Security+ SY0-701 6-4 Application Security

Offer another technique to protect applications against injection attacks.

No. 

Instead, the client sends arguments to the server, which then inserts those arguments into a precompiled query template. This approach protects against injection attacks and also improves database performance.

Sandboxing is the practice of running an application in a controlled or isolated environment to prevent it from interacting negatively with other system resources or applications.

It has restricted access and permissions to system resources.

Enabling them to debug and test code in a safe, controlled environment before deploying it into production.

Sandboxes are isolation tools used to contain attackers within an environment where they believe they are conducting an attack but, in reality, are operating in a benign environment.

Code signing provides developers with a way to confirm the authenticity of their code to end users.

Developers use a cryptographic function to digitally sign their code with their own private key and then browsers can use the developer's public key to verify that signature and ensure that the code is legitimate and was not modified by unauthorized individuals.

Malicious updates, where an attacker attempts to deploy a fake patch that actually undermines the security of an application or operating system. If systems only accept digitally signed updates, a malicious update would fail that check and be rejected by the target system.

They reuse code.

Third-party software libraries and software development kits (SDK).

SDKs are collections of software libraries combined with documentation, examples, and other resources designed to help programmers get up and running quickly in a development environment.

Security teams should ensure that outsourced code is subjected to the same level of testing as internally developed code.

Centralized locations for the storage and management of application source code.

Keep track of them, if you can not eliminate them.

Code repositories are centralized locations for the storage and management of application source code.

Code repositories also perform version control, allowing the tracking of changes and the rollback of code to earlier versions when required.

Security and auditing professionals can ensure that software development includes auditing and logging of changes.

Where code is in use in an organization but nobody is responsible for the maintenance of that code and, in fact, nobody may even know where the original source files reside.

Provisioned and de-provisioned in a secure manner through the organization's approved release management process.

Code integrity measurement uses cryptographic hash functions to verify that the code being released into production matches the code that was previously approved.

Any deviation in hash values indicates that code was modified, either intentionally or unintentionally, and requires further investigation prior to release.

Scalability and elasticity.

Scalability says that applications should be designed so that computing resources they require may be incrementally added to support increasing demand.

Elasticity goes a step further than scalability and says that applications should be able to provision resources automatically to scale when necessary and then automatically deprovision those resources to reduce capacity (and cost) when it is no longer needed.

Placed strategically throughout code, they provide documentation of design choices, explain workflows, and offer details crucial to other developers who may later be called on to modify or troubleshoot the code.

You can provide attackers a roadmap to how the code works.

The compiler automatically removes comments from executable files.

Can reveal information about the inner workings of an application.

When developers include username and passwords in the source code.

First, the developer may create a hard-coded maintenance account for the application that allows the developer to regain access even if the authentication system fails. This is known as a backdoor vulnerability and is problematic because it allows anyone who knows the backdoor password to bypass normal authentication and gain access to the system.

The second variation of hard-coding credentials occurs when developers include access credentials for other services within their source code. If that code is intentionally or accidentally disclosed, those credentials then become known to outsiders. This occurs quite often when developers accidentally publish code to a public code repository, such as GitHub, that contains API keys or other hard-coded credentials.

Package monitoring involves keeping track of all the third-party libraries or packages used in your organization, understanding what they do, and being aware of any potential vulnerabilities they may have.

It includes regularly updating these dependencies to ensure you are using the most secure, up-to-date versions of third-party packages. Automated tools can help with this process by identifying outdated or insecure dependencies and notifying developers when updates or patches become available.

RAM

Whether intentional or accidental, systems may consume all of the memory, storage, processing time, or other resources available to them, rendering the system disabled or crippled for other uses.

memory leak

In the case of an application with a memory leak, the application fails to return some memory that it no longer needs, perhaps by simply losing track of an object that it has written to a reserved area of memory. If the application continues to do this over a long period of time, it can slowly consume all the memory available to the system, causing it to crash.

The memory is returned to the OS for another process to use.

Application development

They are simply an area of memory that stores an address of another location in memory.

This simply means that the application follows the pointer and accesses the memory referenced by the pointer address.

Buffer overflow attacks occur when an attacker manipulates a program into placing more data into an area of memory than is allocated for that program's use.

To overwrite other information in memory with instruction that may be executed by different processes running on the system.

Maliciously inserting information into memory, and it is the primary goal of a buffer overflow attack.

They can last years!

Buffer overflow. The result of an arithmetic operation attempting to store an integer that is too large to fit in the specified buffer.

A difficult exploit to perform that takes advantage of the small window of time between when a service is used and its corresponding security control is executed in an application or operating system, or when temporary files are created.

Is the instance when a system verifies access permissions or other security controls.

is the moment when the system accesses the resource or uses the permission that was granted.

refers to the particular component, system, or mechanism being evaluated or tested for potential vulnerabilities, such as the system's method of managing and validating access permissions.

The system could be disabled or crippled for other uses.