Reference no: EM133317
QUESTION 1
(a)Register the OWASP Top 10 Web Application Security Risks for 2010.
(b)Why does software have to be intensively examined after a security fix?
(c)One security design principles is to expand applications such that all applications execute with least privilege. Thrash out two benefits of this design principle?
(d)Point out three threat Modeling methodologies.
(e)Briefly converse the four possible ways of responding to threats identified for an application.
(f)(i) How do attackers carry out fuzzing?
(ii) How can software be guarded against fuzzing attacks?
QUESTION 2
(a)Confer how an attacker can exploit a C program which is vulnerable to Stack buffer overflow.
(b)With the help of a drawing, differentiate between the Extended Stack Pointer (ESP) and the Extended Base Pointer (EBP).
(c)StackGuard uses a Canary-based defense to buffer overflow attacks in C language.
Explain how StackGuard prevents buffer overflow.
QUESTION 3
(a)Evaluate and contrast Forms authentication with Windows authentication.
(b)Write the code required in web config to allow right of entry as follows:
(i) Just authenticated users have access to the application, and
(ii) Only task "Administrator" has access to the "admin.aspx" page in application.
Your code should be such that access is in charge of is strictly secured.
(c)Frequently "forgotten password" functionality is provided by web applications. Converse the three possible vulnerabilities due to this feature?
(d)What is Index hijacking?
(e)(i) Why is the arbitrary number class of the .NET framework not suitable for cryptography purposes?
(ii) Which class is used instead?
QUESTION 4
(a)How does the "same origin" policy implemented by browsers provide security?
(b)Discriminate between Reflected XSS and Stored XSS attack.
(c)By means of a figure explain the different steps involved in a session hijacking attack via stored XSS.
(d)A web application is known to be vulnerable to cross-site request forgery (CSRF). The application developer made a decision to use SSL to enhance the security of the web application. Argue on the effectiveness of SSL in regard to the CSRF vulnerability.
|
Network security
: SLE, ARO, and ALE, behavioural biometric technology, Enterprise Information Security Policy, Issue Specific Security Policy, System Specific Security Policy, firewalls protect network, creating a DMZ during firewall implementation, use of SSL to se..
|
|
Digital forensic investigation
: computer security incident, Trojan Defence, anti-forensics technique, chain of custody, FAT file system, SQLOracleHacks.txt, SQLOracleAttacks.txt, SQLInjection.html
|
|
Computer security incident
: Locard's Exchange Principle, electronic crime scene, modules or DLLs a process, router forensics, Configuration and user, Local logs process and memory, Network Information, File system, Portray the NTP vulnerability of some Cisco IOS routers
|
|
Security vulnerabilities of vc
: single access point (AP), wireless network, CSMA/CA, goals of information security, Wireless LANs, wireless hacking process, Wired Equivalent Privacy (WEP), Open System Authentication and Shared Key Authentication, Initialisation Vector (IV), RADIU..
|
|
Owasp top 10 web application security risks
: Reflected XSS and Stored XSS attack, threat Modeling methodologies, Extended Stack Pointer (ESP) and the Extended Base Pointer (EBP), Canary-based defense to buffer overflow attacks in C language, admin.aspx, Index hijacking, cross-site request fo..
|
|
Cryptosystem
: Block cipher, Primitive root, Confusion, Diffusion, Digital signature, Conventional Symmetric-Key Encryption
|
|
Cyber weapon
: Single Sign On (SSO), Single Sign On (SSO), netstat -an, arp -a, ipconfig /displaydns, MS Config. Means, MS Config. Means, network reconnaissance
|
|
Dos and ddos attack
: Denial of Service attack (DoS) and Distributed Denial of service (DDoS) attack, two-factor authentication system, password ageing, biometric devic, cryptographic attack made Double DES (2DES), Demilitarized Zone (DMZ), SSL protocols
|