Information Security

SANS Institute is globally recognized as the largest and most trusted source for information security training and certifications, including the widely-recognized GIAC certifications. OWASP is a community focused on web application security resources, MITRE maintains security standards like ATT&CK and CWE, and WASC focuses on web application security consensus - but none provide comprehensive training and certification at SANS's scale.

OWASP (Open Web Application Security Project) maintains and periodically updates the OWASP Top 10 document, which represents a broad consensus about the most critical web application security risks. This document is widely referenced across the industry. WASC, NIST, and other organizations maintain their own security standards and resources, but do not produce the OWASP Top 10.

WASC (Web Application Security Consortium) maintains the Web Hacking Incident Database (WHID), which tracks media-reported security incidents that can be associated with web application security vulnerabilities. The Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) databases are maintained by MITRE, not WASC.

Bugtraq is the full disclosure mailing list maintained by SecurityFocus for detailed discussion and announcement of computer security vulnerabilities. BugZilla is a bug-tracking system, VirusList is not related to vulnerability disclosure.

Both OWASP (Open Web Application Security Project) and WASC (Web Application Security Consortium) are non-profit, open communities dedicated to improving application security. OWASP is widely known for its Top 10 project, while WASC focuses on web security threats and classifications.

CVE stands for Common Vulnerabilities and Exposures, which is the standard system for referencing publicly known information security vulnerabilities. Each CVE entry provides a unique identifier for a specific security vulnerability.

MITRE Corporation maintains the CVE list on behalf of the US Department of Homeland Security. MITRE is a non-profit organization that operates several federally funded research and development centers, including the CVE program.

Data classification must be based on the CIA triad: Confidentiality, Integrity, and Availability. These are the fundamental security principles that determine how data should be protected based on its sensitivity and criticality.

Authentication is the process of validating a claimed identity (like username/password, token, or certificate). It verifies credentials, whereas authorization determines what access those credentials grant. Identification is just claiming an identity.

A vulnerability is any weakness in a system that could be exploited to compromise security. This includes software bugs, configuration errors, or design flaws. A 'danger' is a threat, and vulnerabilities are the openings threats exploit.

Identification is the process of ensuring a subject is the entity it claims to be. It's about claiming an identity (like providing a username), whereas authentication validates that claim (proving you own that username with a password).

Effective security programs require both technical controls (firewalls, encryption, access controls) and non-technical methods (policies, procedures, training, awareness). Technical controls alone are insufficient because security also depends on people following processes and understanding their roles. Countermeasures and safeguards are subsets of technical controls, not the complete picture.

Authorization is the process of determining what permissions and access rights an authenticated subject has. It comes AFTER authentication (proving identity) and answers the question 'what is this user allowed to do?' Option B describes authentication, not authorization. Option A describes credential validation, which is part of authentication.

The seal() method creates a cryptographic seal that binds data together with an expiration timestamp, ensuring data integrity and freshness. Unlike encoding or hashing which only transform data, sealing provides tamper evidence by cryptographically linking the data to a specific time window. This prevents replay attacks where old captured data could be reused.

Input Validation ensures data meets expected criteria before processing, while Output Encoding converts special characters to safe representations, preventing malicious scripts from executing. These two practices directly combat XSS by controlling what enters the system and how it's rendered. Authentication/Authorization and Cryptography address access control and data protection, not script injection prevention.