TRUE/FALSE QUESTIONS: Assurance is the process of examining a computer product or system with respect to certain criteria. Problems with providing strong computer security involve only the design...

TRUE/FALSE QUESTIONS:
1. Assurance is the process of examining a computer product or system with respect to
certain criteria.
True
SQA processes provide assurance that the software products and processes in the project life cycle
conform to their specified requirements by planning, enacting, and performing a set of activities to
provide adequate confidence that quality is being built into the software. This means ensuring that
the problem is clearly and adequately stated and that the solution’s requirements are properly
defined and expressed. SQA seeks to maintain the quality throughout the development and
maintenance of the product by the execution of a variety of activities at each stage which can result
in early identification of problems, an almost inevitable feature of any complex activity. The role of
SQA with respect to process is to ensure that planned processes are appropriate and later
implemented according to plan, and that relevant measurement processes are provided to the
appropriate organization.
2. Problems with providing strong computer security involve only the design phase.
True
More Secure Software, under the heading “It’s not just the code,” highlights that many software
security vulnerabilities are not coding issues at all but design issues. When one is exclusively
focused on finding security issues in code, that person runs the risk of missing out on entire
classes of vulnerabilities. Security issues in design and semantic flaws (ones that are not
syntactic or code related), such as business logic flaws, cannot be detected in code and need to
be inspected by performing threat models and abuse cases modeling during the design stage of
the SDLC. To identify the threats to the software being built. It starts by identifying the security
objectives of the software and profiles it. It breaks the software into physical and logical
constructs generating the software context that includes data flow diagrams, and end-to-end
deployment scenarios, identifying entry and exit points, protocols, components, identities, and
services. Threat Modeling is performed during the design stage so that necessary security
controls (safeguards) can be developed during the development phase of the software.
3. IT security management has evolved considerably over the last few decades due to the rise in
risks to networked systems.
True
Risk analysis drive the need for network security. For a while, information security was influenced to
some extent by fear, uncertainty, and doubt. Examples of these influences included the fear of a new
worm outbreak, the uncertainty of providing web services, or doubts that a particular leading-edge
security technology would fail. But we realized that regardless of the security implications, business
needs had to come first.
If your business cannot function because of security concerns, you have a problem. The security system
design must accommodate the goals of the business, not hinder them. Therefore, risk management
involves answering two key questions:
 What does the cost-benefit analysis of your security system tell you?
 How will the latest attack techniques play out in your network environment?
Dealing with Risk
There are actually four ways to deal with risk:
Reduce: This is where we IT managers evolve and it is the main focus of this book. We are
responsible for mitigating the risks. Four activities contribute to...