Information Security Fundamentals

WASC (Web Application Security Consortium) was a not-for-profit consortium of international experts, industry practitioners, and organizational representatives that produced open source security standards for the web. OWASP is similar but the description specifically matches WASC.

Both OWASP (Open Web Application Security Project) and WASC (Web Application Security Consortium) are non-profit, open communities dedicated to improving application security. OWASP is widely known for its Top 10 project, while WASC focuses on web security threats and classifications.

CVE stands for Common Vulnerabilities and Exposures, which is the standard system for referencing publicly known information security vulnerabilities. Each CVE entry provides a unique identifier for a specific security vulnerability.

MITRE Corporation maintains the CVE list on behalf of the US Department of Homeland Security. MITRE is a non-profit organization that operates several federally funded research and development centers, including the CVE program.

OWASP stands for Open Web Application Security Project. It is a worldwide non-profit organization focused on improving the security of software. The 'Project' in its name reflects its collaborative, community-driven nature.

CWE (Common Weakness Enumeration) provides a unified, measurable set of software weakness types. It's maintained by MITRE and serves as a taxonomy for common software security weaknesses, unlike CVE which catalogs specific instances.

Data classification must be based on the CIA triad: Confidentiality, Integrity, and Availability. These are the fundamental security principles that determine how data should be protected based on its sensitivity and criticality.

Authentication is the process of validating a claimed identity (like username/password, token, or certificate). It verifies credentials, whereas authorization determines what access those credentials grant. Identification is just claiming an identity.

A vulnerability is any weakness in a system that could be exploited to compromise security. This includes software bugs, configuration errors, or design flaws. A 'danger' is a threat, and vulnerabilities are the openings threats exploit.

Senior management commitment is critical because security requires resources, authority, and culture change. Without executive support, security programs fail due to lack of funding, enforcement power, and employee buy-in. Controls, policies, and training flow from this commitment.

Identification is the process of ensuring a subject is the entity it claims to be. It's about claiming an identity (like providing a username), whereas authentication validates that claim (proving you own that username with a password).

Security policies are broad, high-level statements from top management that establish the organization's security stance. They differ from procedures (detailed instructions) and guidelines (recommended practices). Policies are mandatory and management-driven.

The CIA triad - Confidentiality, Integrity, and Availability - are the fundamental principles of information security. All security controls and policies are designed to protect these three attributes of information and systems.

Application security must be considered throughout the entire software development lifecycle, not just at one phase. Thinking about security only during testing, development, or design is insufficient because vulnerabilities can be introduced at any stage. A holistic approach from requirements through deployment ensures security is built in rather than bolted on later.

Effective security programs require both technical controls (firewalls, encryption, access controls) and non-technical methods (policies, procedures, training, awareness). Technical controls alone are insufficient because security also depends on people following processes and understanding their roles. Countermeasures and safeguards are subsets of technical controls, not the complete picture.

Authorization is the process of determining what permissions and access rights an authenticated subject has. It comes AFTER authentication (proving identity) and answers the question 'what is this user allowed to do?' Option B describes authentication, not authorization. Option A describes credential validation, which is part of authentication.

The ASAP (Application Security Assurance Process) framework provides the best results when applied continuously throughout all phases of development. Starting from requirements analysis helps identify security needs early, while continuing through rollout ensures security is maintained. Applying it only during one phase (testing, development, or design) misses opportunities to prevent or catch vulnerabilities earlier.

The hashPassword method requires both the password and accountName parameters. The accountName is typically used as a salt or to ensure uniqueness of hashes across accounts. Option A only takes the password, which would result in identical passwords producing identical hashes - a security vulnerability. Option C has incorrect capitalization.

The verifyPasswordStrength() method returns void because it likely throws an exception if the password doesn't meet strength requirements rather than returning a boolean. This pattern is common in security APIs where failure should halt execution. However, this is a specific API design choice that depends on the actual framework being referenced.

The isAuthorizedForData() method returns a boolean because authorization checks result in a yes/no decision - either the subject has permission to access the data or they don't. This is the standard return type for authorization methods across security frameworks.