Application Security Fundamentals

A virus is a type of malware that replicates by attaching itself to other host files or programs. In contrast, worms are standalone programs that propagate across networks without a host file, and Trojans rely on deception rather than self-replication.

Database views are preventive controls because they restrict user access to specific rows, columns, or subsets of data. By limiting what data users can see or query, views prevent unauthorized access to sensitive information. They don't detect violations (detective) or correct issues (corrective) - they proactively restrict access.

ICMP Sting is a fictional or nonsensical term, making it the correct option for not being a real operational attack. Brute force, denial of service, and buffer overflows are all established, active methods used to disrupt or compromise system operations.

When security is not integrated into a database, it is often handled externally by a trusted front-end application that controls user access and filters queries. Internal database mechanisms like views or cell suppression cannot compensate if base access is unmanaged.

Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs, or laptops. It is generally harmless as it doesn't involve taking control of the device (that's Bluesnarfing) or cloning phones (that's a different attack). The victim simply receives an unsolicited message or contact.

In distributed environments and systems, the fundamental security concern is determining trust - knowing which systems, users, or services to trust. Distributed systems inherently involve multiple autonomous entities communicating across networks, making trust relationships critical. Without proper trust establishment, other security measures become ineffective.

Management has ultimate responsibility for data classification and protection. While data owners define classification levels and access requirements, administrators implement controls, and users follow procedures - management establishes policies, allocates resources, and ensures accountability for the entire data protection program.

The information owner has primary responsibility for determining classification because they understand the business context and sensitivity of the data. Functional managers and senior management set overall policies but don't classify individual items, while users consume information based on its assigned level.

Employees represent the highest risk of fraud and compromise due to their authorized internal access, knowledge of systems, and potential for accidental mistakes or malicious insider actions. External attackers and hackers typically face more security barriers.

To solve this question, the user needs to have a basic understanding of cybersecurity. The user must be able to identify the correct definition of the term "spoofing."

Now, let's go through each option and explain why it is right or wrong:

A. Eavesdropping: This option is incorrect. Eavesdropping is the act of listening to private conversations or communications without authorization. It is not the same as spoofing.

B. Working through a list of words: This option is incorrect. Working through a list of words has no relation to spoofing. It might be related to password cracking or brute-force attack.

C. Session Hijacking: This option is incorrect. Session hijacking is a type of attack in which an attacker takes control of a user session after successfully obtaining or generating an authentication session ID.

D. Pretending to be someone or something else: This option is correct. Spoofing is a type of cyberattack in which an attacker creates a fake identity or uses a legitimate one to gain unauthorized access to information or to make it appear that someone or something else is communicating.

The Answer is: D

CAPTCHA challenges users to complete tasks that are easy for humans but difficult for automated scripts, effectively preventing bots from submitting forms or accessing services. Session management, whitelisting, and blacklisting are security practices but not specifically anti-automation techniques.

Secure configuration management requires disabling or removing all unnecessary elements to minimize the attack surface. This includes unused request methods, manuals, installation files, and sample applications, making 'All' the correct recommendation.

Forcing a website to echo client-supplied data that executes in a user's browser describes Cross-Site Scripting (XSS), not SQL Injection. The other options accurately describe characteristics and capabilities of SQL Injection, such as executing undesired statements or stored procedures.

The principle of full privilege is insecure; applications must instead follow the principle of least privilege, granting users only the minimum access necessary. The other statements accurately describe application Denial of Service mechanisms and defenses.

A weak password policy allows short, simple, or common passwords, drastically increasing the probability of a successful brute-force attack. Cleartext transmission or storage vulnerabilities expose passwords to interception or theft but do not directly facilitate brute-force cracking.

It is a security best practice to implement a generic error page to avoid revealing sensitive debugging details or stack traces to end users. The other statements correctly describe proper error-handling designs, making the recommendation to not implement a generic error page untrue.

Input validation should be as comprehensive as possible, validating the type, length, format, and range of data to prevent injection attacks like XSS. Validating only a subset of these properties (such as just type and format) leaves gaps that attackers can exploit.

Upon log-out, session cookies must be cleared (invalidated on both client and server) to prevent unauthorized session reuse. Modifying time or headers, or storing the IP address, does not properly terminate the session or secure the cookie from being resubmitted.

To ensure secure access control, users need to follow some best practices. The answer is option D, which means that all the options mentioned are correct.

Explanation of each option:

A. Use role-based access: This option is correct because role-based access control (RBAC) is a secure practice to control access to resources based on the roles assigned to individual users within an organization. It ensures that users have the necessary access to complete their tasks and restricts access to resources that are not relevant to their role.

B. Enforce authorization on each request: This option is correct because enforcing authorization on each request helps to verify that the user has the necessary privileges to access the requested resource. Authorization ensures that users only access the resources that they need to complete their tasks and nothing more.

C. Enforce Business Workflow: This option is correct because enforcing business workflow ensures that the access granted to users is in alignment with the business processes. By enforcing business workflow, organizations can minimize the risk of unauthorized access to resources and ensure that the access granted is relevant to the user's role.

D. All: This option is correct because all the options mentioned are secure practices for access control. Using role-based access, enforcing authorization on each request, and enforcing business workflow, all contribute towards ensuring secure access control.

Therefore, the correct answer is: D. All.

Horizontal privilege escalation occurs when a user gains access to resources or functionality belonging to another user with the same role or privileges. Vertical escalation involves gaining higher privileges. Session hijacking involves stealing a session, and cross-functional escalation is not a standard security term.