Defensive Coding Flashcards
1
Q
Defensive Coding Requirements
A
1.) Code must follow the secure architecture
2.) Code must be free of internal weaknesses
2
Q
Complexity
A
Enemy of Security
3
Q
Types of input validation
A
Deny list
Allow list
4
Q
Deny list
A
Drawback: infinite, easy to get around
Benefit: react quickly (often no re-compilation), straightforward
5
Q
Allow list
A
Drawbacks:
Sometimes not possible to block certain characters
Often requires re-compilation and patches
6
Q
Sanitizing Input
A
Convert input to something that won’t be interpreted as code
Drawback: need to know everything to escape
7
Q
Concurrency Risks
A
- Race conditions -> Denial of Service
- Shared memory -> Potential Leakage
- Weird circumstances -> Potential Tampering
