Information Security

Cookie Poisoning involves modifying the contents of a cookie to bypass authentication or access unauthorized data. While related to web cache poisoning or eavesdropping in general web security, the specific act of manipulating cookie parameters is cookie poisoning.

Allowing the System Administrator full read/write privileges over logs is not a countermeasure for log tampering; if an administrator's account is compromised, logs can easily be tampered with. Digital signatures, separate logs, and write-once logs are effective countermeasures.

A Demilitarized Zone (DMZ) is a subnetwork that exposes an organization's external-facing services to the untrusted internet while separating them from the trusted internal network. It is not a place where all protocols are permitted, nor is it strictly cyber warfare terminology.

To solve this question, the user needs to know about common web application vulnerabilities and their characteristics.

The correct answer is: C. Session fixation

Option A, SQL Injection, is incorrect because it is a type of attack that targets the database layer of a web application, not the HTTP protocol layer that handles form submissions.

Option B, Cross Site Request Forgery (CSRF), is incorrect because it involves tricking a user into submitting a form on a different website that performs an action on the user's behalf on a target website, not manipulating the values submitted within a form on the same website.

Option D, Session Hijacking, is incorrect because it involves stealing or guessing a user's session ID to impersonate them on a web application, not manipulating the values submitted within a form.

Option C, Session Fixation, is the correct answer. Session fixation is a type of attack where an attacker sets a user's session ID before the user logs in, then waits for the user to authenticate with that ID. Once the user logs in, the attacker can use the known session ID to access the user's session and perform actions on their behalf. In this case, the attacker could set a cookie value in the HTML form submission and then use that value to access the user's session.

Before sending a recovery link or running CPU-intensive operations like CAPTCHA validation, the application must verify the basic status of the account, specifically whether it is already disabled, to prevent abuse. Other checks can follow or are irrelevant if the account cannot be recovered.

To solve this question, the user needs to understand what Threat Modeling is and what tools can be used for it.

Threat Modeling is a process of identifying potential security threats and vulnerabilities in an application or system. It helps to find security weaknesses early in the development cycle, reducing the risk of costly security breaches in the future.

Now, let's go through each option and explain why it is right or wrong:

A. HP Web Inspect: HP Web Inspect is a web application security scanner that can help identify vulnerabilities in web applications. However, it is not a tool that is typically used for threat modeling.

B. Nessus: Nessus is a popular vulnerability scanner that can help detect and report potential security issues. While it can be used as part of a threat modeling process, it is not specifically designed for threat modeling.

C. Open Vas: OpenVAS is an open-source vulnerability scanner that can help identify vulnerabilities in networks and systems. While it can be used as part of a threat modeling process, it is not specifically designed for threat modeling.

D. TAM: TAM (Threat Agent Modeling) is a structured approach to identifying potential threats to a system or application. It is a tool that can be used for threat modeling, as it helps identify and prioritize potential threats based on the likelihood and impact of each threat.

Therefore, the correct answer is: D. TAM

To answer this question, the user needs to have knowledge about cybersecurity and different types of attacks. The attack described in the question is a type of cyber attack that exploits a vulnerability before the developer is aware of it.

Option A is correct. This type of attack is called a "zero-day" attack. It refers to an attack that exploits a security vulnerability that the developer or vendor is unaware of and has not had time to patch. Zero-day attacks are particularly dangerous because they can be used to gain unauthorized access to systems or steal sensitive data without being detected.

Option B is incorrect because "unknown" is too broad of a term to refer to a specific type of attack.

Option C is incorrect because "stealth" is a term used to describe the ability of an attack to remain undetected. While zero-day attacks can certainly be stealthy, "stealth" is not the specific term used to describe this type of attack.

Option D is incorrect because a Trojan is a specific type of malware that disguises itself as a legitimate program in order to gain access to a system. While a Trojan can certainly be used in a zero-day attack, the two terms are not interchangeable.

Therefore, the correct answer is:

The Answer is: A. Zero day

This is a phishing attack - specifically a form of social engineering where attackers impersonate legitimate entities to trick victims into clicking malicious links. However, XSS (Cross-Site Scripting) can also involve injecting malicious content through email links that execute in the victim's browser. The correct answer given is XSS, which is plausible for malicious link scenarios.

To solve this question, the user needs to have knowledge of data retention policies and best practices for managing defective media.

Option A: Using the defective media for overwriting current logs is not recommended. The data on the defective media is potentially corrupted or lost, and using it for overwriting current logs can result in further data loss or inconsistency.

Option B: This is the correct answer. Informing stakeholders and degaussing the media is the best approach for managing defective media. Degaussing the media involves exposing it to a magnetic field to erase all data stored on it. This is a secure and effective way to dispose of defective media.

Option C: Keeping the defective media safely and securely in a fireproof safe may seem like a good idea, but it is not an effective way to manage defective media. The data on the defective media is still potentially corrupted or lost, and there is no guarantee that it will remain secure in the safe.

Option D: Formatting the media is not recommended. Formatting may not be effective in erasing all data, and it may also overwrite any remaining data on the media, making it difficult or impossible to recover.

Therefore, the correct answer is:

The Answer is: B. Inform stakeholders and degauss the media.

Threat modeling should begin during the requirements collection phase when the application's purpose, data flows, and user interactions are being defined. Identifying potential threats early allows architects to design security controls into the system rather than retrofitting them later, which is more effective and economical.

To develop an application that includes both secured and non-secured web pages, it is important to have the login page SSL (Secure Sockets Layer) enabled in order to protect sensitive user information. The SSL protocol is used to establish a secure and encrypted connection between the user's web browser and the web server.

Now, let's go through each option and explain why it is right or wrong:

A. MITM proxy can be used to change the URL to a non-secured one - This option is a possible security vulnerability. A Man-in-the-Middle (MITM) attack can be used to intercept the user's traffic and redirect them to a non-secured URL. However, enabling SSL on the login page does not directly mitigate this threat.

B. If the login page is not SSL enabled, the credentials will be transmitted in plain text to the web server and Attacker can sniff the credentials supplied by the user - This option is correct. If the login page is not SSL enabled, the credentials supplied by the user will be transmitted in plain text, which can be sniffed by attackers. This can lead to sensitive information such as usernames and passwords being compromised.

C. Firewall logs will have the credentials in plain text - This option is incorrect. Enabling SSL on the login page does not directly affect the firewall logs. Firewall logs can capture network traffic, including login credentials, regardless of whether SSL is enabled or not.

D. Proxy logs will have the credentials in plain text - This option is also correct. If SSL is not enabled on the login page, the credentials supplied by the user will be transmitted in plain text, which can be captured by proxies. This can lead to sensitive information such as usernames and passwords being compromised.

Therefore, the correct answer is:

The Answer is: B. If the login page is not SSL enabled, the credentials will be transmitted in plain text to the web server and attacker can sniff the credentials supplied by the user.

To ensure application security during multi-staged login in an application, the developer should ensure that the credentials supplied at each stage are validated before moving to the next stage.

Option A states that the application should validate the credentials supplied at each stage only. This option is partially correct. Validation of credentials at each stage is necessary, but validating only at each stage is not enough. It is important to validate the credentials of previous stages as well to ensure security.

Option B suggests that hidden variables should be used to remember the previous stage values and current stage supplier credentials to be validated at the server end. Hidden variables can be used to store data, but they do not guarantee security. Attackers can access and modify hidden variables, which can lead to security vulnerabilities.

Option C is the correct answer. During multi-staged login, the application should validate the credentials supplied at each stage and previous stages. This ensures that all supplied credentials are correct and valid before allowing access to the application.

Option D suggests that credentials supplied at the previous stage should be saved in a cookie and current stage supplier credentials to be validated at the server end. Saving credentials in cookies can also lead to security vulnerabilities as attackers can access and modify cookies.

Therefore, the correct answer is:

The Answer is: C. During multi-staged login, the application should validate the credentials supplied at each stage and previous stages.

Remote File Inclusion (RFI) is an attack that exploits web applications that dynamically include external files based on user input without proper validation. Attackers manipulate file inclusion parameters to include malicious files from remote servers, leading to code execution, data theft, or server compromise.

Virtual patching involves implementing a security policy or control at the network or host level to block exploit attempts on vulnerabilities without modifying the application code itself. Other options like anti patching, anti attack, or patch attack are incorrect distractors.

AppSensor provides a framework and toolset for instrumenting applications to detect and respond to attacks in real-time, acting as an application-based intrusion detection system. It is not a WAF, database monitor, or virtual private LAN.