[Information processing engineer handwriting] Information system construction and management

Software life cycle model

waterfall model

? It is the oldest model among the life cycle models and has many application cases, but it is difficult to change requirements and the results of each stage must be confirmed before moving on to the next stage. It is also called a linear sequential or classical life cycle model.

V model

Parallel form of the waterfall model
? Design from the top down, then build from the bottom up
It was proposed by Perry and consists of a detailed testing process, making it effective in developing a highly reliable system.
It can be seen as a variation of the waterfall model that clearly reveals the relationship between development work and verification work.
While the waterfall model focuses on output, the V model focuses on verification of tasks and results.

spiral model

This is a model that views the software development process from a risk management perspective.
? Risk analysis is performed several times at each stage during iterative development.
The system is completed by dividing it into several parts and going through several development cycles.
? This model is suitable when it is difficult to understand requirements or architecture, or when there are problems with the central technology.

Software Development Methodology

Tailoring

This is an activity to appropriately change procedures, outputs, etc. to apply a development methodology optimized for the project.
One of the purposes in management is to identify and eliminate risks in advance to ensure stable project progress in the shortest possible time.
One of the goals in the technical aspect is to introduce technology elements optimized for the project and use optimal techniques and tools suited to the characteristics of the project.
? This does not rule out change.

3 elements of information security

Confidentiality, Integrity, Availability

Confidentiality: Only authorized users have access to information assets. Firewalls, passwords, passwords, etc.
Integrity: Ensuring that information can only be changed in a manner authorized by users with appropriate authority.
Availability: Ensuring access to information assets when needed. backup, etc.
? Volatility is not applicable.

Application security settings for vulnerability management

Setting execution process permissions
Operating system access restrictions
Limit collection of information from operating system
Maintaining the accuracy, consistency, and validity of integrity check data.

Application security settings and patches

Check and remove unnecessary services and malicious programs

framework

The operating principle of the framework is sometimes described as IoC (Inversion of Control) because its control flow operates in the opposite direction to the general program flow.
It is a development software that allows expanded reusability and guaranteed performance by using service components required for each domain based on a semi-finished product.
Characteristics: Modularity, reusability, scalability, reverse flow of control
Python web crawling framework: Scrapy

library

It is called and used from user code, and the user code also has control over it.

TensorFlow

An open source software library for machine learning created and released by Google's Google Brain team.

Cloud-based Hardware Security Module (HSM)

It is a security device that generates, processes, and stores cloud (data center)-based encryption keys.
In Korea, the term cloud HSM frequently appeared as the public authentication system was abolished and the Electronic Signature Act was revised.
Because certificates are stored in the cloud, there is no need to store certificates on existing HSM devices or mobile phones.
Because dedicated hardware is in charge, the security vulnerabilities inherent in software-only encryption technology can be resolved.

encryption algorithm

Salt: Passwords stored in the system are stored as Hash or the result of an encryption algorithm. At this time, a value is added so that identical passwords are stored as different password values to prevent password attacks.

Two-way encryption algorithm

symmetric encryption algorithm

Because it is relatively fast to execute, it is used as a core function in various passwords.
The same key must be shared between the exchanging parties, which makes key management difficult and causes inconvenience when there are frequent key changes.
? Key exchange required
? Block cipher (AES, DES, ARIA, SEED, HIGHT, IDEA) DES: Among the 64-bit key (external key), 56 bits become the actual key (internal key), and the rest are used as spurious bits.

Stream Cipher (RC4)

Asymmetric encryption algorithm

RSA
Public key, encryption key exists
Can be applied to authentication, electronic signature, etc. using a secret key that only you keep

One-way encryption algorithm

MDC

Ensure message integrity
MD5, SHA-1, SHA-2
Symmetric key not used

MCA

Message Authentication
Use symmetric key

access control

It controls access to specific systems or information so that only authorized personnel have appropriate authority.
The most basic means of controlling access to systems and networks are IP and service ports.
Access control for IP performed by network equipment includes access control of the management interface and ACL (Access Control List).

Mandatory Access Control

An access control method that prevents information (objects) requiring a high security level from being exposed to subjects with a low security level based on security labels on both sides when a subject attempts to access a specific object within an information system.

Intrusion Detection System (IDS)

? Abuse detection technique, also called Signature Base or Knowledge Base, enters already discovered and established attack patterns and then detects and blocks them.

HIDS (Host-Based Intrusion Detection) records and tracks which users attempted which access and which actions were performed according to the user account set in the operating system.

A representative example of a NIDS (Network-Based Intrusion Detection System) is Snort.

? An IDS can be installed in the DMZ (Demilitarized Zone), a network where servers that provide services to the external Internet are located.

Security terminology

Worm

Among the types of malware, it spreads itself by taking advantage of vulnerabilities in other computers or spreads by email to multiply itself.
Malicious software program that replicates itself
Stuxnet is infected through Microsoft Windows and attacks Siemens Industrial software and equipment.

Ransomware

It is one of the major cyber crimes that pose a major threat to individuals, businesses, and the nation. Malicious programs such as Snake and Darkside are used to lock systems or encrypt data to make it unusable and demand money by holding it hostage.

Rogue Ware

fake antivirus software
They falsely convince users that their computer has a virus and then convince them to install actual malware on their computer or pay for fake malware removal tools.

Adware

Advertising programs that activate automatically or when you run certain software
It is also classified as malicious code due to the risk of abuse, such as opening indiscriminate advertising pop-ups.

Reflection Attack

reflex attack
An attack method in which an attacker intercepts a message created by the sender and retransmits the message back to the sender to gain access.

RBAC(Role-Based Access Control)

Among access control methods, an access policy is determined and granted based on an individual's role, such as job or position, within the organization.

tcp wrapper

An access control utility that checks whether access is authorized when an external computer is connected, and if authorized, access is allowed, and vice versa, it can be denied.
Tool for investigating traces of system intrusion, investigating hacked systems

Rooting

It refers to the act of gaining administrator rights by hacking the operating system of an Android phone, and is derived from a term referring to the act of gaining administrator rights in Linux.

Switch Jamming

An attack that paralyzes the function of the switch
An attack that continuously sends forged Media Access Control (MAC) addresses to the network, confusing the storage function of the switch MAC address table and causing it to operate like a dummy hub.

? Bluetooth attack

BlueSnarf

Attacks that access arbitrary files on the device

BluePrinting

This refers to the search activity of Bluetooth attack devices.

BlueBug

Attacks that exploit weak connection management between devices

BlueJacking

Distributing business cards anonymously like spam

? Denial of Service (DoS) attacks

Ping of Death attack

As one of the system attack techniques, it paralyzes the network of the target system by transmitting ICMP packets exceeding the allowable range.
This is an attack method that splits ICMP packets larger than the normal size into small fragments and forces the attack target to process the fragmented packets.
Buffer overflow and system crashes occur during the process of reassembling small-sized packets.

Ping Flood

An attack method that prevents the system from operating normally by sending too many ICMP echoes to a specific site and using up all system resources to respond.

Smurf attack

An attack in which an attacker manipulates ICMP to send a large amount of ICMP Reply to the attack target at once. The attacker sets the source address to the IP of the server to be attacked and sends ICMP as a broadcast to all hosts on the network.
An attack in which numerous hosts send ICMP replies to a server and the server processes them, causing system overload.
Broadcast refers to a method in which data transmitted by a sending host is transmitted to all hosts connected to the network.

SYN Flooding

Flooding is a DoS attack that prevents others from connecting by sending a lot of the attacker's request logs to the server.
This prevents other users from using the service by pretending that a non-existent client is connected to a space limited to each server.
Same as FTP Flooding?

Land Attack

This is an attack method that makes the source IP address and destination IP address the same when transmitting a packet and sends it to the attack target.
Resources are depleted as it continues to run inside the server.

Piggyback Attack

A method of bypassing devices that usually have many physical security devices by sneaking in using social engineering methods.

XSS(=CSS, Cross Site Scripting)

An attack technique in which an attacker writes and inserts a malicious script on a bulletin board, and when a user views it, an event occurs and the user's cookie information, personal information, etc. are sent to a specific site.

Land Attack

This is an attack technique that makes the source IP address and destination IP address the same when transmitting a packet and sends it to the attack target.

CSRF(Cross Site Request Forgery)

An attack technique that causes a user to request an action (edit, delete, register, etc.) intended by the attacker to a specific website regardless of his or her will.

Honeypot

It was first proposed by David Clock in the 1990s.
This is a system intentionally installed to detect abnormal access.
It plays a role in tracking crackers and collecting information on attack techniques by tricking intruders into thinking they are actually being attacked.
It must be easily exposed to attackers and must appear vulnerable as if it can be easily attacked.

Secure coding-related input data security weaknesses

SQL Injection

Attacks by inserting external input values, such as user input values, into SQL queries
? Methods may vary depending on DBMS

cross site script

Malicious code is executed in the browser due to unvalidated external input values.

Inserting operating system commands

An attacker manipulates operating system commands because operating system command parameter input values are used without proper prior verification.

Resource Insertion

? Note that this is an external input value.
If external input values are used as identifiers for system resources without verifying them, there is a security issue in which resources protected by the system can be arbitrarily accessed or modified through input value manipulation.

Technical/Common Sense Terms

Zing

Ultra-fast NFC technology
? High-speed NFC (Near Field Communication) technology that allows data to be retrieved immediately by placing the device on the kiosk and transmitting data at gigabit speeds at a distance of less than 10 cm.

BcN(Broadband Convergence Network)

Broadband integrated network
It is a next-generation network environment where quality-guaranteed broadband multimedia services that combine communications, broadcasting, and the Internet, such as voice, data, wired and wireless, can be used in real time without space restrictions.
Next-generation integrated network that can be used safely and seamlessly

Marine Navi

KT's integrated ship safety solution using LTE, intelligent CCTV, and artificial intelligence.
Identify the movement speed and location of nearby vessels based on the GPS-based automatic vessel identification device installed on a small vessel.

C-V2X(Cellular Vehicle To Everything)

Vehicle/object cellular communication
A vehicle communication technology that allows vehicles to exchange information with other vehicles, traffic infrastructure, pedestrians, networks, etc. through cellular mobile communication networks such as LTE and 5G.

Mesh Network

A net-shaped network in which calls destined for other stations are connected directly rather than relayed.
In many stations, the lines may be fragmented, making it uneconomical.
It can deliver large quantities quickly and safely, so it is widely used at event venues and the military.

SDN(Software Defined Networking)

Technology that allows network managers to control and manage the network more efficiently by separating the network into a control unit and a data transmission unit
Developed to control and manage stability, speed, and security through software in network systems that rely on hardware, such as existing routers and switches.
By upgrading the firmware of network equipment, it is possible to directly manage the user's data transmission path, and problems that occur on the Internet can be handled by modifying the transmission path of a specific service without affecting the existing network.

NFS(Network File System)

A mechanism for storing files on a network; a distributed file system that allows users to access files and directories on remote computers and treat those files and directories as if they were local.
Windows file system FAS, NTFS
NTFS is an improved file system over FAS, with improved support for metadata and the use of advanced data structures for performance, reliability and disk space utilization, as well as additional extensions such as secure access control lists and file system journaling.
NTFS slows down on low-capacity volumes.

High Availability Solution (HACMP)

Multiple systems can be connected simultaneously by clustering them around a shared disk between each system.
It can be used to increase the stability of organizations and corporate core business servers.
It is implemented in a variety of ways, and the widely used method is to connect two servers so that the two systems can each perform tasks.

Parsing

Running a program that assembles data and extracts desired data
Syntactic analysis refers to decomposing sentences into constituent elements and analyzing hierarchical relationships between them to determine sentence structure.

MapReduce

By distributing tasks across multiple nodes, each node's process data is stored on that node, if possible.

Hadoop

A platform that can analyze large amounts of data more quickly and at a lower cost, a big data processing and analysis platform
Tajo: Hadoop-based data warehouse system

SSO(Single Sign-On)

A system that provides access to other systems if authentication is successful in one system, no matter how many systems there are.

OWASP(Open Source Developer Security)

It is an open source web application security project that mainly studies information leaks, malicious files and scripts, and security vulnerabilities through the web.

ITU

The International Telecommunication Union is an international intergovernmental organization whose purpose is to promote international cooperation for the improvement and efficient use of telecommunications, promote the dissemination and use of telecommunication infrastructure, technology and services, and ensure harmonious use of telecommunication means among member countries.

MQTT(Message Queueing Telemetry Transport)

? A publish-subscribe based messaging protocol that operates on a TCP/IP based network and is frequently used in recent IoT environments.

VLAN

A technology that allows you to distinguish Broadcast Domains by logically configuring a LAN regardless of physical placement.
Effective in improving the performance and security of connected equipment

PaaS-TA

An open cloud computing platform developed with the goal of strengthening domestic IT service competitiveness and consisting of an infrastructure control and management environment, execution environment, development environment, service environment, and operating environment.

Software cost estimation method

top-down estimation

Expert appraisal, Delphi technique

bottom-up estimation

Raw Code Count (LOC) Technique

? What to look for: Optimism, expectations, pessimism

mathematical calculation

COCOMO, Putnam, function point model

COCOMO (Constructive Cost Model) model

? This is a cost estimation technique proposed by Boehm based on the number of lines of source code (LOC).
? Depending on the development type, it is classified into organizational, semi-separated, and embedded types.
? Organic
Divided into basic, intermediate, and advanced types

Putnam model

A model that predicts the distribution of effort to be used throughout the software life cycle.
Estimation of large project effort distribution
As the development period increases, personnel effort decreases.

Function Point (FP) Model

Weights are assigned to each factor that increases the functionality of the software, and the total function score is calculated by adding up the weights of each factor.

Line configuration method

Point-to-Point Mode

A channel that goes directly from one point to another in a network without physically passing through any intermediary devices.

multipoint method

This refers to a method of connecting multiple stations to one shared transmission line.
How to connect stations that want to communicate with each other is a matter of line configuration and is also called topology.
Topology - the physical arrangement of stations connected to a link.

storage

storage system

SAN(Storage Area Network)

High-speed network for special purposes

NAS (Network Attached Storage) Network attached storage

Storage developed to share files of large amounts of data

Direct Attached Storage (DAS)

Refers to an external storage device connected to the server with a dedicated cable.
A method of directly connecting a data storage device such as a hard disk to a host bus adapter.
Configured as a direct connection between the storage device and the host device without a network device

storage technology

Software Defined Storage

By applying virtualization, it is possible to share as much space as needed and is similar to server virtualization.
It is a data storage system defined by computing software, and a computer-using environment that manages and operates multiple storages within a certain organization as one.
Can be understood as a way to efficiently share storage resources

Types of User Authentication

Knowledge: What you know, passwords, pins, etc.
Possession: What you own, tokens, smart cards, etc.
Existence: Something that represents you, iris, fingerprint, etc.
Knowledge: What you do, your signature, your movements, etc.

Project schedule management

PERT chart

flow chart
A tool used to schedule project work and organize and plan tasks.
? Presents interrelationship between tasks, decision path, boundary time, resource allocation, etc.

Gantt chart

bar chart
The length of the horizontal bar represents the duration of each task.
It helps you see at a glance when each small task that makes up a project should start and end.
It is useful in resource deployment planning.
It is possible to create from a CPM network

Linux

Linux 파일 생성 권한

? unmask value = basic file creation rights - created file creation rights
If the created file creation permission is 644, the default creation permission is 666, so the difference value is 022.
The created directory permission is 777

Linux login history file

btmp (failure record), utmp (current user status record), wtmp (login logout record), lastlog (most recent login record)

? wtmp Records user's successful login/logout information on Linux system
Record shutdown/startup times of the system