2: 4 Secure Coding Practices

Question 1

Input Validation

Answer 1

Filters user-supplied input

Question 2

Whitelist

Answer 2

Specifies allowable input

Question 3

Blacklist

Answer 3

Specifies disallowed input

Question 4

Where should input validation be done

Answer 4

Server

Question 5

Parameterized Query

Answer 5

Client sends arguments to the server that enters arguments into a template

Question 6

Application Authentication

Answer 6

Verifies user identity and confirms authorization

Question 7

Hashing

Answer 7

Turning a password into a pre-defined length hash

Question 8

Salting

Answer 8

Adds random value to passwords prior to hashing to protect against rainbow table attacks

Question 9

TLS

Answer 9

Transport Layer Security - Uses HTTPS to secure entire session

Question 10

Output Encoding

Answer 10

Replaces dangerous characters with string i.e. < into %3c

Question 11

What should perform output encoding

Answer 11

Trusted libraries

Question 12

Exception Handling

Answer 12

Handles unpredictable states that may jeopardize application security. Provides explicit instructions to handle unpredictable states

Question 13

What form of exception handling does Java use?

Answer 13

Try-Catch

Question 14

Database Normal Forms

Answer 14

Rules for database columns and tables that improves design and provides security advantages

Question 15

Database activity monitoring

Answer 15

Logs and analyzes database requests

Question 16

Why should databases use stored procedures

Answer 16

To protect against SQL injections

Question 17

Deidentification

Answer 17

Removes obvious Identifiers

Question 18

Anonymization

Answer 18

Removes possibility of identification

Question 19

What are the two ways to pass HIPPA Standards

Answer 19

Have statisticians analyze and verify, or eliminate the 18 types of identifiers (safe harbor approach)

Question 20

Data Obfuscation

Answer 20

Transforms sensitive data to a form that cannot be retrieved

Question 21

Masking

Answer 21

Redacts sensitive information from a file

Question 22

Tokenization

Answer 22

Replaces sensitive fields with a random identifiers (using a secure lookup table)