Flashcards
W8: Security and Risk
Cards in this deck (38)
- 1What are the six security principles?Expect the worst
Least privilege
Simple is more secure
Defence in depth
No security in obscurity
Fail security - 2Explain: Expect the worstFocus on prevention instead of reaction
- 3Explain: Least privilegeAny user, program, or process should have only the bare minimum privileges necessary to perform its function. Never trusts users, people make mistakes even if they mean well.
- 4Simple is more secureThe more complex the system, The harder it is to secure. The more forms, tables, routes the more you have to test!
- 5Defence in depthDefense in depth is an information assurance strategy in which multiple layers of defense are placed throughout an IT system.
=> Use layered security mechanisms. If someone gets access to your website, do they have access to everything? One entry point: that is bad - 6No security in obscuritySecurity through obscurity aims to secure a system by deliberately hiding or concealing its security flaws
Be careful about error messages: “hey the login is wrong but password is correct” etc. - 7Fail secureWhen you fail - don’t help the hackers. Don’t, for example, show error messages that can help them.
- 8What are social hackers?People who persuade you online to give your password (for example)
- 9What are "white hat" hackers?White hackers - also known as “ethical hackers,” are non harmfull hackers, often
paid employees or contractors working for companies as security specialists that attempt to find security holes via hacking. - 10What are "black hat" hackers?A black hat hacker is a computer user who will fully vandalizes or commits theft on other people's networks.
The term "black hat" is a way to describe their malicious motivations. - 11What is hashing?Hashing performs a one-way transformation on a password, turning the password into another String, called the hashed password. A mathematical operation that's easy to perform, but very difficult to reverse.
password -> hashing -> hdhfhhrogiorhgdbl3 - 12What are rainbow tables?Rainbow Tables are a dictionaries of plaintext passwords and their corresponding hash values which can allow hackers to reverse the hashing function to determine what the plaintext password might be
- 13How can we avoid rainbow tables?Adding a "salt" to the password. It’s a unique value that can be added to the end of the password to create a different hash value.
password + salt + hash = hashed password
The idea is that by adding a salt to the end of a password and then hashing it, you’ve essentially complicated the password cracking process. - 14What are some important "best practises"?Regulate requests
Validate input
Sanitise data
Keep code private
Vague security errors - 15Regulate requestsIf you have a post and you have some inputs, check if you are receiving what you respected. Validate get parameters. I am aware of what I am receiving?
- 16Validate inputCheck the size/type/length of the data that you expect to receive.
How do you validate form? - 17Sanitise dataIs the data potentially dangerous? For instance, including HTML in a comment on a message board may be harmful to someone viewing the message since their computer might interpret the HTML as a command. Therefore, HTML tags and special character sequences are usually sanitized (removed) from message data that might be misinterpreted as computer instructions or database queries. If its inputs are not sanitized, the application may be vulnerable to attacks such as an SQL injection.
- 18Keep code privateorganise your code so important code is not accessible to the public
- 19Vague security errorsDon't give to vague error codes. But don’t give too much information! (for hackers)
- 20What are Confidentiality attacks?Network attacks against confidentiality.
- 21Name two types of confindetality attacksPacket sniffing - attacker captured the data packets in travel. Once the data is captured, the attacker can read the sensitive data like passwords or card numbers, if the network traffic is not encrypted.
Port Scanning. - 22Give an example of an integrity attack?Man in the middle: Is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other
- 23Availability attackIs an attack on the availabiliy of the system.
Can be for example to attack a network server with large number or service requests with it cannot handle which causes the server to crash and users are denied the service. - 24Authenticity attackSomeone is impersonating you accessing data
- 25Name 4 different attacks:Confidentiality attacks
Integrity attack
Availability attack
Authenticity attack - 26What are the five "components" of risk assessement?risk
trigger
likelihood
impact
CONTINGENCY PLAN - 27What is a risk?An undesirable event with the potential to have a negative impact on the project.
You have to evaluate: Who wants to harm us? What are our vurnabilities? Especially at the human level: how can they use this system? If they try sending a post this way - validating, sanitising. - 28What is a trigger?An event that provides noticeable signs for the group that the risk may actually be happening.
It’s a sign to be monitoring. For example: monitor logins. 10 logins per minute, then suddenly: 100 logins! That is a flag. - 29What is "likelihood"?Chance of the risk occurring, rated on a scale of likely, possible, or unlikely.
For example: a huge number of logins could have occurred for a natural reason (a promotion?), there was a flag - but the risk was low. - 30impactExtent to which the group will suffer as a result of the risk occurring, rated as major, moderate, or minor. If that happens - what are the consequences? Exposing data? Server comes down?
- 31What is the CONTINGENCY PLAN?What to do in the event that the risk happens? But the site offline?
- 32How do you manage the risk?Prevention
Detection
Response
Recovery and Remediation - 33Give examples of common web attacksSQL - injection
Url - manipulation
XSS - Cross-Site Scripting
CSRF - Cross-Site Request Forgery
Cookie theft - 34What is SQL-injection and how can you prevent it?SQL injection is the placement of malicious code in SQL statements, via web page input. If you’re not sanitising your form input - then people can enter SQL statements that that you will unknowingly run on your database and damage it.
Prevent: Give limited privileges to the user AND sanitise the input. Don’t let everyone create or delete tables for example - 35what is URL-manipulation? How to avoid?By manipulating certain parts of a URL, a hacker can get a web server to deliver web pages that they are not supposed to have access to.
Even unlinked pages are accessible - don’t rely on obscurity as access control! Make sure the server protects access to directories containing sensitive data;
Never use important data in get - 36what is XSS? How to avoid?Cross-Site Scripting (XSS) attacks when malicious scripts are injected into otherwise trusted websites. The end user’s browser has no way to know that the script should not be trusted, and will execute the script - the malicious script can access any cookies or other sensitive information
Avoid: if you have an input form: sanatise & validate! - 37What is CSRF?Cross site request forgery (CSRF) is an attack that tricks a web browser into executing an unwanted action in an application to which a user is logged in.
CSRFs are typically conducted with an email or link that tricks the victim into sending a forged request to a server.
Avoid: GET requests should make no change, should be for lists etc at max you can filter things by ID, but they should not make change. Do post request instead! It is very hard to make someone accidentally do a post request. - 38How can we avoid cookie theft?Assume that they are visible! Use
Non-sensitive data in cookies
Set cookie expiration, domain & path
Information
- Description
- Webdev Flashcards on W8: Security and Risk, created by Emma Tysk on 21/06/2019.
- Created by
- Emma Tysk
- Views
- 1
- Rating