present the SANS incident response framework?

<p>SANS (D)</p> Signup and view all the answers

What is the main benefit of using logs to test apps prior to deploying them into production?

<p>Identifying security flaws before they become exploitable vulnerabilities (D)</p> Signup and view all the answers

What is the direct impact of the length of time a vulnerability remains exploitable?

<p>Financial, brand, and consumer trust costs (A)</p> Signup and view all the answers

How does logging and effective log management contribute to improving collaboration between teams?

<p>By enabling real-time monitoring and coordination of modifications (B)</p> Signup and view all the answers

What is the primary role of logs in the context of application security?

<p>Identifying security flaws before deployment (D)</p> Signup and view all the answers

Why is the use of logs important in the context of software development and deployment?

<p>To prevent vulnerabilities from entering production environments (C)</p> Signup and view all the answers

What aspect does effective log management aim to enhance in the context of application development?

<p>Coordination between development and IT operations teams (A)</p> Signup and view all the answers

What impact does the presence of vulnerabilities in deployed applications have on other team members?

<p>It saves time that would have been spent detecting them (D)</p> Signup and view all the answers

Why might vulnerabilities delivered into production remain exploitable for several hours or even days?

<p>Owing to the absence of effective log management (A)</p> Signup and view all the answers

What is the primary purpose of a top-tier log management application in the context of application security?

<p>To identify security flaws before deploying apps into production (D)</p> Signup and view all the answers

How does log management contribute to reducing costs related to security flaws?

<p>By minimizing financial costs through efficient log analysis (D)</p> Signup and view all the answers

Flashcards are hidden until you start studying

More Like This

Use Quizgecko on...
Browser
Browser