Information Security

TCS Security API is the security library provided by TCS for remediation of security vulnerabilities. It offers standardized security functions and controls that development teams can integrate into their applications.

Virtual keyboards are NOT foolproof against keylogging. Hardware keyloggers capture keystrokes at the physical keyboard level before software virtual keyboards are involved. Kernel-level keyloggers intercept input at the OS level, capturing all input regardless of whether it comes from a physical or virtual keyboard. Both A and C correctly identify why virtual keyboards fail as protection.

MD5 has known cryptographic weaknesses and collision vulnerabilities that make it significantly easier to crack than NTLM, NTLMv2, or any strong modern hash. NTLM and NTLMv2 have stronger security properties, while an obscure hash would be more secure due to lack of known attacks.

Man-in-the-Middle (MitM) attacks exploit certificate verification by intercepting communications between parties without their knowledge. An unverified digital certificate error indicates the certificate chain cannot be verified, which is a classic sign of an MitM attack where an attacker presents a fraudulent certificate.

AES (Advanced Encryption Standard) is the current US government standard for encryption and is significantly stronger than DES or Triple DES, which have known vulnerabilities. Whirlpool is a hash function, not an encryption algorithm. AES is approved for classified information and widely adopted.

Call stack traces expose internal implementation details (file paths, method names, library versions, framework info). This helps attackers understand system architecture and identify vulnerabilities. Displaying user-specific info (A) or generic error messages (B) is less risky. 404 errors (D) are standard and safe.

Proper session management requires destroying session data on logout to prevent session hijacking. Invalidating and destroying the session removes all session data from server. Displaying personalized info (A) or generic welcome (B) doesn't address session security. Persistent cookies (D) increase security risk as they remain after browser closes.

AppScan automatically fills and submits forms during testing, including password change forms. When it encounters a password change form, it submits with auto-generated values like '1234', changing the actual password. This is normal testing behavior, not an attack. Solution: use a dedicated test account during scans.

Malicious file execution allows attackers to upload and execute arbitrary code on the server, leading to complete server takeover. This enables site defacement, data theft, using the server to attack others, and full control of the application. Impact is far more severe than compromising individual user accounts or sessions - it's total server compromise.

XSS injects JavaScript that executes in victims' browsers, allowing attackers to access cookies, session tokens, or other sensitive data. Unlike SQL injection or command injection, XSS doesn't directly affect the server or database.

Anti-CSRF tokens like the trnsactToken in option A prevent CSRF by including an unpredictable, session-bound value that attackers can't guess. HTTPS and cookie encryption protect against different threats (eavesdropping), not CSRF.

Sending a 404 Not Found code hides a resource's existence entirely. A 403 Forbidden or 302 Found (redirect) reveals the resource exists but requires access rights or redirection, whereas a 200 OK indicates success and exposes the resource.

Secure coding practices address vulnerabilities at the root level during development. While HTTPS, encryption, and testing are vital, they are secondary defenses if the code itself is fundamentally insecure.

Stack traces expose implementation details, file paths, framework versions, and variable states - all valuable intelligence for attackers. Unlike generic error messages, stack traces provide a roadmap of your application's internal structure.