Les 7 & 8

Question 1

wat is IDOR

Answer 1

InsecureDirect Object References - an authorization failure

Question 2

op welke 3 dingen kunnen IDOR op gebeuren

Answer 2

Question 3

wat is een CSRF attack

Answer 3

Question 4

op welke 2 manieren kan je CSRF attacks tegengaan

Answer 4

anti-csrf tokens
same site cookie attribute

Question 5

als je anti-csrf tokens gebruikt, waar gaat in het stappenplan de attack falen

Answer 5

Question 6

als je de same site cookie attribute gebruikt, waar gaat in het stappenplan de attack falen

Answer 6

Question 7

welke 3 levels heeft de same site cookie attribute en wat beteken ze

Answer 7

The cookie samesite attribute can be strict, lax or none. “Strict” samesite cookies are never sent when initiated from another domain. “Lax” samesite cookies are present on top-level navigation requests, which is secure enough in most cases. “None” cookies are always sent.

Question 8

threat modeling

welke 4 stappen in de vicieuze cirkel zijn er van thread modeling

Answer 8

Question 9

threat modeling

A hurricane pours rain on my picnic due to it being in open space which leads to wet food and wet equipment (with a 55% chance).

welke delen van deze zin zijn hier de volgende dingen:
- asset
- vulnerability
- threat
- threat actor
- frequency
- impact

Answer 9

Question 10

threat modeling

An internet attacker defaces the public website due to improper output validation which leads to reputational loss with an estimated frequency of once a month.

welke delen van deze zin zijn hier de volgende dingen:
- asset
- vulnerability
- threat
- threat actor
- frequency
- impact

Answer 10

Question 11

threat modeling

welke 4 stappen volgt thread modeling

Answer 11

1. identify main components
2. identify assets
3. identify threats & threat actors
4. think about the controls