secure programming

Question 1

what is STRIDE?

Answer 1

• Spoofing of user identity
• Tampering of data
• Repudiation of actions
• Information disclosure
• Denial of service
• Elevation of privilege

Question 2

how can you prevent malicious input?

Answer 2

• ensure input can only be created +modified by trusted parties
• Authenticate source
• Control access to source

Question 3

how can you detect malicious input?

Answer 3

• Format
• verify properties of input
• check sums, access log files

Question 4

how should you react to maicious input?

Answer 4

• refuse, block
• alert, notify
• log, shut down

Question 5

What is defensive programming?

Answer 5

always validate input
-size, format, sequence, integrity, authenticity
anticipate failures and handle them

Question 6

What is a trusted path?

Answer 6

A mechanism by which a person at a terminal can communicate directly with the Trusted Computing Base.