FINAL EXAM Flashcards
(64 cards)
What is a common pattern observed in Business Logic Vulnerabilities (BLVs)?
Exploiting functionality not originally designed to be secure
Name three architectural mitigations for Business Logic Vulnerabilities (BLVs).
• Use worst-case scenario planning during design phases
• Collaborate with stakeholders to anticipate abusive user behavior
• Avoid assumptions about user intent or benign interaction
How can statistical modeling and monitoring help detect Business Logic Vulnerabilities (BLVs)?
• Collect and analyze user interaction data
• Model user inputs and expected outcomes to detect anomalies
• Use behavior analytics to flag deviations from standard use cases
Describe Prototype Pollution as a client-side attack.
__PROTO__ can be altered, to override built-in functions, often used to escalate privileges.
What is Clickjacking and how is it typically achieved?
Clickjacking involves tricking users into clicking hidden or disguised UI elements. This is often done via iframes and CSS opacity manipulation, such as using a malicious overlay that submits a hidden form
What is the primary security risk associated with accepting user input into a website?
cross-site scripting (XSS) and SQL injection
What are some general guidelines and practices for handling user input securely?
• Do not rely solely on client-side validation
• Ensure server-side validation
• Use whitelisting and blacklisting
• Assume all input is malicious
• Sanitize your input
What is an RFC (Request for Comments)?
Document that describes acceptable syntax for various inputs like email addresses, URLs, and XML
Name the key technologies and systems commonly used to build a functional website.
HTML, CGI scripts, JavaScript, and a SQL database back-end
What is a major security concern with HTML, and how can it be exploited by malicious users?
HTML was not created with security in mind. Malicious users can insert their own <form> tags to create fake forms to steal data or run malicious scripts
How can you help prevent attacks leveraging HTML vulnerabilities?
• Monitor discussion groups to identify untrustworthy data input
• Ensure input is validated
• Check HTML code periodically for malicious code
• Verify the size of the file, as a change in size can indicate a problem
What is the purpose of Common Gateway Interface (CGI), and how can it be secured?
CGI defines how a web server interacts with databases/documents/programs. To secure it:
• Program CGI with security in mind
• Research known vulnerabilities
• Review programs and patch as needed
• Validate and sanitize user input
While JavaScript can execute arbitrary code when a page loads, what are some built-in security features it provides regarding the client computer’s file system?
JavaScript cannot write/delete files or directories on a client computer. There is no file object or file access function for JavaScript
What types of attacks are common against a SQL database back-end, and what is a common mitigation approach?
Common attacks: SQL injection, brute-force attacks. Mitigations: access control, encryption, role-based authentication, integrity verification
What is the difference between the Software Development Life Cycle (SDLC) and the Secure Software Development Life Cycle (SSDLC)?
SDLC focuses on functionality and performance; SSDLC includes security at every phase of development
Name some key security considerations to incorporate during the ‘Systems analysis’ and ‘Designing’ stages of the SDLC.
Systems analysis: identify potential threats (e.g., injection, overflow)
Designing: establish a secure foundation with threat assessment and mitigation
What are key security practices developers should incorporate during the ‘Implementation’ stage of the SDLC?
Input validation, strong encryption, secure data handling, authentication, error handling
What types of security testing are performed during the ‘Testing’ stage of the SDLC?
Testing for privilege, injection, error handling, directory traversal, and penetration testing
Why is HTTPS preferred over HTTP for sensitive web communications?
HTTPS uses SSL/TLS to encrypt and authenticate communications, protecting against interception
In the context of SSL/TLS, what is the purpose of hashing algorithms? Name two significant hashing algorithms mentioned.
Hashing ensures data integrity. Examples: SHA1, MD5 (MD5 has known vulnerabilities)
What is access control in web applications, and what criteria can it be based on?
Access control regulates user access based on factors like IP, time of day, or browser; uses authentication and authorization
Name some causes of information disclosure in web applications.
Hardcoded API keys, visible internal content, insecure configs, design flaws causing error messages
How can the impact of information disclosure be assessed, and what is more important to focus on?
Focus on how leaked data can be used; assess risk by potential impact, not just presence
Name four methods to prevent information disclosure.
- Review third-party tools
- Awareness training
- Generic error messages
- Secure configurations
- QA code audits
