Section 21.201 Application Security

Question 1

Application Security

Answer 1

Focuses on building secure applications and aims to prevent, detect, and remediate security vulnerabilities

Question 2

Six Key Areas in Application Security

Input Validation

Answer 2

Acts as a gatekeeper to ensure that applications only act on well-defined and uncontaminated data

● Guards against attacks exploiting data input vulnerabilities (e.g SQL
injection, XSS, buffer overflows)

● Serves as a kind of quality control for data to ensure that every piece of
information is valid, secure, and correctly formatted

● Validation Rules: Delineate acceptable and unacceptable inputs (input expects phone number but receives alphabetical characters - needs to reject this)

While input validation is criticial to peform, it is not a cure all solution so it is used with other defense tools
○ Secure communication protocols
○ Regular security auditing
○ Implementing proper error handling

Question 3

Six Key Areas in Application Security

Cookies

Answer 3

Small data pieces stored by web browsers used to maintain stateful information between the server and client

● Secure Cookies: Transmitted over HTTPS for enhanced security so cookie cannot be read or modified

● Best practices:
○ Refraining from persistent cookies for session verification
○ Enabling the Secure attribute
○ Enabling HttpOnly attribute
○ Configuring the SameSite attribute

Question 4

Six Key Areas in Application Security

Static Code Analysis (SAST)

Answer 4

A method of debugging an application by reviewing and examining its source code before running the program

● Identifies issues like buffer overflows, SQL injection, and XSS

● Important for proper input validation in both front-end and back-end code

Question 5

Six Key Areas in Application Security

Dynamic Code Analysis (DAST)

Answer 5

Analyses applications while they run

Common methods of DAST:
○ Fuzzing (Fuzz Testing)
■ Inputs random data to provoke crashes or exceptions
■ Helps uncover security flaws and weaknesses

○ Stress Testing:
■ Evaluates system stability and reliability under extreme
conditions
■ Reveals bottlenecks and assesses system recovery

Question 6

Six Key Areas in Application Security

Code Signing

Answer 6

Confirms the software author’s identity and integrity

● Utilises digital signatures to verify code authenticity

● Protects against code tampering but doesn’t guarantee absence of
vulnerabilities

Question 7

Six Key Areas in Application Security

Sandboxing

Answer 7

Isolates running programs, limiting their access to resources

● Prevents harmful actions on the host device or network

● Used to execute untrusted or untested programs securely