Chapter 1

Question 1

What is Security

Answer 1

Regulating asset access to minimize risks

Question 2

What is Software Security

Answer 2

managing software functionality risks

Question 3

Security Should Assess…

Answer 3

• Stakeholders
• Assets
• Threats
• Attackers

Question 4

What is a Security Policy?

Answer 4

Specification of what coutermeasures intend to achieve

Question 5

How are Security Policies Enforced?

Answer 5

Via security mechanisms

Question 6

Define CIA

Answer 6

• Confidentiality: prevent unauthorized disclosure
• Integrity: prevent unauthorized altering
• Availability: always available

Question 7

What is Non-repudiation?

Answer 7

Authorized users cannot deny actions

Question 8

Define AAAA

Answer 8

• Authentication
• Authorization (Prevention)
• Auditing (Detection)
• Action (Reaction)

Question 9

What are Sources of Software Vulnerabilities?

Answer 9

• Application/infrastructure bugs
• Inappropriate infrastructure features
• Inappropriate use of infrastructure features

Question 10

What are the Main Causes of Software Vulnerabilities?

Answer 10

• Feature Complexity
• Developer Ignorance

Question 11

What are the Threat Modelling Steps

Answer 11

• Identify assets and stakeholders
• Consider app architecture and environment
• Brainstorm known threats
• Define security assumptions
• Rank threats
• Decide threat priorities
• Decide how to mitigate threats