Web Application Security Fundamentals

To determine which Algorithm/Encryption method is safest for use, we need to evaluate each option and determine its level of security.

A. DES (Data Encryption Standard) is an encryption method that uses a symmetric key algorithm. It was widely used in the 1970s and 1980s but has since been replaced by more secure encryption methods. DES is vulnerable to brute-force attacks, which can decrypt the encrypted message by trying all possible keys.

B. RC4 (Rivest Cipher 4) is a symmetric key stream cipher that was widely used in the past but is now considered insecure. It has been found to have many vulnerabilities, including biases in the key-scheduling algorithm and statistical weaknesses in the keystream.

C. Block ciphers using Electronic Code Book (ECB) mode is a method of encrypting data in blocks using a symmetric key algorithm. However, it is not considered secure because it is vulnerable to certain attacks, such as pattern attacks, where the same plaintext block is encrypted to the same ciphertext block.

D. AES (Advanced Encryption Standard) is a symmetric key algorithm that is widely used and considered to be secure. It has a key size of 128, 192, or 256 bits and uses a block cipher to encrypt data. AES has been extensively tested and is currently used by many organizations, including the US government, for encryption.

Therefore, the safest Algorithm/Encryption method for use is:

The Answer is: D. AES

Security must be integrated throughout the entire Software Development Life Cycle (SDLC). Addressing security early in design and continuing through deployment is more cost-effective and results in more secure applications than late-stage fixes.

Trusted websites face multiple attack vectors including exploiting software vulnerabilities, uploading malware through user-generated content features, and internal threats. Each method represents a different approach to compromising trusted systems.

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a methodology developed by Microsoft specifically for Threat Modelling to identify potential security threats during the design phase. Other options do not represent threat modeling frameworks.

Displaying or sending a raw password (old or new) is insecure. The most secure design is to verify identity details and send a temporary reset link via email to the registered address. Distractors are unsafe because they expose existing passwords or generate new ones directly on screen.