Web Application Security Study Notes
Uploaded by
Viji MWeb Application Security Study Notes
Uploaded by
Viji MCommon questions
Powered by AIDKIM (DomainKeys Identified Mail) authenticates an email's origin by allowing verification of domain identity through cryptographic signatures, thus preventing email spoofing. S/MIME (Secure/Multipurpose Internet Mail Extensions) provides encryption and digital signatures for emails using public key cryptography, ensuring confidentiality and message integrity. Together, they play significant roles in securing email communications by verifying sender legitimacy and protecting message contents .
Token-based authentication, such as using JWT, offers stateless authentication where a token holds the user's authentication data, allowing seamless communication without server-side sessions. OAuth2, meanwhile, provides authorization framework allowing third-party services to access user data without sharing credentials. Token-based systems are simpler and suitable for single applications, while OAuth2 is preferred for scenarios involving third-party access and service-to-service communication, addressing complex authorization needs .
A Secure SDLC incorporates security practices at every phase of software development, including security requirements analysis, secure design, code analysis, security testing, and maintenance. Critical elements include threat modeling, secure coding practices, static and dynamic analysis, and pen-testing. These elements are essential because they ensure vulnerabilities are identified and mitigated early, reducing the risk of exploitation and minimizing development costs by preventing costly post-deployment fixes .
Social engineering exploits human psychology to manipulate individuals into divulging confidential information, bypassing technical defenses. Common tactics include phishing, pretexting, and baiting. The potential consequences are severe, often leading to unauthorized system access, data breaches, identity theft, and financial losses. Its impact is profound as it often circumvents traditional security measures, necessitating increased user awareness and training as countermeasures .
Originally, software security was considered an afterthought, being addressed as secondary to functionality. However, with the rise in cyber threats and attacks, it evolved into a core design principle in software development. Factors contributing to this shift include the increasing complexity of web applications, frequent data breaches, and the realization of the potential financial and reputational damage caused by security vulnerabilities .
Session management prevents hijacking by securing session IDs through practices like ensuring they are unique, unpredictable, and transmitted over secure channels (e.g., using SSL/TLS). Best practices include expiring sessions after periods of inactivity, regularly rotating session IDs, and implementing HttpOnly and secure flags on cookies to protect sensitive session data from client-side scripts and man-in-the-middle attacks .
Rate limiting protects APIs by restricting the number of requests a client can make to a server within a given timeframe, preventing Distributed Denial of Service (DDoS) attacks and excessive load from a single client. While it enhances security by mitigating abuse, improperly configured rate limiting can affect legitimate users, leading to service unavailability. Balancing limits between security needs and performance requirements is crucial to minimize negative impacts on user experience .
Vulnerability assessments are critical as they systematically identify, analyze, and remedy security vulnerabilities within a system, protecting against potential threats. Vulnerability scanning involves automated tools to detect known vulnerabilities, while penetration testing involves simulated attacks to exploit vulnerabilities actively, offering deeper insights into security posture. Together, they provide a comprehensive understanding of security strength and weaknesses, facilitating informed remediation strategies .
Input validation ensures that only properly formatted data passes through an application, thereby preventing malicious data entry that could lead to injection attacks, such as SQL injection and Cross-Site Scripting (XSS). By enforcing stringent validation rules, applications can neutralize potentially harmful inputs before they reach the execution phase, effectively enhancing security measures and mitigating risks of compromise .
Security misconfigurations arise from improper settings, default configurations, and unpatched systems, creating exploitable vulnerabilities. These issues can lead to unauthorized access and data exposure. Mitigation strategies include regular audits, implementing least privilege principles, automating configuration management, ensuring software is updated, and continuously monitoring for deviations from security baselines. These steps help prevent exploitation due to misconfigurations .