Sec+ Ch11: Secure Application Development, Deployment, and Automation Concepts

1. To develop secure software that prevents attackers from directly injecting attacks into computer memory and manipulating the application's process, one should employ which method? A. Elasticity B. Dead code C. Normalization D. Software diversity

1. D. Software diversity in the form of diverse binaries will prevent direct memory attacks against known software structures.

10. What is the only sure method of ensuring input is valid before use on a server? A. Use of third-party libraries and software development kits B. Server-side validation C. Stored procedures D. Client-side validation

10. B. Server-side validation is the only sure validation method for inputs to the application.

2. Problems in which phase will specifically stop continuous deployment but not necessarily continuous delivery? A. Continuous integration B. Continuous monitoring C. Continuous validation D. Continuous development

2. C. Continuous validation is required to ensure error-free software, and errors will stop continuous deployment.

3. Why is memory management important in software development? A. A program can grow and consume other program spaces. B. Memory is expensive. C. Memory can be a speed issue. D. None of the above.

3. A. Memory management failures can lead to a program growing in size when executing. This can result in either its own failure or the diminishing of memory resources for other programs.

4. When a program is installed and needs permissions, what is this called? A. Staging B. Provisioning C. Continuous integration D. Version control

4. B. Provisioning is the assignment of permissions or authorities to objects.

5. Which of the following statements concerning elasticity and scalability are true? A. Scalability requires elasticity. B. Elasticity involves enabling software to use more processors to do more work. C. Elasticity means being prepared to take advantage of scalability. D. All of the above.

5. D. All of the above is the correct answer. Scalability requires elasticity to scale, elasticity involves enabling software to use more processors to do more work, and elasticity means developing software that is prepared to take advantage of scalability.

6. To protect software from reverse engineering by attackers, developers can use which of the following? A. Dead code B. Obfuscation C. Binary diversity D. Stored procedures

6. B. Obfuscation is the technique of hiding properties to prevent examination. Making code hard to decompile and not storing any specific clues in the source code can make reverse engineering a challenge.

7. To manage various releases of software over time, the organization uses which of the following? A. Staging environment B. Provisioning and deprovisioning steps C. Version control D. Continuous integration

7. C. Version control comprises the processes and procedures employed to manage different releases of software over time.

8. Which of the following environments is used to test compatibility against multiple target environments? A. Production B. Test C. Quality assurance D. Staging

8. D. The staging environment can be used to manage software releases against different targets to ensure compatibility.

9. The fact that there are multiple methods of representing an object in a computer system can lead to issues when logical comparisons are needed. What can be used to ensure accuracy of comparison elements? A. Normalization B. Stored procedures C. Third-party libraries D. Third-party software development kits

9. A. Normalization is the process of reducing items to a canonical form before comparisons to ensure appropriate logical matching.

Data Exposure

Data exposure is the loss of control over data from a system during operations. Data must be protected during storage, during communication, and even at times during use. It is up to the programming team to chart the flow of data through a system and ensure it is protected from exposure throughout the process. Data can be lost to unauthorized parties (a failure of confidentiality) and, equally dangerous, can be changed by an unauthorized party (a failure of integrity). EXAM TIP The list of elements under secure coding techniques is long and specific in the CompTIA S+ exam objectives. It is important to understand the differences so you can recognize which one best fits the context of the question.

Memory Management

Memory management encompasses the actions used to control and coordinate computer memory, assigning memory to variables, and reclaiming it when it is no longer being used. Errors in memory management can result in a program that has a memory leak, and it can grow over time, consuming more and more resources. The routine to clean up memory that has been allocated in a program but is no longer needed is called garbage collection. In the C programming language and C++, where there is no automatic garbage collector, the programmer must allocate and free memory explicitly. One of the advantages of newer programming languages such as Java, C#, Python, and Ruby is that they provide automatic memory management with garbage collection. This may not be as efficient as specifically coding in C, but it is significantly less error prone.

Code Reuse and Dead Code

Modern software development includes the extensive reuse of components. From component libraries to common functions across multiple components, there is significant opportunity to reduce development costs through reuse. This can also simplify a system through the reuse of known elements. The downside of massive reuse is associated with a monoculture environment, which is where a failure has a larger footprint because of all the places it is involved with. During the design phase, decisions should be made as to the appropriate level of reuse. For some complex functions, such as in cryptography, reuse is the preferred path. In other cases, where the lineage of a component cannot be established, the risk of use may outweigh the benefit. Additionally, the inclusion of previous code, sometimes referred to as legacy code, can reduce development efforts and risk. Dead code is code that, while it may be executed, obtains results that are never used elsewhere in the program. There are compiler options that can remove dead code, called dead code elimination, but these must be used with care. Assume you have a section of code that you put in specifically to set a secret value to all zeros. The logic is as follows: generate a secret key, use the secret key, set the secret key to zero. You set the secret key to zero to remove the key from memory and keep it from being stolen. But along comes the dead code removal routine. It sees you set the value of secretkey == 0, but then you never use it again. So, the compiler, in optimizing your code, removes your protection step.

Normalization

Normalization is an initial step in the input validation process. Specifically, it is the process of creating the canonical form, or simplest form, of a string before processing. Strings can be encoded using Unicode and other encoding methods. This makes byte-by-byte comparisons meaningless when trying to screen user input of strings. Checking to see whether the string is "rose" can be difficult when "A Rose is a rose is a r%6fse." The process of normalization converts all of these to "rose," where they can then be screened as valid input. Different libraries exist to assist developers in performing this part of input validation. Developers should always normalize their inputs prior to validation steps to remove Unicode and other encoding issues. Per the Unicode standard, "When implementations keep strings in a normalized form, they can be assured that equivalent strings have a unique binary representation." Canonical form refers to simplest form and, because of the many encoding schemes in use, can be a complex issue. Characters can be encoded in ASCII, Unicode, hex, UTF-8, and even combinations of these. So, if the attacker desires to obfuscate a response, then several things can happen. (examples in book)

Obfuscation/Camouflage

Obfuscation or camouflage is the hiding of obvious meaning from observation. While obscurity is not considered adequate security under most circumstances, adding obfuscation or camouflage to a system to make it harder for an attacker to understand and exploit is a good thing. Numbering your e-mail servers email1, email2, email3, . . . tells an attacker what namespace to explore. Removing or hiding these hints makes the work harder and offers another layer of protection. This works well for data names and other exposed elements that have to be exposed to the outside. Where this does not work well is in the construction of code. Obfuscated code, or code that is hard or even nearly impossible to read, is a ticking time bomb. The day will come when someone will need to read the code, figure out how it works so it can be modified, or determine why it is not working. If programmers have issues reading and understanding the code, including how it functions and what it is supposed to do, how can they contribute to its maintenance?

Stored Procedures

Stored procedures are methods of interfacing with database engines. Stored procedures are precompiled scripted methods of data access that offer many advantages. First is speed. Because they are precompiled, they can run much more efficiently in the production environment. But because they are scripted in advance, they offer much less flexibility than other methods such as using parameterized queries or building and executing SQL statements on the fly in an application program.

Open Web Application Security Project (OWASP)

The Open Web Application Security Project (OWASP) is a nonprofit foundation dedicated to improving web-based application software security. Best known for its top ten list of software vulnerabilities associated with website applications, OWASP also has a multitude of useful guidelines on its website, www.owasp.org. OWASP is a resource that should be actively used by web application programmers to prevent vulnerabilities that are common in web applications. This site has tons of resources to assist developers in producing better and more secure apps.