Page 1390 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

programmer distributes the source code, which contains instructions
in the higher-level language. End users then use an interpreter to

execute that source code on their systems. They’re able to view the
original instructions written by the programmer.

Each approach has security advantages and disadvantages. Compiled
code is generally less prone to manipulation by a third party. However,
it’s also easier for a malicious (or unskilled) programmer to embed
back doors and other security flaws in the code and escape detection

because the original instructions can’t be viewed by the end user.
Interpreted code, however, is less prone to the undetected insertion of
malicious code by the original programmer because the end user may
view the code and check it for accuracy. On the other hand, everyone
who touches the software has the ability to modify the programmer’s
original instructions and possibly embed malicious code in the
interpreted software. You’ll learn more about the exploits attackers use
to undermine software in the section “Application Attacks” in Chapter

21, “Malicious Code and Application Attacks.”

Object-Oriented Programming

Many modern programming languages, such as C++, Java, and the
.NET languages, support the concept of object-oriented programming
(OOP). Older programming styles, such as functional programming,
focused on the flow of the program itself and attempted to model the
desired behavior as a series of steps. Object-oriented programming

focuses on the objects involved in an interaction. You can think of it as
a group of objects that can be requested to perform certain operations
or exhibit certain behaviors. Objects work together to provide a
system’s functionality or capabilities. OOP has the potential to be
more reliable and able to reduce the propagation of program change
errors. As a type of programming method, it is better suited to

modeling or mimicking the real world. For example, a banking
program might have three object classes that correspond to accounts,
account holders, and employees, respectively. When a new account is
added to the system, a new instance, or copy, of the appropriate object
is created to contain the details of that account.

Each object in the OOP model has methods that correspond to specific