Secure SDLC, application security controls, and software vulnerabilities tested on CISSP Domain 8.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the primary phases of the Secure Software Development Lifecycle (SDLC)?
- Requirements/Planning, Design, Development, Testing, Deployment, and Maintenance
- What is the main goal of threat modeling in SDLC?
- Identify potential threats and vulnerabilities before development begins
- What does SAST stand for?
- Static Application Security Testing
- What does DAST stand for?
- Dynamic Application Security Testing
- What is input validation?
- Verifying that input data meets expected format, type, length, and range before processing
- What is cross-site scripting (XSS)?
- Injection of malicious scripts into web applications to execute in users' browsers
- What is SQL injection?
- Inserting malicious SQL code into input fields to manipulate database queries
- What is OWASP?
- Open Web Application Security Project, an organization focused on web application security
- What are the top 3 items typically in the OWASP Top 10?
- Broken Access Control, Cryptographic Failures, Injection
- What is code review in secure SDLC?
- Manual examination of source code by peers to identify security flaws and quality issues
- What is fuzz testing?
- Sending random, malformed, or unexpected data to an application to discover vulnerabilities
- What is a buffer overflow?
- Writing data beyond the allocated buffer boundaries, potentially overwriting adjacent memory
- What is the difference between authentication and authorization?
- Authentication verifies identity; authorization grants access to resources based on identity
- What is session management?
- The process of maintaining and tracking user state during their interaction with an application
- What is cross-site request forgery (CSRF)?
- Tricking an authenticated user into performing unintended actions on a website they are logged into