Unit 4: Apply the Secure Software Development Life Cycle

Question 1

What are common vulnerabilities in the Software Development Life cycle according to the OWASP TOP Ten project

Answer 1

1. Injection
2. Broken Authentication and Session Management
3. Cross-site Scripting (XSS)
4. Insecure Direct Object References
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Missing Function Level Access Control
8. Cross-site Request Forgery (CSRF)
9. Using Components with Known Vulnerabilities
10. Unvalidated Redirects and Forwards.

Question 2

Forces a logged-on victim to send a forged HTTP request to a vulnerable web application

Answer 2

Cross-site Request Forgery (CSRF)

Question 3

When attackers redirect victims to phishing or malware sites or use forwards to access unauthorized pages

Answer 3

Unvalidated Redirects and forwards

Question 4

Occurs when untrusted data is sent to an interpreter as part of a command or query

Answer 4

injection

Question 5

Occurs when a developer exposes a reference to an internal implementation object

Answer 5

Insecure Direct Object References

Question 6

Occurs whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping

Answer 6

Cross-site Scripting (XSS)

Question 7

What is the STRIDE Threat Model

Answer 7

Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Privilege
Elevation of Privilege