MIST 4630 Final May 4

What is the difference between "black box" and "white box" testing?

Black box testing requires no knowledge of internal paths, structures, or implementation of the software being tested. White box testing is a testing strategy based on internal paths, code structures, and implementation of the software being tested.

What are salts, and how are they used?

In password protection, salt is a random string of data used to modify a password hash. Salt can be added to the hash to prevent a collision by uniquely identifying a user's password, even if another user in the system has selected the same password. Salt can also be added to make it more difficult for an attacker to break into a system by using password hash-matching strategies because adding salt to a password hash prevents an attacker from testing known dictionary words across the entire system.

What are CAPTCHAs, and what are their limitations?

The advantages of CAPTCHA is that it will stop spammers from registering on your site. Spammers and bots cannot tell what letters and numbers there are in a CAPTCHA, therefore stopping them. However, CAPTCHA's may be annoying to type. If someone sees that there is a CAPTCHA when registering, they might back down and not join your site because of it. There is also another chance that the real people you think are registering to your site are bots, and the CAPTCHA is doing its job without losing real visitors and members. You can also look for an alternative to CAPTCHA, I know there are certain plugins that ask a question instead of you typing in a CAPTCHA. If registration doesn't go the way you want it to go, I recommend you use that plugin.

A ________ is testing a desired input against a list of negative input's. Basically you would compile a listing of all the negative or bad conditions, then verify that the input received is not one of the bad or negative conditions.

blacklist

What is the difference between hashing and encryption?

http://www.securityinnovationeurope.com/blog/whats-the-difference-between-hashing-and-encrypting

A ________ is testing a desired input against a list of possible correct input's. To do this you would compile a list of all the good input values/conditions, then verify that the input received IS one of this correct conditions.

whitelist