C-SWCM flashcards
C-SWCM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- STRIDE categories
- A threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Each category maps to a security property that a control must protect.
- Trust boundary
- A point in a data flow diagram where data crosses between components with different privilege or ownership. Each boundary is a candidate location for validation and threat enumeration.
- Defense in depth
- Layering independent security controls so that failure of one does not cause compromise. Controls should not share the same failure mode or credential store.
- DREAD risk score
- A qualitative risk model averaging Damage, Reproducibility, Exploitability, Affected users, and Discoverability. Higher totals indicate higher priority, though scoring is subjective.
- Fail-safe defaults
- A design principle where access is denied unless explicitly permitted. Error conditions must fail closed rather than granting access by default.
- Session fixation
- An attack where an attacker sets or knows a victim's session identifier before login. Mitigation is to issue a new session ID at authentication and invalidate the old one.
- IDOR
- Insecure Direct Object Reference: the server trusts a client-supplied identifier without verifying the subject is authorized to access that object. Prevented by server-side object-level authorization checks.
- OAuth 2.0 with PKCE
- An authorization code flow where the client sends a code_challenge and later proves possession of the code_verifier. It prevents authorization code interception and is required for public clients.
- OpenID Connect
- An identity layer on top of OAuth 2.0 that adds an ID token (a signed JWT) and a UserInfo endpoint. It enables authentication, whereas OAuth alone is authorization.
- Password hashing KDFs
- Adaptive functions such as Argon2id, scrypt, bcrypt, and PBKDF2 with high iterations. They are salted and deliberately slow, unlike fast hashes such as SHA-256.
- RBAC versus ABAC
- RBAC assigns permissions to roles and roles to users. ABAC evaluates attributes of subject, resource, action, and environment, enabling finer-grained and context-aware policy decisions.
- Parameterized queries
- Prepared statements that send SQL structure and data separately, so user input is never parsed as SQL syntax. This is the primary defense against SQL injection.
- Stored XSS
- A cross-site scripting variant where the malicious payload is persisted server-side and served to other users. Prevention requires context-aware output encoding and CSP.
- DOM-based XSS
- XSS where client-side JavaScript reads a tainted source (such as location.hash) and passes it to a dangerous sink like innerHTML or eval, without server involvement.
- Content Security Policy
- An HTTP response header restricting which sources may load scripts, styles, and other resources. Nonce- or hash-based policies mitigate XSS better than allowlists with unsafe-inline.
- Command injection prevention
- Avoid shell invocation and use argument-array process APIs, with allowlist validation of inputs. Never concatenate untrusted data into a shell command string.
- Second-order injection
- Injection where stored data is later used unsafely in a query or command. Input-time validation does not replace safe handling at the sink.
- AES-GCM
- An authenticated encryption mode providing confidentiality and integrity. A nonce must never be reused with the same key, and ECB mode should not be used for structured data.
- Encrypt-then-MAC
- A composition where ciphertext is authenticated after encryption. It avoids padding-oracle and forgery weaknesses of MAC-then-encrypt and encrypt-and-MAC constructions.
- HSTS
- Strict-Transport-Security forces browsers to use HTTPS for a defined period. With includeSubDomains and preload, it protects against protocol downgrade and cookie hijacking.
- Envelope encryption
- A scheme where a data key encrypts content and a master key in a KMS or HSM wraps the data key. It limits exposure and simplifies key rotation.
- CSPRNG for tokens
- Cryptographically secure pseudorandom generators produce unpredictable values for session IDs and tokens. Math.random and time-based seeds are predictable and unsuitable.
- Insecure deserialization
- Processing untrusted serialized data can trigger gadget chains and remote code execution. Mitigate with class allowlists, integrity checks, and avoiding native serialization of untrusted input.
- SSRF mitigation
- Server-side request forgery is mitigated by allowlisting destinations, blocking link-local and metadata addresses such as 169.254.169.254, and disabling redirects to internal ranges.
- TOCTOU race condition
- A time-of-check-to-time-of-use flaw where state changes between validation and use. Mitigate with atomic operations, database constraints, and locking.
- Security headers
- Response headers such as Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and frame-ancestors that reduce XSS, MIME sniffing, and clickjacking risk.
- CVSS base score
- A numeric severity from exploitability and impact metrics. Temporal and environmental metrics adjust it for current threat and organizational context.
- SAST versus DAST
- SAST analyzes source or bytecode without executing the application. DAST tests a running application from the outside. They find different classes of defects and are complementary.
- IMDSv2
- A cloud instance metadata service requiring a session token, which raises the bar for SSRF-based credential theft. IMDSv1 can be reached with a simple GET request.
- Container hardening
- Running as non-root, using read-only root filesystems, dropping Linux capabilities, and avoiding privileged mode. These reduce impact if the container is compromised.
- Shift-left security
- Integrating security checks such as SAST, SCA, and secret scanning into CI/CD pipelines so defects are found earlier, when remediation is cheaper.
- Incident response phases
- Per NIST: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Evidence should be preserved before destructive containment actions.