Secure Programming Practices - Quiz

The correct option is:

Unsafe, because they rely on security by obscurity.

Proprietary protocols and data formats often rely on security through obscurity, which is not a robust security approach. This method assumes that hiding details of the protocol will prevent attackers from exploiting vulnerabilities, but this is generally insecure because once the details are discovered, attackers can target the system.

The correct option is:

File permissions are not set appropriately

Explanation: If file permissions are not set properly, sensitive data in temporary files can be exposed to unauthorized users or processes. Proper file permissions ensure that only authorized users can access or modify the temporary files, protecting confidential information.

The correct option is:

Size of the attack surface

Explanation: Managed code, such as code running in a .NET or Java environment, often has built-in security features like memory management, type safety, and automatic bounds checking, which help reduce vulnerabilities. This reduces the attack surface because it prevents certain types of low-level vulnerabilities (e.g., buffer overflows) that are more common in unmanaged code (like C or C++).

Unmanaged code typically gives the programmer more control over memory and system resources, but this also increases the potential for security flaws and exploits, enlarging the attack surface.

The correct answer is:

All the above options

Explanation:

• Business workflow: Secure access control can involve defining business workflows where only authorized individuals or systems can perform certain actions based on roles and permissions.

• Authorization on each request: It's important to perform authorization checks for each request to ensure the user has the necessary permissions for the specific action they are attempting.

• Role-based access: Role-based access control (RBAC) is a common and secure method where permissions are assigned based on the user's role, helping to ensure that users can only access resources appropriate to their role.

Hence, All the above options are secure practices for access control.

The correct answer is:

HTTP Parameter Pollution

Explanation: HTTP Parameter Pollution (HPP) occurs when an attacker submits multiple input parameters with the same name (e.g., in the query string, POST data, or cookies). This can lead to unexpected behavior in the application, including overwriting values, misinterpreting input, or exposing vulnerabilities that can be exploited on both the server-side and client-side. It often causes issues like bypassing input validation, leading to security risks.

The correct answer is:

Basic

Explanation: In Basic Authentication, login credentials (username and password) are sent to the web server in clear text (i.e., unencrypted) in the HTTP request. This can be a security risk unless it is used in combination with HTTPS (SSL/TLS), which encrypts the data during transmission. Other authentication schemes like Digest, NTLM, and Client Certificates offer more secure methods for transmitting credentials.

The correct answer is:

E) A) and C)

Explanation: Enabling all compiler warnings is an effective way to enforce security checks at compile time. Compiler warnings can help identify potential security issues, such as uninitialized variables, buffer overflows, and other vulnerabilities, before the code is executed. Paying attention to these warnings ensures that any potential problems are addressed early in the development process, which is crucial for writing secure code.

While other options like checking pointers against null values and adding debug traces are useful for runtime security, they are not typically compile-time checks.

The correct answer is:

Clean and validate all user input

Explanation: To improve the overall quality and security of web applications, it is essential to clean and validate all user input. This ensures that data entered by users is both expected and safe to use, helping to prevent common vulnerabilities like SQL injection, cross-site scripting (XSS), and other malicious attacks that exploit improperly validated input.

The other options:

• Allowing the use of HIDDEN form fields can be risky if not handled properly, as attackers might manipulate them.
• Using GET instead of POST is not advisable for sensitive operations because GET data is visible in the URL and can be cached.
• Trusting user-supplied data is inherently insecure, as it opens up the application to various attacks. It is crucial to always validate and sanitize such data.

The correct answer is:

Only when combined with other controls

Explanation: Securing a database application with username/password access control is important, but it is not sufficient on its own. Passwords can be compromised, and relying solely on username and password increases the risk of unauthorized access. Additional controls such as multi-factor authentication (MFA), encryption, role-based access control (RBAC), and regular audits should be used in combination to strengthen security.

The correct answer is:

Client-side data validation

Explanation: While client-side data validation can improve user experience and reduce server load, it is not recommended as the sole security measure for web applications. Since client-side validation can be bypassed (e.g., by manipulating the client-side code), it should not be relied upon to secure the application.

Instead, the following measures are more secure:

• Filtering data with a default deny regular expression: Helps prevent malicious input.
• Using parameterized queries to access a database: Prevents SQL injection attacks.
• Running the application with least privileges: Reduces the potential impact of a security breach.

Server-side validation and secure coding practices are essential for proper security.