Application Security

Question 1

What is OWASP?

Answer 1

The Open Web Application Security Project
• Non-profit organisation
– Local chapters in most countries, also in Norway
• OWASP promotes security awareness and security
solutions for Web application development.
• OWASP Top-10 security risks identify the most critical
security risks of providing online services
– The Top 10 list also recommends relevant security solutions.
• OWASP ASVS (Application Security Verification Standard)
specifies requirements for application-level security.
• Provides and maintains many free tools for scanning and
security vulnerability fixing

Question 2

What are the top 10 vulnerabilitites list?

Answer 2

njection

2. Broken Authentication and Session Management
3. Cross-Site Scripting (XSS)
4. Insecure Direct Object References
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Missing Function Level Access Control
8. Cross-Site Request Forgery (CSRF)
9. Using Components with Known Vulnerabilities
10. Unvalidated Redirects and Forwards

Question 3

What are the main vulnerabilitites?

Answer 3

– SQL Injection
– XSS - Cross-Site Scripting
– Broken authentication and session management

Question 4

Explain SQL Injection.

Answer 4

• Database system misinterpretation of input data
– Attacker disguises SQL commands as data-input
– Disguised SQL commands = ‘injected’ SQL commands
• With SQL injection, an attacker can get complete
control of database
– no matter how well the system is patched,
– no matter how well the firewall is configured,
• Vulnerability exists when web application fails to
sanitize data input before sending to it database
• Flaw is in web application, not in SQL database

Question 5

Explain XSS- Cross- Site Scripting.

Answer 5

Data provided by users to a web application is stored
persistently on server (in database, file system, …)
and later displayed to users in a web page.
• Typical example: online message boards.
• Attacker uploads data containing malicious script to
server.
• Every time the vulnerable web page is visited, the
malicious script gets executed in client browser.
• Attacker needs to inject script just once

Question 6

What is the broken authentication and session management?

Answer 6

User authentication does not necessarily provide continuous
authentication assurance
– User authentication is only at one point in time
• Insecure implementation of session control with a static
session Id which is passed in the URL
– Unfortunately this can be misused
• Recommendations for session Id must be followed
– E.g friom OWASP
• Examples of controls for session Id:
– Link session Id to e.g. IP address, TLS session Id

Question 7

Explain Cloud Computing.

Answer 7

Er når man bruker et nettverk av eksterne servere som er vert på Internett for å lagre, og prosessere data istedenfor å ha en lokal server eler datamaskin.

The use of shared computing for the purpose of providing efficiencies, performance, reliability, scalability and security.

Question 8

What are the DevSecOps?

Answer 8

Innebygget sikkerhet. Konfigurasjonstyring.

Question 9

What are the benefits(techinical, business) with DecSecOps?

Answer 9

TECHNICAL BENEFITS:
1. CONTINUOUS SOFTWARE DELIVERY
2. LESS COMPLEX PROBLEMS TO FIX
3. FASTER RESOLUTION OF ISSUES WHEN THEY
ARISE
4.SECURE ENVIRONMENT

BUSINESS BENEFITS:
1. FASTER DELIVERY OF FEATURES
2. MORE STABLE OPERATING ENVIRONMENTS
3. MORE TIME AVAILABLE TO ADD VALUE (RATHER THAN
WASTE IT WITH FIXES/MAINTENANCE)
4. NO BREACHES / BETTER IMAGE

Question 10

STRIDE threat modeling

Answer 10

• Spoofing: Can an attacker gain access using a false identity?
• Tampering: Can an attacker modify data as it flows through the application?
• Repudiation: If an attacker denies doing something, can we prove he did it?
• Information disclosure: Can an attacker gain access to private or potentially injurious data?
• Denial of Service: Can an attacker crash or reduce the availability of the system?
• Elevation of privilege:
  Can an attacker assume the identity of a privileged user?