Design Vulnerabilities

Question 1

How do Design Vulnerabilities arise?

Answer 1

They often arise from the general design of the software code.

Question 2

What are the three main types of Design Vulnerabilities?

Answer 2

Insecure Components
Insufficient Logging and Monitoring
Weak or Default Configurations

Question 3

What are Insecure Components?

Name 3 examples

Answer 3

Any code that is used or invoked outside of the main program process.

Code Re-use
Third-Party Library
Software Development Toolkit (SDK)

Question 4

What is Insufficient Logging and Monitoring?

Answer 4

Any program that does not properly record or log detailed enough information for an analyst to perform their job.

Question 5

What is a Weak or Default Configuration?

Answer 5

Any program that uses ineffective credentials or configurations, or one which the default configs haven’t been changed for security.

Question 6

Many apps run as root or as a local admin. What security principal are they generally forgetting or ignoring?

Answer 6

Least privilege

Question 7

What is a best practice to prevent Design Vulnerabilities?

Answer 7

Use scripted installations and baseline config templates to secure the apps during installation.