Network and Computer Security Flashcards

Question

How does MAC work?

Answer 1

Specifies system-wide access restriction to objects - Mandatory because subjects may not transfer their access rights - Shift power from users to system owner

Answer 2

Top secret - Comprehensive backgrounc check, highly-trusted individual Secret - Routine background check, trust individual Confidential/Sensitive - No background check. Limited distribution, minimally trusted individuals Unclassified - Unlimited distribution and untrusted individuals

Answer 3

A way to divide resources, data and systems into separate groups to control access and limit exposure to risks. Each compartment has its own sets of rules, permissions and protections.

Answer 4

A set that is: Reflexive, Transitive, Anti-symmetric

Answer 5

A reflexive set is a set in which every element is related to itself under a given relation.

Answer 6

A transitive set is a set where everything inside the set also has all of its "parts" included in the set. (If a→b and b→c then a→c)

Answer 7

An antisymmetric relation means that if two things are related in both directions, they must actually be the same thing.

Answer 8

A mathematical structure used to model relationships between security levels, access controls, or permissions.

Answer 9

Recall all pairs of lattice elements have a least upper bound and a greatest lower bound If labels form a lattice, we can uniquely answer questions like: Given 2 objects with different labels, what is the minimal label a subject requires to be allowed to read both objects? Given 2 subjects with different labels, what is the maximal label an object can have that can still be read by both subjects? Well-suited for need-to-know policies, where each subject is assigned a label reflecting least privilege required for this function.

Answer 10

A security model used to protect classified information and control access to it. Considers cross-level communication where subjects may interact below their level of clearance Main insight: prohibiting write-down is essential for confidentiality as otherwise information can effectively be reclassified.

Answer 11

No information leakage possible (if implementation is secure) Prevents "legitimate" communication from high-level subjects to low-level ones.

Answer 12

Owners can change permissions

Answer 13

Allows to override the access control in "emergencies"

Answer 14

Controlling the use of documents For example: - You aren't allowed to share files but you can use them yourself - You can watch a film 3 times in the next 2 weeks

Answer 15

Watermarking Monitoring

Answer 16

Technical - how to implement usage control iin an open environment Ethical - The right to read

Answer 17

No Read Up - A user cannot read information that is classified higher than their clearance No Write Down - A user cannot write information to a lower security level

Answer 18

Cryptography - Secret Writing Steganography - Concealed Writing Cryptanalysis - Secret Analysis

Answer 19

Symmetric Encryption - Same key is used to encrypt/decrypt Asymmetric Encryption - Different keys used to encrypt/decrypt (a public and private key)

Answer 20

One-to-one relationship between items in sets

Answer 21

A guide that explains how data or information is encoded or translated. It lists codes and their corresponding meanings or values, helping to decode or interpret the data

Answer 22

Each letter in the plaintext is replaced with a different one, but the substitution pattern stays the same throughout the message.

Answer 23

Key-length: 26 letters Key Space: total number of possible keys - 26!

Answer 24

- Brute-forcing a key is difficult - Trivial to crack using frequency analysis

Answer 25

A polyalphabetic cipher is a type of cipher where each letter in the plaintext can be encrypted using different alphabets at different points in the message. This means that the same letter may be replaced by different letters at different times.

Answer 26

Uses random key that is the same length as the message, each bit is encrypted with corresponding pad using XOR

Answer 27

Where the positions of the letters in the plaintext are rearranged according to a specific system, but the actual letters themselves remain unchanged.

Answer 28

Combines two or more encryption methods, such as substitution and transposition, to make the encryption stronger and harder to break.

Answer 29

Splits data into two halves and repeatedly applies a series of operations, where one half is transformed using a function and then combined with the other half. The halves are swapped after each round. This process is repeated several times, creating strong encryption. The key idea is that decryption works by reversing the steps with the same key.

Answer 30

- First cryptographic standard - 16 round Feistel cipher and key-scheduler - A block cipher, encrypting 64-bit blocks - Was extended to triple-DES to overcome key length problem - Now replaced by AES

Answer 31

Main attack: exhaustive search - took 7 hours with $1M pc (1993) - took 7 days with $10,000 FGPA-based machine (2006) No mathematical attacks (but reduced key space from 2^56 to 2^43) No known attacks on triple DES

Answer 32

Easy to compute in done direction but difficult (or pratically impossible) to reverse

Answer 33

Easy to compute in one directrion but exteremely difficult to reverse unless you have special information

Answer 34

An expanded public-key encryption concept into encryption system

Answer 35

RSA depends on the difficulty of factoring large prime numbers - Breaking down a prime into its factors - (because factoring numbers over 2048 bits is computationally infeasible

Answer 36

Two numbers are congruent modulo n if they have the same remainder when divided by n (for example 10 and 7 are congruent modulo 3, as 10 mod 3 = 7 mod 3 = 1)

Answer 37

GCD of 2 numbers is the greatest common divider

Answer 38

Two numbers are relavitely prime if their gcd is 1 (don't share any factors except 1)

Answer 39

The multiplicative inverse of a number is a value that, when multiplied by original number, results in 1.

Answer 40

1. Find two (pretty large) prime numbers p & q 2. Compute n & Φ(n) 3. Choose public key (e) 4. Compute (d)

Answer 41

A way of evaluating the performance or efficiency of an algorithm, particularly in the context of computational complexity. It can be understood as the ratio of the actual performance of an algorithm to its theoretical performance.

Answer 42

N ( N - 1) / 2

Answer 43

Public - encryption Private - decryption

Answer 44

Proving Identity

Answer 45

Modification Detection Code provides a checkable fingerprint (also known as hash, message digest, MAC, MDC, fingerprint)

Answer 46

Used to check if data has been altered does not encrypt the data Hashing is a pure one-way function Generates a unique hash for a piece of data - changing the data, changes the hash

Answer 47

- Compression: h maps an input x of an arbitrary bit length to an output h(x) of fixed bit length n - Polynomial time computable

Answer 48

If it is additionally: - One way (Pre-image Resistance) - And usually either: - 2nd Pre-image Resistance - Collision Restistance

Answer 49

Given a hash output y=h(x), it is computationally hard to find the original input x

Answer 50

Given an input x, it is computationally infeasible to find another x' (x!=x') such that both inputs produce the same hash output –> h(x) = h(x') (its very hard to find another input that produces the same output hash)

Answer 51

It is difficult to find any two distinct inputs x and x', such that h(x) = h(x')

Answer 52

Block Chaining techniques can be used: - Divide message M into fixed size blocks b1,...bn - Use symmetric encryption algorithm (such as DES)

Answer 53

Instead of storing passwords in plaintext, we store only its cryptographic hash: - For password p, store h(p) in password file - Requires only pre-image resistance

Answer 54

To provide data integrity

Answer 55

Symmetric encryption is reversible, while hash functions are not

Answer 56

AES (Advanced Encrpytion Standard)

Answer 57

3. Securing communication between two parties

Answer 58

To know if the private/public key pair belongs to the right person

Answer 59

To join PKI, Alice - Generates her own public/private key pair - Takes her public key Ka to private certification authority (CA) that everybody trusts and states she is Alice and this is her public key The CA verifies that Alice is who she says she is, and then signs a digital certificate - That says "Ka is Alice's public key"

Answer 60

An infrastructure that allows principles to recgonise which public key belongs to whom

Answer 61

Linking public keys to entities (certificates) Key life-cycle management (key revocation, recovery, updates)

Answer 62

1. Certification Authority (CA) - Creates Certificates and publishes them in the directory 2. Directory - Makes user certificates and CRLs available - Must identify users uniquely (needs fresh/accurate user data) - Backs up certain keys 3. Registration Authority (RA) - Manages process of registering users and issuing certificates - Ensures proper user identification

Answer 63

- Creates certificates and publishes them in directory - Maintains Certificate Revocation List (CRL) in directory. CRL checked actively by single clients or by validation services - Backs up certain keys

Answer 64

A token that binds an identity to a key

Answer 65

A standard that defines a framework for authentication services

Answer 66

Goal: Ensure Alice can securely communicate with Bob and verify it's genuinely him. Key Concept: - Nonce (Number Used Once): - A fresh, unique value known only to the entity that generated it. - Helps to verify message authenticity and freshness.

Answer 67

1. Eve intercepts communication between Alice and Bob 2. Eve uses her own keys to impersonate Alice to Bob and vice versa Result: Bob thinks he’s securely communicating with Alice, but Eve is the intermediary

Answer 68

A protocol is a set of rules governing communication between two or more participants

Answer 69

Security protocols utilize cryptographic methods to achieve: 1. Authentication: Verifying identities. 2. Key Establishment: Securely sharing cryptographic keys. 3. Integrity: Ensuring messages are not tampered with. 4. Non-repudiation: Preventing denial of actions.

Answer 70

- Follows the protocol rules strictly. - Always generates fresh, unique nonces. - Does not respond to invalid or malformed messages.

Answer 71

Key Problem: - Kab contains no information about A or B, only a random bit-string representing the session key. Risk: - If intercepted, an attacker can misuse the session key without knowing its intended context.

Answer 72

1. Embed context in the session key (e.g., identities or usage scope) 2. Use encryption to ensure the key exchange is secure 3. Introduce mutual authentication steps Example: - A protocol can include signed or encrypted messages between parties to verify their identities

Answer 73

Role of Nonces: - Nonces ensure the "freshness" of a session or message. - Prevents replay attacks by verifying that a received message is recent and unique. Best Practice: - Always generate a new, unpredictable nonce for every session or transaction.

Answer 74

Roles: - A, B: Represent principals like Alice and Bob - a, b, i: Represent agents Key: - Symmetric Keys: K, Kab, ... - Asymmetric Keys: - Public Keys: pk(A) - Private keys: inv(pk(A)) Encryption: - Symmetric: {M}k (Message M encrypted with key K) - Asymmetric: {M}pk(A) (Message M encrypted with pk(A)) Other Notations: - Nonces(NA, NB): Fresh values for challenge-response - Timestamps (T): USed for key expiration - Message concatenation: M1, M2, M3

Answer 75

Communication between principals A and B is represented as: A→B:{A,T1,Kab} pk(B)

Answer 76

Combine prose, specifications, diagrams, and message sequences. Example sequence: - A → B: {NA, A}_{pk(B)} - B → A: {NA, NB}_{pk(A)} - A → B: {NB}_{pk(B)} Purpose: Define evefnt sequences (traces) and describe the conditions for secure communication

Answer 77

Steps: 1. Generate a fresh nonce (NA), attach identity, and encrypt with pk(B) 2. Wait for response: - Decrypt with inv(pk(A)) - Verify contents match expected format 3. Encrypt NB with pk(B) and send back to B Checks: - Verify nonce values. - Reject messages that fail decryption or validation.

Answer 78

1. Person-in-the-Middle Attack: - An attacker intercepts and modifies messages between A and B 2. Oracle Attack: - Exploits normal responses to derive encryption/decryption results 3. Replay Attack: - Reuses parts of old messages to fool the system 4. Type Flaw Attack: - Substitutes fields with unexpected message types 5. Masquerading Attack: - Pretends to be another principal 6. Reflection Attack: - Sends received data back to the originator 7. Binding Attack: - Uses messages out of context for unintended purposes

Answer 79

1. Use timestamps and nonces to prevent replay attacks 2. Employ key-specific contexts to mitigate binding attacks 3. Ensure strict type checks to prevent type flaw attacks 4. Validate all received data thoroughly

Answer 80

Formal methods use mathematical notation to model and verify systems, ensuring they work as intended

Answer 81

1. Why? Lack of resources or awareness 2. What? Issues that arise during the developing and maintenance of secure systems 3. How? Poor development of systems

Answer 82

1. Create models for the system 2. Define specifications (properties to check) 3. Use a tool to verify properties (e.g., automated theorem provers)

Answer 83

Used to check security protocols by checking the flow of information between parties

Answer 84

Roles: - Initiator: Begins the interaction - Responder: Responds to the initiator Verification Goal: - Ensure every message and response align with protocol rules

Answer 85

By adding random bits or values in messages, it becomes difficult for an attacker to reuse or replay intercepted messages without detection 1. Man-in-the-Middle Attack: - Intercepts and modifies communication between two parties. 2. Replay Attack: - Reuses valid messages to trick the system. 3. Reflection Attack: - Sends the same message back to its sender.

Answer 86

1. Subjects: The entity requesting access 2. Objects: The resource being accessed 3. Rules: Define which subjects can access which objects

Answer 87

Enforce confidentiality through access control Key Concepts: - No Read-Up: Subjects cannot read data above their clearance - No Write-Down: Subjects cannot write data below their clearance level

Answer 88

Enforce data integrity through access control Key Rules: - No Read-Down: Subjects cannot read lower integrity data - No Write-Up: Subjects cannot write to higher integrity levels - (Its the inverse of Bell-LaPadula Model)

Answer 89

Tools: - SPIN: Checks model specifications for concurrent systems - Alloy: Lightweight modeling language for analyzing structures Benefits: - Reduces human error in verification - Speeds up analysis and testing

Answer 90

Example: - Malicious entity replaces a legitimate key with their own Prevention: - Use certificates and trusted key exchanges

Answer 91

Automate proof generation to check the correctness of system properties

Answer 92

A protocol is defined by role scripts for each role name Components: - Role names are agent variables. - Signal events are used to define properties.

Answer 93

Variables in a chord that first occur in a non-receive event are free variables Example: - In A→B:{NA,NB}pk(A), 𝑁𝐴, 𝑁𝐵. NA, NB are free variables.

Answer 94

1. Instantiate free variables (agents, values) 2. Replace these in the role description to create a "closed role"

Answer 95

State = Trace × IntruderKnowledge × Threads - Trace: History of events - IntruderKnowledge: Messages the attacker knows - Threads: Map thread IDs to roles

Answer 96

1. Send Rule: Adds a message to the trace and updates the intruder's knowledge 2. Receive Rule: Matches incoming messages 3. Signal Rule: Processes specific protocol events (e.g., verification)

Answer 97

Steps: - Eve intercepts 𝐴→𝐵:{𝑁𝐴,𝐴}𝑝𝑘(𝐵)A→B:{NA,A} pk(B) - Uses it to deceive 𝐵 into thinking Eve is 𝐴 Key Takeaway: - Without mutual authentication, protocols can be attacked.

Answer 98

Let S be any non-empty, proper subset of the computable functions. Then the verification problem for S is undecidable.

Answer 99

Deals with determining whether a computer program will eventually stop (halt) or keep running forever, given a specific input

Answer 100

A way to describe how an attacker behaves when trying to break a cryptographic protocol; helps us understand security by assuming a very powerful but simple adversary.

Answer 101

- Full Control of the Network: Attacker can eavesdrop, modify, block, or replay any message sent between two parties. - Can See All Messages: Attacker can see all messages being exchanged over network - Can Create New Messages: Attacker can create new messages using any information they have (e.g., encrypting or signing messages using known methods). - Can Use Public Keys: Attacker can use public keys (but not private keys) to encrypt or verify messages. - Cannot Break Cryptography: Attacker cannot break strong cryptographic systems unless they have the secret key. So, if encryption is strong, the attacker can't decrypt messages without the correct key.

Answer 102

- Intercepts messages between honest parties - Modifies messages or injects new ones into the conversation - Replays old messages to confuse or trick the parties - Can encrypt or sign messages they create using public information or knowledge of cryptographic operations (like encrypting plaintext)

Answer 103

- Cannot break encryption or cryptographic systems unless it already has the keys - Cannot guess secret information like private keys or secret session keys unless it's exposed

Answer 104

1. Large Codebases: Modern applications contain millions of lines of code 2. High Adoption Rates: Technologies evolve rapidly, introducing more vulnerabilities (e.g., Apple iOS adoption) 3. Defects in Coding Phase: 80% of software defects are introduced during coding

Answer 105

Fixing Defects earlier (such as in the coding phase) is much easier and cheaper to fix (640x cheaper) Later on in the development process the cost to fix defects grows exponentially

Answer 106

Shifting the process of fixing defects to towards the start of the development process (left) makes it much cheaper and easier

Answer 107

- Securing systems is expensive; prioritization based on value-risk analysis is essential - Helps allocate resources effectively: - High-Value, High-Risk Assets: Require immediate protection - Low-Value, Low-Risk Assets: Lower priority

Answer 108

To identify and mitigate potential security concerns

Answer 109

1. Built-in Security: - Embeds security measures early in the system 2. Early Detection: - Identifies vulnerabilities before deployment 3. Security Mindset: - Encourages thinking critically about system weaknesses

Answer 110

1. Scope Definition: - Identify: - Representation - Assets - Entry points - Trust boundaries 2. Determine Threats: - Use structured methodologies (e.g., STRIDE framework) 3. Countermeasures and Mitigation: - Strategies include: - Accept risk - Eliminate risk - Mitigate risk - Transfer risk 4. Evaluation: - Assess the effectiveness of implemented measures

Answer 111

Preserve Confidentiality, Integrity, Availability (CIA)

Answer 112

1. Spoofing Identity: Impersonating another user 2. Tampering with Data: Altering data/code unauthorized 3. Repudiation: Denying actions without proof 4. Information Disclosure: Exposing unauthorized data 5. Denial of Service (DoS): Disrupting service availability 6. Elevation of Privilege: Gaining unauthorized higher permissions

Answer 113

1. Spoofing Identity: - Unauthorized access using another user's credentials (e.g., stolen passwords) 2. Tampering with Data: - Modifying database entries or code files without authorization 3. Repudiation: - Example: Denying the transfer of funds while records say otherwise 4. Information Disclosure: - Accidentally exposing sensitive information, such as private customer data 5. Denial of Service (DoS): - Examples: Flooding a server to make it unresponsive 6. Elevation of Privilege: - Exploiting system flaws to gain admin-level access

Answer 114

- High impact + high ease of attack = Critical Risk - Helps prioritize mitigation efforts effectively

Answer 115

A flaw in application logic that allows unintended or malicious behaviour Example: Payment system increases balance when a negative amount is entered Impact: Can lead to financial loss or exploitation

Answer 116

A vulnerability where malicious SQL is executed by injecting it into user input Impact: Bypasses authentication and exposes sensitive data Example: SELECT * FROM users WHERE name = 'admin' OR '1'='1';

Answer 117

Username: admin Password: ' OR '1'='1 Result: Always evaluates as TRUE, bypassing authentication.

Answer 118

1. Use prepared statements. 2. Validate and sanitize inputs. 3. Use ORM (Object-Relational Mapping) tools.

Answer 119

A catalog of software weaknesses to standardize vulnerability descriptions. Purpose: Provides a shared language for security discussions. Examples: Includes SQL injection, XSS, and buffer overflow.

Answer 120

The most critical and common software weaknesses Examples: 1. Improper Input Validation. 2. SQL Injection. 3. Buffer Overflow.

Answer 121

Purpose: - Identify and categorize vulnerabilities. - Link to specific attack patterns. Tool Integration: Used by tools like static analyzers to flag potential weaknesses.

Answer 122

A database of real-world vulnerabilities with unique identifiers Contents: - Vulnerability description. - Affected software and versions. - Fixes and patches.

Answer 123

Common Vulnerability Scoring System for rating severity

Answer 124

- Network (N): Exploitable remotely. - Adjacent (A): Exploitable within the same subnet. - Local (L): Requires local access. - Physical (P): Requires physical access.

Answer 125

- Low (L): Exploit requires no special conditions. - High (H): Exploit depends on specific conditions.

Answer 126

1. None (N): No authentication needed. 2. Low (L): Requires basic access. 3. High (H): Requires admin-level access.

Answer 127

1. None (N): No user action needed. 2. Required (R): User must perform an action.

Answer 128

1. Confidentiality (C): Data exposure levels. 2. Integrity (I): Data modification risk. 3. Availability (A): System uptime impact.

Answer 129

Injecting malicious scripts into a web page to execute in the victim’s browser

Answer 130

1. Reflected XSS: Immediate reflection of input. 2. Stored XSS: Input stored and executed later. 3. DOM-Based XSS: Execution via client-side scripts.

Answer 131

1. Sanitize and validate inputs. 2. Use frameworks that auto-encode outputs (e.g., Jinja2, React).

Answer 132

1. Broken Access Control. 2. Cryptographic Failures. 3. Injection. 4. Insecure Design. 5. Security Misconfiguration. 6. Vulnerable Components. 7. Identification Failures. 8. Software Integrity Failures. 9. Logging Failures. 10. SSRF

Answer 133

Sending random or malformed inputs to a system to find vulnerabilities

Answer 134

1. Random Fuzzing: Purely random inputs. 2. Mutation-Based Fuzzing: Modify valid inputs. 3. Generation-Based Fuzzing: Create inputs from specifications.

Answer 135

Notify vendors and give them time to fix vulnerabilities before publicizing Typical Period: 90 days.

Answer 136

Rewards for finding and reporting vulnerabilities

Answer 137

Analyzes source code for vulnerabilities Pros: Identifies issues early Cons: May miss runtime issues

Answer 138

Tests a running application for vulnerabilities Pros: Identifies runtime flaws Cons: Requires a deployed environment

Answer 139

Ensuring that user inputs follow expected formats Example Rules: Only allow numeric values for a "quantity" field Disallow special characters in usernames

Answer 140

- Allow-Lists: Define what is allowed (e.g., [0-9]+ for numeric input) - Deny-Lists: Define what is disallowed Best Practice: Use allow-lists whenever possible for stricter control

Answer 141

Pre-compiled SQL queries where user input is passed as parameters Benefit: Prevents SQL injection

Answer 142

1. Using outdated algorithms (e.g., MD5, SHA-1) 2. Insecure key storage 3. Weak random number generators Prevention: Use modern libraries like OpenSSL and robust algorithms like AES

Answer 143

A browser policy that restricts resources a page can load Benefit: Reduces risk of XSS and other attacks

Answer 144

Overwriting memory by exceeding buffer size Impacts: - Corrupts data - Executes arbitrary code

Answer 145

1. Use memory-safe languages like Rust 2. Implement bounds-checking in C/C++

Answer 146

Users accessing resources outside their permissions Prevention: - Use role-based access controls (RBAC) - Implement server-side checks Examples: - Viewing another user’s profile without authorization - Modifying sensitive data via ID tampering

Answer 147

- Regularly check configurations - Use security benchmarks (e.g., CIS) Examples of Security Misconfiguration: - Default credentials left unchanged - Unnecessary services enabled - Insecure default settings in frameworks

Answer 148

- Regular dependency checks using tools like Snyk - Update software promptly Examples of Vulnerable Components: - Outdated libraries - Known vulnerabilities in third-party tools

Answer 149

Examples: - Weak passwords. - Broken session management. Prevention: - Enforce strong password policies. - Use secure token-based authentication (e.g., OAuth).

Answer 150

Insecure methods for software updates or data integrity Prevention: - Use signed certificates for updates - Implement cryptographic checks for files

Answer 151

Insufficient or non-existent logging of security events Impact: Delayed response to breaches Best Practices: - Enable logging for sensitive operations - Regularly review logs

Answer 152

A vulnerability where attackers force servers to make requests to unintended destinations Prevention: - Validate and sanitize user-supplied URLs - Use allow-lists for accessible domains Example: Accessing internal services via manipulated URLs

Answer 153

1. Static Application Security Testing (SAST): - Examines source code. 2. Dynamic Application Security Testing (DAST): - Tests running applications. 3. Interactive Application Security Testing (IAST): - Combines SAST and DAST.

Answer 154

Incorrectly flagged vulnerabilities that aren’t real issues Impact: Wastes developer time Mitigation: - Use accurate configuration settings - Manually review critical findings

Answer 155

Real vulnerabilities that are not detected Impact: Leaves systems exposed to attacks. Mitigation: - Combine multiple testing tools (SAST + DAST). - Regularly update tools to detect new patterns.

Answer 156

Random Fuzzing: - Purely random inputs. - Example: aaaa... or #$%@. Mutation-Based Fuzzing: - Modifies existing valid inputs. - Example: Altering a valid JSON.

Answer 157

Create test cases using input specifications. Advantages: High coverage for valid inputs. Examples: Using RFCs to design test inputs for protocols.

Answer 158

1. Identify the vulnerability 2. Contact the vendor 3. Provide sufficient details for reproduction 4. Wait for the vendor’s fix before publicizing

Answer 159

Publish all details of a vulnerability immediately

Answer 160

Pros: - Forces vendors to act quickly. Cons: - Increases risk for users before a fix is available.

Answer 161

Generates test cases based on coverage metrics

Answer 162

1. Rotate keys regularly 2. Use hardware security modules (HSMs) for key storage 3. Avoid embedding keys in source code

Answer 163

1. Validate inputs. 2. Use parameterized queries. 3. Avoid hard-coded secrets. 4. Implement error handling securely. 5. Regularly test and review code.

Answer 164

Incorporating security from the start of the software lifecycle Principles: 1. Identify potential risks early. 2. Design with defense-in-depth. 3. Document security requirements alongside functional ones.

Answer 165

Storing usernames or passwords directly in code Why it’s bad: Easily accessible in version control systems Fix: Use environment variables or secret management tools

Answer 166

1. Remove sensitive data from logs 2. Encrypt data at rest and in transit 3. Implement strict access controls for sensitive files

Answer 167

1. Failed login attempts 2. Privileged operations 3. Changes to configurations 4. Suspicious activity (e.g., rate-limited actions)

Answer 168

1. User passwords 2. Cryptographic keys 3. Session tokens or sensitive personal data

Answer 169

Combines two or more authentication methods Examples: - Password + OTP - Password + Biometric (fingerprint/face ID) Benefit: Reduces risk of credential theft

Answer 170

A tool for detecting vulnerabilities in web applications Capabilities: 1. Automated vulnerability scanning. 2. Manual penetration testing. 3.Fuzzing input fields.

Answer 171

A web security testing tool Features: 1. Proxy for intercepting and modifying traffic 2. Scanner for vulnerabilities like XSS and SQL injection 3. Intruder module for brute-force testing

Answer 172

1. SQL Injection: Manipulating SQL queries 2. Command Injection: Executing OS commands 3. LDAP Injection: Manipulating directory queries 4. XML Injection: Altering XML data

Answer 173

1. Requirements: Include security needs 2. Design: Incorporate secure architecture 3. Development: Use secure coding practices 4. Testing: Perform security tests 5. Maintenance: Regularly update and patch

Answer 174

1. Full Disclosure: Publish immediately 2. Responsible Disclosure: Notify vendors, allow time for a fix 3. Bug Bounty Programs: Incentivize researchers to report vulnerabilities

Answer 175

1. Use API keys and authentication 2. Rate-limit requests 3. Validate all inputs

Answer 176

Uses code coverage metrics to generate smarter inputs

Answer 177

Identifying potential security threats during design Steps: - Identify assets - Identify threats - Define controls to mitigate threats

Answer 178

--------------------------

Answer 179

1. Shorter certificate validity periods limit the time frame in which a compromised certificate can be exploited by an attacker, enhancing security by minimizing the potential damage. 2. Certificates with shorter lifespans encourage website administrators to renew them regularly, ensuring they stay up-to-date with the latest security standards and practices. 3. Shorter certificate validity reduces the reliance on CRLs, which can be difficult to manage and less reliable, as frequent renewals minimize the risk of using an outdated or revoked certificate.

Answer 180

Experts advocate for the use of Extended Validation (EV) Certificates despite their higher cost and longer issuance time because they offer several important benefits. 1. They increase user trust by displaying the organization's name in the browser's address bar, helping to distinguish legitimate websites from phishing sites. 2. EV Certificates require a more thorough validation process, ensuring the website's identity is verified, which enhances security. 3. Additional verification reduces the risk of fraud and phishing attacks, providing greater protection for both website owners and users.

Answer 181

Threat 1: Phishing Attack Description: A user might be tricked into entering their login credentials on a fake SSO login page created by an attacker. Once the credentials are entered, the attacker can access the user’s accounts. Goal Violated: Confidentiality. The attacker gains access to the user’s login credentials, compromising the confidentiality of their personal information. Threat 2: Service Provider Breach Description: If a major SSO provider, such as Google or Facebook, is breached, the attacker may access the accounts of users who use that provider for authentication. This can affect all connected services. Goal Violated: Availability. The breach may result in users being unable to access websites or services, violating the availability of those services.

Answer 182

Use asymmetric encryption to securely exchange the symmetric key and symmetric encryption to encrypt the actual data

Answer 183

1. Has greater security as it uses Asymmetric Encryption to securely transfer the symmetric key which is used to transfer the data. 2. Symmetric encryption is computationally faster for large data, ensuring quick and efficient data processing.

Answer 184

It's not entirely appropriate as it: 1. Assumes the attacker can fully control the communication network, including eavesdropping, intercepting, and injecting messages. However, in proximity-based protocols, physical distance and signal range constraints limit an attacker's capabilities, making the model too negative 2. Focuses on symbolic message manipulation and ignores real-world physical-layer attacks, such as signal jamming or relay attacks, which are relevant to protocols like Bluetooth.