Certified Information Systems Security Professional (CISSP) Software Development Security Flashcards

24 sample cards from the Software Development Security deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is a TOC/TOU attack an example of more generally?

   A race condition / state-change attack exploiting non-atomic check-then-act sequences. The lesson: validation and use of a resource must occur atomically.

2. What is input validation and why is allowlisting preferred over denylisting?

   Verifying that input conforms to expected type, length, format, and range before processing. Allowlisting (accept only known-good) is preferred because denylisting (block known-bad) inevitably misses novel malicious patterns.

3. What is output encoding and what attack does it primarily prevent?

   Converting output characters into a safe representation for the rendering context (HTML, URL, JS) so they are treated as data, not code. It primarily prevents Cross-Site Scripting (XSS).

4. What is the secure coding principle of 'fail securely' (fail-safe defaults)?

   When a system fails, it should default to a secure/denied state rather than granting access. Errors should not leave the system in an insecure condition or leak sensitive information.

5. What is 'defense in depth' as a secure coding/architecture principle?

   Applying multiple, layered, independent security controls so that if one control fails, others still protect the asset. No single point of failure protects the system.

6. What is the principle of least privilege in secure coding?

   Granting each user, process, or component only the minimum permissions necessary to perform its function, and only for as long as needed, to limit the impact of compromise.

7. What is 'economy of mechanism' (keep it simple) in secure design?

   Security mechanisms should be as small and simple as possible, because complexity increases the likelihood of flaws and makes design harder to verify.

8. What is 'complete mediation' as a Saltzer and Schroeder design principle?

   Every access to every object must be checked for authorization on every request, rather than caching or assuming prior approval still holds.

9. What is 'open design' as a security principle?

   Security should not depend on the secrecy of the design or implementation ('no security through obscurity'); it should rely on the secrecy of keys/passwords, allowing open scrutiny of the mechanism.

10. What is 'separation of duties' / 'separation of privilege'?

    Requiring more than one condition or person to complete a sensitive action, so that no single individual or component has enough power to compromise the system alone.

11. What is the 'least common mechanism' principle?

    Minimizing shared mechanisms (e.g., shared variables, shared services) among users/processes, because shared resources can become channels for information leakage or unauthorized influence.

12. What is 'psychological acceptability' in secure design?

    Security mechanisms should be easy to use and not impose excessive burden, or users will bypass or misuse them, undermining protection.

13. What is a sandbox in application security architecture?

    An isolated execution environment that restricts a program's access to system resources, containing untrusted or potentially malicious code so it cannot harm the host system.

14. What is a reference monitor and what enforces it?

    An abstract concept that mediates all access between subjects and objects; it must be tamperproof, always invoked, and verifiable. The security kernel is the hardware/software/firmware that implements it.

15. What is the difference between trusted computing base (TCB) and the attack surface?

    The TCB is the totality of protection mechanisms (hardware, software, firmware) responsible for enforcing security policy. The attack surface is the sum of all points where an attacker could attempt entry; secure design minimizes both unnecessary attack surface and TCB complexity.

16. What are the three main types of application security testing: SAST, DAST, and IAST?

    SAST (Static): analyzes source/binary code without executing it (white-box). DAST (Dynamic): tests the running application from outside (black-box). IAST (Interactive): instruments the running app to combine both during testing.

17. What is fuzzing (fuzz testing)?

    An automated dynamic testing technique that feeds malformed, unexpected, or random inputs to an application to discover crashes, memory leaks, and exploitable vulnerabilities.

18. What is Software Composition Analysis (SCA)?

    Tooling that identifies open-source and third-party components in software, detecting known vulnerabilities (CVEs), license risks, and outdated dependencies in the supply chain.

19. What is the purpose of audit logging for code and configuration changes?

    To create a tamper-evident, attributable record of who changed what, when, and why — supporting accountability, non-repudiation, forensic investigation, and detection of unauthorized changes.

20. What logging best practice prevents an attacker from covering their tracks after compromise?

    Forwarding logs in near-real-time to a secure, centralized, write-once/append-only log server (or SIEM) separate from the monitored system, so local log tampering does not destroy the evidence.

21. What sensitive data should NOT be written to application logs?

    Secrets and sensitive data such as passwords, session tokens, API keys, full credit-card numbers, and personally identifiable information (PII) — they must be masked, redacted, or excluded.

22. What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

    A formal, machine-readable inventory of all components, libraries, and dependencies in a software product. It enables rapid identification of affected systems when a component vulnerability (e.g., Log4Shell) is disclosed.

23. What security practices apply when acquiring or using third-party/COTS software?

    Vendor risk assessment, reviewing security track record and SLAs, code/escrow and SBOM review, validating patches and updates, contractual security requirements, and ongoing monitoring for supply chain compromise.

24. What is the purpose of defining organizational secure coding guidelines and standards?

    To provide developers consistent, enforceable rules (e.g., OWASP, CERT, language-specific standards) on input validation, error handling, cryptography, and authentication, reducing common vulnerabilities and enabling measurable, auditable secure development.

What this deck covers

Software Development Security flashcards FAQ