Hardware, Threats & Collaboration

Question 1

File System & Hardware Vulnerabilities

Answer 1

File System Example: World-writable files → privilege escalation
Prevention: Set proper file permissions
Hardware Example: Unpatched firmware → attacker gets root
Prevention: Regularly update firmware and drivers

Question 2

Side-Channel Attacks

Answer 2

Attack based on physical signals (timing, power use)
Types:
Timing attack
Power analysis
Mitigation: Constant-time algorithms, limit data leakage

Question 3

Collaboration in Secure Dev

Answer 3

Benefits:
Shared knowledge
Faster detection of flaws
Better decision-making
Example: Dev + Security team find a flaw during sprint planning

Question 4

Code Reviews for Secure Coding

Answer 4

Focus Areas:
Authentication & access control
Input validation
Sensitive data handling
Error handling
Example: PR review catches password stored in plain text

Question 5

SAST vs DAST

Answer 5

SAST: Static scan of code → finds issues early (e.g., GitHub scan)
DAST: Scans running app → finds runtime flaws (e.g., OWASP Zap)
Why Use Both: Covers more attack surfaces