Information Security

Using per-user or session indirect object references (like using database IDs instead of sequential numbers) prevents Insecure Direct Object References. Without this, attackers can manipulate URLs or parameters to access other users' data by guessing or incrementing IDs. This ensures users can only access objects they're authorized to see.

Cross Site Request Forgery (CSRF) involves attackers forging authenticated requests that victims unknowingly submit. Since the browser automatically sends cookies (including session tokens) with the request, the server believes it's from the legitimate user. Key indicators: forged requests, tricking victims, authentication bypass. Unlike XSS which executes scripts in the browser.

CSRF tokens are unique, unpredictable values included in forms as hidden fields. When the form is submitted, the server validates this token matches the session token. Since attackers cannot guess or obtain this token, they cannot forge valid requests even if they trick users into submitting forms. This is the primary defense against CSRF.

Exception stack traces exposed to users reveal internal system details: file paths, database schemas, software versions, and potential vulnerabilities. Attackers use this information for targeted attacks. This is a clear case of Security Misconfiguration (specifically, Weak Security Configuration). Proper error handling should show generic messages to users.

Using strong hashing algorithms with salts prevents Insecure Cryptographic Storage. Salting adds uniqueness to each password, preventing rainbow table attacks. Strong hashing (bcrypt, scrypt, Argon2) resists brute-force attacks. Without these, stolen password databases can be easily cracked, leading to credential theft.

This is a classic Insecure Cryptographic Storage scenario. Encrypting data is useless if the decryption key is stored alongside the encrypted data. When the backup tape is stolen, the attacker has both the encrypted data and the key to decrypt it. Keys must be stored separately, preferably in a secure key management system.

Failure to Restrict URL Access happens when applications don't verify authorization for every page request. Attackers can simply guess or manipulate URLs (like /admin, /user/profile/123) to access privileged functionality. The scenario describes this exactly - an authorized user changes URL to access unprotected privileged pages.

The deny-by-default approach prevents Failure to Restrict URL Access by ensuring no page is accessible without explicit authorization. This is a defense-in-depth strategy where developers must explicitly grant access rather than accidentally leave pages unprotected. It prevents attackers from accessing unprotected pages through URL manipulation.

Not using SSL for authenticated pages allows attackers on the network to intercept session cookies (sniffing). Requiring SSL for all sensitive pages encrypts traffic, preventing cookie theft. The scenario describes Insufficient Transport Layer Protection. Requiring SSL and redirecting non-SSL requests is the correct defense.

Len Cohen (often referred to as Fred Cohen) was the first to formally define and demonstrate the concept of a computer virus in 1983. He created the first documented computer virus as part of his doctoral research. Smith, Norton, and McAfee are associated with antivirus software, not the original virus definition.

Spyware is specifically designed to secretly collect personal information, including passwords, financial details, and browsing habits. This makes it the most dangerous type for identity theft. Worms replicate themselves, adware displays ads, and Trojans disguise themselves as legitimate software, but spyware's primary purpose is data theft.

Plain text files (.txt) contain only unformatted text and cannot execute code, making them the least likely to harbor viruses. Word documents, JavaScript files, and ActiveX files can contain macros or executable code that viruses use to spread. ActiveX is particularly vulnerable to malicious code.

Stuxnet was a sophisticated computer worm discovered in 2010 that specifically targeted Iran's nuclear enrichment facilities at Natanz, causing centrifuges to spin out of control and fail. This cyberweapon, widely believed to be a US-Israeli joint operation, significantly delayed Iran's nuclear program by destroying nearly 1,000 centrifuges. The other options (nuira, globalnet, Fox) are not real malware names associated with this incident.

Estonia witnessed a massive cyber attack from Russian hackers in 2007, often considered the first instance of state-sponsored cyber warfare against an entire nation. The attack came after Estonia moved a Soviet war memorial, triggering a coordinated distributed denial-of-service (DDoS) assault that targeted government, banking, and media websites, effectively disabling the country's digital infrastructure for weeks. Bulgaria, USA, and China were not the primary targets of this specific incident.