1. CSCE 548 Secure Software Development Final Exam – Review 2016

2. Reading McGraw: Software Security: Chapters 1 – 9
24 deadly sins: as listed on class’ site
Non-textbook reading: as listed on class’ site
CSCE Farkas

3. Final Exam July 29, 2016, 8:30 am – 11:00 am
Closed book – 2 pages cheat sheet
CSCE Farkas

4. Sample Questions – 24 deadly sins
Explain why casting operations may lead to integer overflows.
Why is it dangerous to use “gets” to read input in C/C++ code? Recommend an alternate.
What is the difference between attack patterns and taxonomy of programming errors?
Indirect information flow may be created by inferences. Give an example of an unauthorized inference that cannot be controlled using traditional access control.
Show an example code for SQL Injection. Explain the security problem.
Why does a failed Windows impersonation create a security problem if not handled properly?
Show the binary representations of the decimal numbers +70 and Show their addition using an 8 bits register.
CSCE Farkas

5. Sample Questions
Explain a way how buffer overruns occur. Which languages are the most vulnerable?
Define covert and overt communication channels.
Explain the 2 stages of the buffer overrun attack.
Why do we have binary arithmetic operations that yield results different on paper than by a computer. Give an example.
What type of access control Windows support? Give a common access control mistake in Windows environment.
Should stored data be protected by the operating system security or by database management system security?
CSCE Farkas