CISSP考试指南笔记：8.15 快速提示

debugeeker

于 2021-04-16 22:59:28 发布

阅读量338

点赞数

分类专栏： CISSP备考资料

本文链接：https://blog.csdn.net/xuzhina/article/details/115773683

版权

CISSP备考资料专栏收录该内容

120 篇文章 5 订阅

订阅专栏

Security should be addressed in each phase of system development. It should not be addressed only at the end of development because of the added cost, time, and effort and the lack of functionality.
The attack surface is the collection of possible entry points for an attacker. The reduction of this surface reduces the possible ways that an attacker can exploit a system.
Threat modeling is a systematic approach used to understand how different threats could be realized and how a successful compromise could take place.
Computer-aided software engineering refers to any type of software that allows for the automated development of software, which can come in the form of program editors, debuggers, code analyzers, version-control mechanisms, and more. The goals are to increase development speed and productivity and reduce errors.
Various levels of testing should be carried out during development: unit (testing individual components), integration (verifying components work together in the production environment), acceptance (ensuring code meets customer requirements), regression (testing after changes take place), static analysis (reviewing programming code), and dynamic analysis (reviewing code during execution).
Fuzzing is the act of sending random data to the target program in order to trigger failures.
Zero-day vulnerabilities are vulnerabilities that do not currently have a resolution or solution.
The ISO/IEC 27034 standard covers the following items: application security overview and concepts, organization normative framework, application security management process, protocols and application security control data structure, case studies, and application security assurance prediction.
The Open Web Application Security Project (OWASP) is an organization dedicated to helping the industry develop more secure software.
An integrated product team (IPT) is a multidisciplinary development team with representatives from many or all the stakeholder populations.
The CMMI model uses five maturity levels designated by the numbers 1 through 5. Each level represents the maturity level of the process quality and optimization. The levels are organized as follows: 1 = Initial, 2 = Repeatable, 3 = Defined, 4 = Managed, 5 = 5 Optimizing.