Please enable JavaScript.

Coggle requires JavaScript to display documents.

GROUP 1 : Application threats & countermeasures., Data integriti &…

- - - - Network Eavesdropping
        
        The attacker traces the user name and password from the network when it is sent by the user to server.
        
        Authentication mechanisms like Microsoft Window authentication
      - Brute Force Attack
        
        Involves tracing password by using various hashing and encryption algorithms.
        
        Using strong password enables the elimination of risks due to brute force attacks.
      - Dictionary Attacks
        
        Is used to trace passwords by iterating used words made of uppercase, lowercase, numeric and special characters.
        
        Use complex password with irregularly used words made of uppercase, lowercase, numeric and special characters.
        
        Use cryptographically strong random numbers in the password.
      - Cookie Replay Attacks
        
        Involve capturing cookies by gaining access under a false identity
        
        Applying an encrypted communication channel
        
        Applying a cookie timeout authentication
      - Credential Theft
        
        Anyone other than the user can access a stored user login and password.
        
        Applying strong passwords
        
        Storing password verifiers in the hash form
        
        Using an account lockout policy after a specific number of retry attempts.
  - - - Buffer Overflow
        
        It includes DOS attack and code injection attacks in which user is pretended the use of specific resources
        
        Make input validation checks at the start of the application so that the unexpected input will be stopped.
      - Cross-Site Scripting
        
        Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy
        
        Input validation checks involve input from query strings, form fields and valid checks for cookies for the application.
      - SQL Injection
        
        Validation injects arbitrary commands into the database by the use of QSL statements.
        
        Applying input checks before sending requests to the database
        
        Applying parameterized stored procedures.
        
        Allowing restricted users to connect to the database
      - Elevation Of Privilege
        
        Privileges of the local administrator are increased so that attacker can have full control over the machine or systems
        
        Use least privileged processes, services and user accounts.
  - - - Disclosure Of Confidential Data
        
        Making strong access control list (ACLs) to secure Windows resources.
        
        Data must be kept in persistent stores like databases and configuration files. Only authenticated and authorized users should be allowed to review it.
        
        Creating roles for the specific users to access confidential data.
      - Configuration Management
        
        Permits operators and administrators to alter configuration parameters, update website content and perform routine maintenance.
        
        Allowing few administration interfaces
        
        Having and Using strong authentication
        
        Local administrator must be given right to access data. If an administrator is remote, they must use secured channels.
      - Elevation of Privilege
        
        Data must be kept in persistent stores like databases and configuration files. Only authenticated and authorized users should be allowed to review it.
        
        Creating roles for the specific users to access confidential data.
        
        Making strong access control list (ACLs) to secure Windows resources.
        
        Using standard encryption to keep confidential data in configuration files and databases.
- - - - Digital signature
      - Audit Trails