Web Security

Question 1

what is OWASP?

Answer 1

• worldwide charitable organization focused on improving the security of application software.

Question 2

Top 10 OWASP :
1. Cross-Site Scripting (XSS)

Answer 2

• malicious scripts are injected into trusted websites.
  ‏

Question 3

Top 10 OWASP :
2. Injection Flaws

Answer 3

• allow attackers to relay malicious code through the Web application to another system.

Question 4

Top 10 OWASP :
3.malicious file execution

Answer 4

• occurs when websites and web applications are not properly validated

Question 5

Top 10 OWASP:
4. Insecure Direct Object Reference

Answer 5

• occurs when a developer exposes a reference to an internal implementation object

Question 6

Top 10 OWASP:
5. Cross-Site Request Forgery

Answer 6

• is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.

Question 7

Top 10 OWASP:
6. Information Leakage and Improper Error Handling

Answer 7

• Applications can unintentionally leak information about their configuration, internal workings…etc

Question 8

Top 10 OWASP:
7. Broken Authentication and Session Management

Answer 8

-includes all aspects of handling user authentication and managing active sessions.

Question 9

Top 10 OWASP:
8. Insecure Cryptographic Storage

Answer 9

• Protecting sensitive data with cryptography

Question 10

Top 10 OWASP:
9. Insecure Communications

Answer 10

• SSL must be used for all authenticated connections, especially the Internet-accessible Web pages

Question 11

Top 10 OWASP:
10. Failure to Restrict URL Access

Answer 11

• the only protection for a URL that links to that page are not presented to unauthorized users. However skilled or just plain lucky attacker may be able to find and access these pages.

Question 12

Web attacks are classified into34 typesthat include:

Answer 12

• Abuse of functionality
• Buffer Overflow
• Content spoofing
• Brute force

Question 13

Web weaknesses are classified into15 classes that include:

Answer 13

• Application Misconfiguration
• Information Leakage
• Directory Indexing
• Improper input handling

Question 14

The to-do list for web application design

Answer 14

• Harden the network
• Document network security procedures
• Deploy encryption strategies
• Educate users
• Use preventative tools

Question 15

What is a Website Security Audit?

Answer 15

-It compares the effectiveness of the organization’s security systems and protocols to a set of predetermined standards.

Question 16

Why Web Application Security Audits Important?

Answer 16

• Saves money
• Verify the security stance
• Gain the upper hand over hackers by moving first
• Discover the Threats to a Website
• Demand for Compliance
• Find and fix problems with security policies and protocols