2.4 Software Vulnerabilities Flashcards
Given software vulnerability scenarios, select appropriate security controls
(Application Security Design Considerations)
Secure by Design
an application has considered the threat environment it will be operating within and that it appropriately uses available technology to achieve security
(Application Security Design Considerations)
Secure by default
the principle that when an application is deployed in a default configuration, security is maintained
(Application Security Design Considerations)
Default by deployment
an application is deployed into an environment that will support the security goals of the application
(Specific Application Issues)
Unsecure direct objective references
a direct object occurs when an application refers to the actual name of objects such as files, folders, databases, or storage elements
(Specific Application Issues)
XSS
Cross site scripting
-involves attackers discovering and exploiting vulnerabilities on websites in order to inject malicious code-typically JavaScript
(Specific Application Issues)
CSRF
Cross-Site request forgery
-malicious code found in emails, websites, or instant messages and cause a user’s WEB BROWSER to execute undesired actions on a site to which the user is already authenticated
(Specific Application Issues)
Click-Jacking
an attack where a use is tricked into clicking something on a web page causing a different operation to be performed
(Specific Application Issues)
Session Management
Session management is done through the use of cookies and session IDs
(Specific Application Issues)
Input Validation
Screening all input to ensure it is in proper form and length before processing
(Specific Application Issues)
SQL injection
designed to attack the database associated with a web application
(Specific Application Issues)
Improper error and exception handling
occurs when an error message provides too much information to the attacker, thus revealing vulnerabilities
(Specific Application Issues)
Fuzzing/fault injection
a software testing methodology used to detect input validation errors
(Specific Application Issues)
Secure cookie storage and transmission
cookies provide client-managed storage in the form of text files that enable a web browse to locally store information from a web application
(Specific Application Issues)
Buffer overflow
when the size of the data being read is larger than the destination buffer causing an overflow condition resulting in application failure
(Specific Application Issues)
Memory leaks
result in failure of an application to correctly manage memory, which can lead to a memory shortage
(Specific Application Issues)
Integer overflows
error that occurs when a number is too large to be stored in the variable
(Specific Application Issues)
Race Condition
software flaws that arise from different processes or threads having a dependence on an object or resource that affects another thread or process
(Specific Application Issues)
Resource Exhaustion
a form of DoS where a required resource to perform some specific action is not available at the time of need
(Specific Application Issues)
Geotagging
attaching geographical identification properties to media such as pictures,websites, videos etc
(Specific Application Issues)
Use of third party libraries
helps reduce development time and improves code quality and security
(Specific Application Issues)
Data remnants
any unwanted pieces of information that remain after a deletion operation
(Specific Application Issues)
Code reuse
the authorized use of someone else’s proven code, to improve your software development efforts
Application Sandboxing
a mechanism to constrain an application into a confined area during execution
Secure encrypted enclaves
secure enclaves use a separate coprocessor from the system’s main processor to prevent the main processor from having direct access to information stored in the secure encrypted enclave
