Tag: security

Passwords transmitted in clear text over an insecure channel

Weak password policy

Encrypted passwords stored in configuration files

Passwords stored in clear text configuration files

Never rely on the operating system, database, or hardware to handle errors

Your application’s code should always include its own error handler.

All errors generated by internal components such as system calls, database queries, and other internal functions, should be handled by the application’s exception handler

Never implement a generic error page

type and format

type, length , format and range

type, length and range

length and range

Update the time

Clear them

Update the header

Store IP

Use role based access

Enforce authorization on each request

Enforce Business Workflow

All

Horizontal Privielege Escalation

Vertical Privielege Escalation

Cross functional escalation

Session Hijacking

A symmetric algorithm provides better access control.

A symmetric algorithm is a faster process.

A symmetric algorithm provides nonrepudiation of delivery.

A symmetric algorithm is more difficult to implement

Random numbers

A long password

DES

A FIPS - or EAL-certified algorithm

FBI agent

A website that allows you to masquerade your identity

Tool that allows you to do phising

Tool that allows you to do vishing

Wear a mask over their face while they hack

Change their dressing pattern, modify their appearance

Using methods like phising

Piggybacking into unsecured wireless