Print Domain 8: Software Development Security flashcards - Easy Notecards

← Back to notecard set|Easy Notecards home page

Instructions for Side by Side Printing

Print the notecards
Fold each page in half along the solid vertical line
Cut out the notecards by cutting along each horizontal dotted line
Optional: Glue, tape or staple the ends of each notecard together

To print: Ctrl+PPrint as a list

83 notecards = 21 pages (4 cards per page)

Domain 8: Software Development Security

front 1 Software Development Life Cycle (SDLC)	back 1 Initiation & Planning Define requirements Create project plan and estimate costs Identify risks Obtain management approval Acquisition & Development Perform analysis & design Include controls for risks Conduct programming & testing Prepare documentation Deployment Execute QA & security testing Conduct user acceptance testing Complete certification & accreditation Roll out to production Operation & Maintenance Implement change management Maintain configuration management Ensure backups are in place Decommissioning Retire the system Dispose of data securely
front 2 Certification	back 2 Tests system features and safeguards Ensures system meets organizational requirements Applies to in-house or COTS systems
front 3 Accreditation	back 3 Management approval to deploy system May include conditions or limitations Acts as a "seal of approval"
front 4 Certification & Accreditation =	back 4 Assessment/Evaluation & Authorization

front 5 SSDLC (Secure SDLC)	back 5 Builds security into each phase of SDLC Proactive approach to secure systems Leads to better, safer applications
front 6 Waterfall Method	back 6 Linear, sequential development Each phase must be completed before the next begins
front 7 Spiral Method	back 7 Iterative development with risk analysis Cycle: Requirements Risk Analysis Prototype Validation Repeat with refined requirements
front 8 Agile Principles	back 8 Deliver working software frequently Welcome changes, even late Daily cooperation between business & devs Focus on technical excellence Emphasize teamwork

front 9 Scaled Agile Framework (SAFe)	back 9 Designed for large organizations Enables coordination across multiple teams Supports collaboration and effective product delivery
front 10 Scrum (Agile Method)	back 10 Popular Agile development framework Scrum Roles: Product Owner – Visionary, often the customer Scrum Master / Team Coach – Facilitator/manager Scrum Team – Developers
front 11 RAD (Rapid Application Development)	back 11 Emphasizes rapid prototyping Uses iterative delivery
front 12 Lean	back 12 Focuses on minimizing waste Maximizes productivity Similar to Agile

front 13 Iterative vs. Non-Iterative Models	back 13 Iterative: Spiral, Agile, Scrum, RAD, Lean → Multiple rounds of development Non-Iterative: Waterfall → Each phase is discrete and finalized
front 14 DevOps	back 14 Combines Development, Operations, and QA Based on Lean and Agile principles Goal: Shorten development cycle and enable continuous delivery
front 15 DevSecOps / SecDevOps	back 15 Integrates security into every phase of DevOps Maintains focus on security best practices
front 16 SCA (Software Component Analysis)	back 16 Analyzes custom-built apps for embedded open-source components Checks for: Version updates Vulnerabilities Licensing requirements Used in IT and software engineering

front 17 Software Bill of Materials (SBOM)	back 17 A complete list of components, libraries, and modules in a software product Helps detect malicious implants or unauthorized files
front 18 Hierarchical Database	back 18 Organizes data in a tree-like structure Examples: Windows Registry Microsoft Active Directory
front 19 NoSQL Databases	back 19 Examples: MongoDB, DynamoDB Stores unstructured data (e.g., documents) Uses key-value pairs Commonly used to index the internet
front 20 Relational Databases	back 20 Examples: MS SQL Server, Oracle Structured using tables with columns and rows Table Terminology Columns = Fields / Attributes / Degrees Rows = Records / Tuples Primary Key Rules (Entry Integrity) Must be unique Cannot be empty Foreign Key Rules (Referential Integrity) Must match a primary key in another table Ensures linked records between tables

front 21 Database Shadowing	back 21 Hidden copy of DB, delayed updates Used for high availability Can rebuild using transaction logs Not accessible by users
front 22 Remote Journaling	back 22 Copies transactions to backup site Used for disaster recovery Transactions can be replayed to restore DB
front 23 Database Replication	back 23 Frequent copying of DB between servers Ensures data consistency across locations Supports shared access to current data
front 24 Data Warehousing	back 24 Large databases storing high volumes of data Aggregates data from multiple sources Used for specialized analysis techniques

front 25 Data Mining	back 25 Technique to search through data warehouses Identifies correlated information and patterns
front 26 Database Query Languages	back 26 DDL (Data Definition Language) Defines DB structure/schema Used for: Creating tables Modifying columns Deleting DB objects DML (Data Manipulation Language) Manages table records Used for: Adding Updating Deleting records DCL (Data Control Language) Manages user access permissions Assigns privileges to users TCL (Transaction Control Language) Controls DB transactions Used for: Applying changes Rolling back changes DQL (Data Query Language) Retrieves data using SELECT command
front 27 Deadlocking (Deadly Embrace)	back 27 Occurs when two users/processes lock resources and wait on each other Example: User #1 locks Record A, waits for B User #2 locks Record B, waits for A Results in a stalemate
front 28 Inference	back 28 Combines non-sensitive info to deduce sensitive info Relies on human deduction Produces an educated guess

front 29 Aggregation	back 29 Combines lower-classified data to derive higher-classified info Key traits: Uses machine processing Involves classification levels Produces a definite value
front 30 ACID Test (Transaction Integrity)	back 30 Atomicity All changes take effect or none do Consistency Maintains internal and external consistency Isolation Ensures concurrent operations don’t interfere Durability Completed transactions are permanent
front 31 Metadata	back 31 Descriptive data about other data Example: File metadata includes creation date, file type, access permissions
front 32 Machine Languages	back 32 1GL – Machine Languages Binary code Hardware-specific 2GL – Assembly Languages Human-readable machine code Uses assemblers Still hardware-specific 3GL – High-Level Languages Machine-independent Examples: C, C++, Python, Java Uses compilers/interpreters 4GL – Very High-Level Languages Application-specific Examples: SQL, macros 5GL – Fifth Generation Languages Based on AI problem solving May use neural networks Cutting-edge technology

front 33 Object-Oriented Programming (OOP)	back 33 Objects contain: Procedures (methods): Perform actions Data (attributes): Store information
front 34 OOP Concepts	back 34 Inheritance Objects can derive data/functions from other objects Polymorphism Objects can take on many forms
front 35 Class	back 35 A collection of methods defining object behavior Acts as a template or "master" object
front 36 Instance	back 36 An object created from a class Uses the class’s methods and structure

front 37 Encapsulation	back 37 Also called Data Hiding in OOP Only includes necessary data for an object Hides irrelevant or sensitive data
front 38 Polysinstantiation	back 38 A form of encapsulation used in databases Creates multiple versions of data for different classification levels Prevents inference attacks Allows same primary key across versions
front 39 Open System	back 39 Has a published API Allows third-party integration
front 40 Closed System	back 40 Proprietary No third-party support or access

front 41 Open Source	back 41 Source code is viewable and distributable May be free or fee-based
front 42 Input Validation	back 42 Sanitizes incoming data to ensure safety Must be done on the back-end WAFs can help protect public-facing services
front 43 Edit Controls	back 43 Front-end routines to check input validity Prevents accidental errors during data entry
front 44 Bounds Checking	back 44 A form of Input Validation Ensures a variable stays within a specific range Example: If asking for age, only allow values between 18–150

front 45 Application Attacks	back 45 Memory Buffer Overflow Too much data sent → memory overflow → crash or remote code execution Mitigation: Input Validation Cross-Site Scripting (XSS) Malicious code injected into websites → runs in users' browsers Mitigation: Input Validation Cross-Site Request Forgery (CSRF/XSRF) Session hijacking via fake requests that appear legitimate SQL Injection (SQLi) Malicious SQL commands entered via input fields Example: '; shutdown with nowait; -- Mitigation: Sanitize input on back-end SQLi Clues Keywords: SELECT, UPDATE, DROP Logic tricks: 1=1;-- Dangerous commands: shutdown with nowait;--
front 46 OWASP Top 10 – 2017	back 46 Injection Broken Authentication Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Cross-Site Scripting (XSS) Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring
front 47 OWASP Top 10 – 2021	back 47 Broken Access Control Cryptographic Failures Injection Insecure Design Security Misconfiguration Vulnerable & Outdated Components Identification & Authentication Failures Software & Data Integrity Failures Security Logging & Monitoring Failures Server-Side Request Forgery (SSRF)
front 48 Virus	back 48 Malicious code that replicates by attaching to programs/files Requires human interaction to spread (e.g., email, USB)

front 49 Examples of Viruses	back 49 Macro Virus Targets macros in productivity software (Word, Excel, etc.) Boot Sector Virus Overwrites boot sector Loads into RAM before OS starts Multipartite Virus Uses multiple infection methods Can infect both boot sector and files Armored Virus Uses obfuscation to hide its code Designed to evade analysis Retro Virus Attacks or disables antivirus software Stealth Virus Avoids detection by hiding its presence Companion Virus Adds a pointer to a host program Pointer runs a separate malicious file Polymorphic / Metamorphic Virus Constantly changes shape Alters file names, locations, signatures, etc. to avoid detection
front 50 Worm	back 50 Self-replicating malware Spreads via network vulnerabilities Doesn’t require user interaction or infected files
front 51 STUXNET	back 51 Famous worm targeting Iranian nuclear systems
front 52 Mobile Code	back 52 Software sent over a network Executes on the local system

front 53 Applets	back 53 Mini-programs sent from server to client Perform specific tasks locally
front 54 Java Applets	back 54 Java-based applets Run in a sandbox for isolation
front 55 ActiveX	back 55 Microsoft’s version of applets Full system access (less secure than Java applets)
front 56 Hostile Applet	back 56 Exploits system resources May monopolize or misuse them

front 57 Logic Bomb	back 57 Malicious code triggered by specific time or condition Often inserted by insiders
front 58 Trojan Horse	back 58 Malware hidden inside legitimate software User unknowingly installs it
front 59 RAT (Remote Access Trojan)	back 59 Opens a backdoor for remote attacker access
front 60 Rootkit	back 60 Grants admin-level access to attackers Hides its presence in the system

front 61 Kernel Rootkit	back 61 Replaces critical system files Interferes with kernel functions
front 62 DDoS with Botnets	back 62 Distributed attack using zombie bots Controlled by a master handler
front 63 Ransomware / Cryptomalware	back 63 Encrypts or blocks access to data Demands ransom to restore access or prevent data leak
front 64 Cryptojacking	back 64 Uses victim’s computing resources to mine cryptocurrency Done without victim’s knowledge

front 65 APT (Advanced Persistent Threat)	back 65 Stealthy, long-term network intrusions Often state-sponsored Goal: Espionage
front 66 Fileless Malware	back 66 Runs in RAM only, no files written to disk Uses existing system tools Hard to detect due to lack of signatures
front 67 Anti-Malware Tools	back 67 1. Signature Scanning Detects known threats via signatures Examples: Antivirus, IDS 2. Heuristic Scanning Detects suspicious behavior Useful for new/unknown malware 3. Change Detection Tools Monitors for unauthorized changes Example: Tripwire
front 68 Covert Channel	back 68 Secret data transfer that violates security policies

front 69 Trap-Door / Back-Door	back 69 Hidden access bypass created during development Also called maintenance hook
front 70 Sabotage	back 70 Destructive act, often by insiders Targets systems or data
front 71 Phlashing	back 71 Maliciously flashes BIOS with unauthorized version
front 72 Data Diddling	back 72 Alters input data to commit fraud Affects databases, documents, programs

front 73 Session Hijacking	back 73 Attacker takes over a victim’s session Often by stealing or guessing session-ID Prevention Tips: Use randomized IDs Use high-entropy (mix of characters) Use time-based tokens that expire
front 74 Race Condition	back 74 Occurs when processes must execute in a specific order Failure leads to errors or delays
front 75 Memory Leak	back 75 Program fails to release unused memory Causes performance issues or crashes
front 76 TOC/TOU (Time Of Check / Time Of Use)	back 76 TOC: When system checks object state TOU: When system uses the object Delay between check and use can cause bugs

front 77 Unit Testing	back 77 Performed by developers Tests individual units of code
front 78 Acceptance Testing	back 78 Performed by customers/users Validates system meets requirements
front 79 Regression Testing	back 79 Tests new and old features Ensures updates don’t break existing functionality
front 80 Separation of Duties	back 80 Also called Segregation of Duties Prevents collusion/fraud by separating roles (e.g., coders vs. testers)

front 81 Software Assurance Maturity Model (SAMM)	back 81 Open framework for software security strategy Helps with: Evaluating current practices Building assurance programs Measuring improvements Defining security activities
front 82 Source-Code Escrow	back 82 Third-party holds source code Protects client if developer goes out of business
front 83 Change Management Process	back 83 Change Control Steps Submit formal change request Analyze request (cost, feasibility, impact, security) Develop implementation strategy Obtain management approval Develop and document the change Change Management Steps 6. Test the change Deploy the change Review and verify (roll back if needed) Report results to management Note: A Change Management Board (CMB) ensures safety, accountability, and supports separation of duties.