EXAM 1 Flashcards
(22 cards)
Why is accepting user input into a website poses a significant security risk. Provide at least two examples of potential attacks related to unvalidated input.
Input could contain harmful code, two examples being Cross-site scripting(XSS) and SQL injection
Describe the concept of a layered security strategy for websites and web applications
Layered security involves implementing multiple security mechanisms in case one fails.
Define a denial of service (DoS) attack
Spamming requests to a specific website / service to deny users of the service.
Provide one common of DoS example of this type of attack. Briefly explain its objective.
Ping flood, where target is flooded withe request
Outline the six phases of the traditional Software Development Life Cycle (SDLC)
Systems analysis,
Designing,
Implementation,
Testing,
Acceptance
Deployment
Maintenance.
What is the purpose of a Common Gateway Interface (CGI) script? In the context of security, what is one crucial practice to follow when developing CGI programs?
CGI is used with user input and is used for retrieving information with the request from other services / programs
Input sanitization
In which phase is the actual code written? for the SDLC?
Implementation Phase
What does sandboxing do in web browsers?
Prevents writing / deletion of files on the computer
What is WhiteBox Testing?
Attacker has ALL access to the system / information
What is BlackBox testing?
Attacker has no knowledge of the system
What is GreyBox Testing?
Attacker knows a little bit about of the system
Explain the difference between the Software Development Life Cycle (SDLC) and the Secure Software Development Life Cycle (SSDLC)
SSDLC was made with security in mind, meaning everything is built with security being one of the priorities
From a business standpoint, why is it important to conduct website vulnerability and security assessments?
It’s important to conduct website vulnerability and security assessments to reduce the risks of security breaches.
What are some best practices for securing web applications ?
Input sanitization, Never rely on client side sanitation, Assume All input is malicious.
What are some benefits to using Web Applications?
Not installed on disk,
Can be accessed from anywhere with internet
OS Independent
What are some Web Application Disadvantages?
Performance
Browser support
Support Difficulty, no one knows where to go to get help with a bug.
What is Server-Side Rendering?
Client sends request to a a server for content, and Rendering is performed on the web server and sends it to the client as is
What is Static Site Generation?
Website stored on Content delivery network and is already ready to display
What is a Single Page Application? (SPA)
Loads one page, and if required updates the content of the page through API’s
What is a Progressive Web Application?
Runs like native app but does not reside on the device it is running on
What is an Application Programming Interface?
An API is a messenger that lets two programs talk to each other.
