CISSP Cheat Sheet Series
Software Development Lifecycle (SDLC)

Programming Language Types

Data Warehousing and Data Mining

Understand and integrate security throughout the software development
lifecycle (SDLC)

MachineLanguages

Direct instructions to processor - binary representation

Data
Warehousing

Combine data from multiple sources.

Development Methodologies

Assembly
Language

Use of symbols, mnemonics to represent binary codes ADD, PUSH and POP

Data Mining

Arrange the data into a format easier to make businessdecisions based on the content.

High-Level
Language

Processor independent programming languages - useIF, THEN and ELSE statements aspart of the code logic

Very high-levellanguage

Generation 4 languages further reduce amount of code
required - programmers can focus on algorithms.
Python, C++, C# and Java

Build and ﬁx• No key architecture design• Problems ﬁxed as they occur• No formal feedback cycle• Reactive not proactiveWaterfall• Linear sequential lifecycle• Each phase is completed before moving on• No formal way to make changes during cycle• Project ends before collecting feedback and re-starting

V-shaped• Based on the waterfall model• Each phase is complete before moving on• Veriﬁcation and validation after each phase• No risk analysis phase

Prototyping

IncrementalSpiral

RapidApplication
Development(RAD)Agile• Rapid prototyping - quick sample to test the current
project• Evolutionary prototyping - incremental improvements toa design• Operational prototypes - incremental improvements
intended for production• Multiple cycles (~ multiple waterfalls)• Restart at any time as a different phase• Easy to introduce new requirements• Delivers incremental updates to software• Iterative• Risk analysis during development• Future information and requirements considered for risk
analysis• Allows for testing early in development• Rapid prototyping• Designed for quick development• Analysis and design are quickly demonstrated• Testing and requirements are often revisited• Umbrella term - multiple methods• Highlights eﬃciency and iterative development• User stories describe what a user does and why• Prototypes are ﬁltered down to individual features

DevOps (Development & Operations)

Naturallanguage

Database Architecture and Models
Relational Model

Database Systems
Database

Parent child structure. An object can have one child,multiple children or no children.

Network Model

Similar to hierarchical model but objects can havemultiple parents.

Object-Oriented
Model

Has the capability to handle a variety of data types
and is more dynamic than a relational database.

Object-Relational
Model

Combination of object oriented and relationalmodels.

Software program control access to data stored
in a database.

DBMS Types

Hierarchical • Network • Mesh • Object-orientated• Relational

DDL
Degree of Db

Open Database
Connectivity (ODBC)

Local or remote communication via API

Java Database
Connectivity (JDBC)Java API that connects to a database,issuing queries and commands, etc

Tuple

row

DDE

Dynamic data exchange

DCL

Data control language. Subset of SQL.

Semantic integrity

ensure semantic rules are enforced between datatypes

Referential integrity

all foreign keys reference existing primary keys

Candidate Key

an attribute that is a unique identiﬁer within agiven table, one of the candidates key becomesprimary key and others are alternate keys

Primary Key

Foreign Key

DBMS terms

unique data identiﬁcationreference to another table which include primarykey. Foreign and primary keys link is known as
referential integrity.

• Incorrect Summaries • Dirty Reads • LostUpdates• Dynamic Lifetime Objects: Objects developed
using software in an Object Oriented
Programming environment.
• ODBC - Open Database Connectivity. Databasefeature where applications to communicate withdifferent types of databases without a programcode.
• Database contamination - Mixing data withdifferent classiﬁcation levels• Database partitioning - splitting a single
database into multiple parts with unique contents• Polyinstantiation - two or more rows in the same
relational database table appear to have identicalprimary key and different data in the table.

The act of combining information from various sources.

Inference

Process of information piecing

AccessControl• Content Dependent Access Control: access is based on
the sensitivity of the data
• Context Dependent Access Control: access via
location, time of day, and previous access history.

AccessControl
Mechanisms• Database Views: set of data a user or group can see• Database Locks: prevent simultaneous access• Polyinstantiation: prevent data interference violations
in databasesA•C•I•D
Atomicity

Database roll back if all operations are not completed,transactions must be completed or not completed at allConsistency

Preserve integrity by maintaining consistent transactions

Isolation

Transaction keeps separate from other transactions until
complete

Durability

Committed transaction cannot be roll backed

Traditional SDLC
Steps

Analysis, High-level design, Detail Design, Construction,
testing, Implementation

Phases• Initiation: Feasibility, cost analysis, risk analysis,Management approval, basic security controls• Functional analysis and planning: Requirement
deﬁnition, review proposed security controls• System design speciﬁcations: detailed design specs,
Examine security controls• Software development: Coding. Unit testing Prototyping,Veriﬁcation, Validation• Acceptance testing and implementation: securitytesting, data validation

DB API allows XML applications to interact
with more traditional databases

XML

Object Linking andEmbedding Database (OLE is a replacement for ODBCDB)

Knowledge Management
ExpertSystems

ExpertSystems (TwoModes)

Data deﬁnition language deﬁnes structure andschema DML
number of attributes (columns) in table

Aggregation

Database Interface Languages

Deﬁne storing and manipulating data

DBMS (databasemanagementsystem)

Uses attributes (columns) and tuples (rows) toorganize data

HierarchicalModel

Software Development • Quality Assurance • ITOperations

Software Development Methods

Generation 5 languages enable system to learn andchange on its own - AI

Database Threats

NeuralNetworks

Two main components: 'Knowledge base' and the'Inference engine'• Use human reasoning• Rule based knowledge base• If-then statements• Interference system• Forward chaining: Begins with known facts and applies
inference rule to extract more data unit it reaches to thegoal. A bottom-up approach. Breadth-ﬁrst searchstrategy.
• Backward chaining: Begins with the goal, works
backward through inference rules to deduce therequired facts that support the goal. A top-down
approach. Depth-ﬁrst search strategy.
Accumulates knowledge by observing events,
measuring their inputs and outcome, then predicting
outcomes and improving through multiple iterations
over time.

Covert Channels (Storage & Timing)
Executable content
Mobile code

ActiveX controls, Java applets, browser scripts

Virus

Propagates with help from the hostWorm

Propagates without any help from the host

Logic Bomb/CodeBomb

Run when a speciﬁc event happens

Buffer Overﬂow

Memory buffer exhaustion

Backdoor
Covert Channel

Malicious code install at back end with thehelp of a front end user
Unauthorized information gathering

BotnetZombie code used to compromise thousandsof systems

TrojanMalicious code that outwardly looks orbehaves as harmless or necesary code

Object-oriented technology (OOT) Terminology
Objects contain both data and the instructions that workon the data.
Encapsulation

Data stores as objects

MessageInforms an object to perform an action.

MethodPerforms an action on an object in response to amessage.

Behavior

Results shown by an object in response to amessage. Deﬁned by its methods, which are thefunctions and subroutines deﬁned within the object
class.

Change Management Process
RequestControl

Develop organizational framework where users canrequest modiﬁcations, conduct cost/ beneﬁt analysis bymanagement, and task prioritization by developers

ChangeControl

Develop organizational framework where developers cancreate and test a solution before implementation in a
production environment.

ReleaseControlChange approval before releaseConﬁguration Management Process
Software VersionControl (SVC)
Conﬁguration
Identiﬁcation

The labelling of software and hardware
conﬁgurations with unique identiﬁers

Conﬁguration Control

Verify modiﬁcations to software versions
comply with the change control andconﬁguration management policies.

Conﬁguration Audit

Ensure that the production environment is
consistent with the accounting records

Capability Maturity Model
Reactive

1. Initiating – informal processes,
2. Repeatable – project management processes

Proactive

3. Deﬁned – engineering processes, project planning,
quality assurance, conﬁguration management practices
4. Managed – product and process improvement
5. Optimizing – continuous process improvement

Project Management Tools
Gantt chart

Type of bar chart that illustrates the relationshipbetween projects and schedules over time.

Program Evaluation
Review Technique(PERT)

Project-scheduling tool used to measure thecapacity of a software product in development
which uses to calculate risk.

Phases of object-oriented design
OORA (RequirementsAnalysis)
OOA (Analysis)
OOD (Design)

Objects are instances of classes

OOP (Programming)

Introduce objects and methods

ORBs (Object RequestBrokers)

Work as middleware locators and distributors
for the objects

CORBA (Commonobject request)

Architecture and standards that use ORBS toallow different systems and software on asystem to interfce with eachotherCohesionSet of methods which deﬁnes the behavior ofobjects

ObjectAn instance of a class containing methods

Inheritance

Subclass accesses methods of a superclassMultiple
Inheritance

Inherits characteristics from more than one parent
class

Polyinstantiation

Two or more rows in the same relational databasetable appear to have identical primary key elements
but contain different data

Boot sector

Boot record infectors, gain the most privaleged
access and can be the most damaging

Abstraction

Object users do not need to know the information
about how the object works

System infector

Infects executable system ﬁles, BIOS and systemcommands

Process isolation

Allocation of separate memory spaces for process’s
instructions and data by the operating system.

UEFI

Infects a system's factory installed UEFI (ﬁrmware)

Companion

Virus stored in a speciﬁc location other than in themain system folder. Example NOTEPAD.EXE

StealthAny modiﬁcations to ﬁles or boot sector are hiddenby the virus

Multipart

Infects both boot sector and executable ﬁlesTrusted Computer Base (TCB)
The set of all hardware, ﬁrmware, and/or software components that are
critical to its security. Any compromises here are critical to systemsecurity.
Input/output
operations

May need to interact with higher rings ofprotection - such communications must be
monitoredExecution domain
switching

Applications that invoke applications orservices in other domains

Memory protection

Monitoring of memory references to verify
conﬁdentiality and integrity in storage

Process activation

Monitor registers, process status information,and ﬁle access lists for vulnerabilitiesBrowser site trust is exploited by trying tosubmit authenticated requests forcefully tothird-party sites.

Penetration Testing

A process of identifying and determining thetrue nature if system vulnerabilities

Cross-site scripting(XSS)

Uses inputs to pretend a user’s browser to
execute untrusted code from a trusted site

Patch management
systemManages the deployment of patches toprevent known attack vectors

Session Hijacking

Attempts to obtain previously authenticatedsessions without forcing browser requests
submission

Open system

System with published APIs - third parties canuse system

SQL Injection

Directly attacks a database through a web app

Closed system

Proprietary system - no third-party
involvement

Open-source

Source code can be viewed, edited anddistributed free or with attribution or fees

API Keys

Used to access API. Highly sensitive - sameas passwords

Service Pack

Collection of patches for a complete operating
systemWork independently without help from otherprograms• High cohesion – No integration or interaction
with other modules• Low cohesion – Have interaction with othermodules• Coupling - Level of interaction between objects

ClassCross-site request
forgery (CSRF / XSRF )Updates to operating systems andapplications

Deﬁne classes of objects and interactions
Identify classes and objects which are common
to any applications in a domain - process ofdiscovery

Virus Types

Self-garbling

Attempts to hide from anti-virus by changing theencoding of its own code, a.k.a. 'garbling'

Polymorphic

The virus modiﬁes the "garble" pattern as it spreads

Resident

Loads as and when a program loads to the memory

Master bootrecord / sector(MBR)

Infects the bootable section of the system

Anti-Virus Types

Security Assessment & Testing Terms

Hotﬁx / Update /Security ﬁx

A methodology for storing and tracking changes
to software

Signature based

Not able to detect new malware a.k.a. Zero-day
attacks

Heuristic based

Static analysis without relying on signaturesProtection Rings
Layer 0Operating system kernel

Layer 1

Parts of the operating system other than the kernel

Layer 2I/O drivers and utilities

Layer 3

Applications and programs