Identifying vulnerabilities and protections

Question 1

Footprinting

Answer 1

Interrogating resources on the Internet for
information about systems, looking to discover
what a potential attacker can also discover
without an organisation’s knowledge

Question 2

Penetration testing

Answer 2

Attempting to penetrate a system’s security layers
in order to demonstrate security risks.

Question 3

• Buffer overflows

Answer 3

a program tries to store more data
in a buffer (temporary data storage area) than it was intended to hold

Question 4

• Too many permissions

Answer 4

installation of an app asks you to give permission for the software to access certain settings and features of your device

Question 5

• Scripting restrictions

Answer 5

Same Origin Policy (SOP) is a security measure that prevents a
website’s scripts from accessing and interacting with scripts used on other sites. Running
scripts from other sites would be dangerous because a malicious script from a compromised
site could interact with a script from a legitimate site without restriction, potentially leading
to malware infections or sensitive data being compromised.

Question 6

• Accepting parameter without validation

Answer 6

dynamically generated HTML web pages can
introduce security risks if inputs are not validated on the way in. Malicious script can be
embedded within input that is submitted to web pages and this could then appear to
browsers as originating from a trusted source

Question 7

cookie

Answer 7

a small piece of code that is given to a Web browser by a Web server.
The main purpose of a cookie is to identify users and prepare customized Web pages or to save site login information.
Cookies can be seen as a security issue as they hold personal information and this can be used or sold and tracking cookies can hold information on the
websites visited by users