NAME: SADMAN AWAL CODE: CWS 640

ID: 2023.1.ICT06.0005 LECTURER: SUTHAN

SUBJECT: WEB & APPLICATION SECURITY

1. What is web application security, and why is it important?

Web application security is about protecting websites and online services from attacks that try to exploit
weaknesses in how they're built. It’s important because web apps handle sensitive data and are often
targets for cybercriminals looking to steal information or disrupt services. Without proper security,
attackers can manipulate the web app to gain unauthorized access or steal data. Protecting web apps
ensures the trust of users and the stability of business operations.

2. How does the Open Web Application Security Project (OWASP) contribute to web application
security?

OWASP is a great resource that offers free tools, guidelines, and advice to help make web applications
more secure. One of its most famous contributions is the OWASP Top 10, which highlights the biggest
security risks developers should watch out for. The project fosters a community of security professionals
and developers, constantly updating its resources based on the latest threats. It’s widely recognized and
used by companies around the world to build more secure applications.

3. What are some common web application vulnerabilities?

Some common issues include things like SQL Injection, where hackers can mess with a website’s
database; Cross-Site Scripting (XSS), which allows attackers to inject malicious scripts; and broken
authentication, which can let unauthorized users into the system. Other vulnerabilities include Cross-Site
Request Forgery (CSRF) and insecure direct object references, which can lead to unauthorized access to
sensitive data. Identifying and patching these vulnerabilities early is key to avoiding breaches.

4. What is broken authentication, and how does it impact web applications?

Broken authentication happens when there are flaws in how users log in and stay logged in. It’s a big
deal because it can let attackers access user accounts, leading to data breaches and other serious
problems. This often happens due to weak passwords, poor session management, or insufficient
protection of authentication credentials. The impact can be severe, including stolen identities, financial
fraud, and data theft.
5. What are common signs that a web application suffers from broken session management?

You might notice that session IDs are predictable, or they don’t expire properly when a user logs out.
Other signs include session IDs being reused or not being secured, which makes it easier for hackers to
hijack user sessions. For example, if session cookies are sent over unsecured HTTP instead of HTTPS,
attackers can easily steal them. This compromises user privacy and allows attackers to impersonate
legitimate users.

6. How can multi-factor authentication (MFA) help mitigate broken authentication issues?

MFA adds an extra step to the login process, like requiring a code sent to your phone. Even if a hacker
gets your password, they still can’t log in without that second factor, making it much harder for them to
break in. By combining two or more authentication methods (something you know, something you have,
something you are), MFA drastically reduces the chances of unauthorized access. It’s a simple and
effective way to enhance security.

7. What security best practices should be followed to ensure secure session management?

To manage sessions securely, it’s important to use strong cookies, make sure session IDs change after
login, set session timeouts, and always use HTTPS to protect data as it’s transmitted. Additionally,
developers should invalidate sessions after a user logs out and ensure cookies have proper flags like Http
Only and Secure. This prevents session hijacking and other related attacks, safeguarding user data.

8. How can encryption help mitigate the risks associated with sensitive data exposure?

Encryption scrambles data so that only authorized parties can read it. Even if a hacker gets their hands
on sensitive data, they won’t be able to understand it without the decryption key. This is particularly
important for data at rest (stored data) and data in transit (data being sent over networks). Without
encryption, sensitive information like credit card numbers or personal details can be easily intercepted
and misused.

9. What is the role of Transport Layer Security (TLS) in protecting sensitive data?

TLS is what keeps data safe as it moves between a user’s browser and a web server. It ensures that
sensitive info, like passwords or credit card details, can’t be intercepted by someone lurking on the
network. TLS also ensures data integrity, meaning the information can’t be modified or tampered with
during transmission. It’s a critical layer of security for online transactions, login processes, and other web
activities.
10. What are some examples of sensitive data that need protection in web applications?

Things like passwords, credit card numbers, personal info (like names and addresses), and medical
records are all examples of data that need to be protected. Additionally, things like API keys, session
tokens, and even email addresses can be sensitive, depending on how they’re used. Protecting this data
is crucial to preventing identity theft, financial fraud, and privacy breaches.

11. How can developers prevent sensitive data exposure in a web application?

Developers can keep sensitive data safe by using encryption, setting strong access controls, making sure
passwords are stored securely, and following best practices for data handling and storage. It's also
important to ensure that sensitive data is only transmitted over secure channels (like HTTPS) and that it’s
stored with encryption at rest. Regular security audits can help identify areas where data might be
exposed and mitigate those risks.

12. How can regular security audits and patches help prevent security misconfigurations?

Security audits help find mistakes or vulnerabilities, and patches fix them. By staying on top of audits and
patching issues quickly, you can stop attackers from exploiting weaknesses in your app. Regularly
scheduled audits ensure that security measures remain up-to-date, and patching vulnerabilities as soon
as they’re discovered minimizes the risk of exploitation. This is a proactive approach to maintaining a
secure environment.

13. Why is it important to disable unnecessary features in a web application?

The more features an app has, the more ways there are for attackers to get in. Disabling features you
don’t need reduces the number of possible attack points, making the app more secure. For example,
unused plugins or modules might have vulnerabilities that go unnoticed, giving attackers an entry point.
By minimizing the attack surface, you reduce the risk of vulnerabilities being exploited.

14. What is the principle of least privilege, and how does it relate to security misconfiguration?

The principle of least privilege means only giving users or systems the minimum level of access they
need to do their job. If there’s a misconfiguration that gives someone too much access, it increases the
risk of that access being exploited. For instance, if a regular user has admin rights due to a
misconfiguration, they could accidentally or intentionally compromise the system. Enforcing least
privilege helps to limit potential damage from such misconfigurations.
15. What is a software dependency, and how can it contribute to security risks?

A software dependency is a piece of code (like a library or package) that your app relies on to work. If
one of these dependencies has a security flaw, it can open up your app to attacks. Many developers
don’t always keep track of the security status of their dependencies, which leaves the application
vulnerable if an outdated or compromised component is used. This highlights the need for continuous
monitoring and updates.

16. What steps can be taken to mitigate the risks associated with vulnerable components?

To minimize these risks, it’s important to keep dependencies up to date, only use trusted sources for
components, monitor for vulnerability reports, and avoid using outdated or unsupported software. It’s
also helpful to use automated tools that track and alert you to vulnerabilities in your software stack.
Regularly reviewing and replacing risky dependencies will reduce the likelihood of them being exploited
in an attack.

17. Why is input validation critical for web application security?

Input validation ensures that only the right kind of data is allowed into your app, helping prevent attacks
like SQL Injection or Cross-Site Scripting (XSS), where hackers try to trick your app into doing something it
shouldn’t. By restricting input to the expected types and formats, you reduce the chance of malicious
data being processed. It’s a basic but essential defense against many types of attacks that rely on
injecting harmful code.

18. What is the difference between input validation and input sanitization?

Input validation checks that data coming into the app is valid (e.g., making sure a phone number only
contains numbers), while input sanitization cleans data by removing harmful elements (like stripping out
malicious scripts). Both are important, but validation happens before data is processed, ensuring it’s in
the right format, whereas sanitization protects against harmful content that might still make it through.
Together, they help secure web applications from malicious user input.

19. What is a Secure Software Development Life Cycle (SDLC)?

A Secure SDLC is a way of building software where security is a priority at every stage, from planning and
design to coding and deployment. This helps ensure that security risks are caught and addressed early.
By embedding security practices throughout the development process, the chances of vulnerabilities
making it to production are reduced. It also promotes a culture of security awareness among developers
and other stakeholders.
20. What are some security activities that should be incorporated at different stages of the SDLC?

 Planning: Do a risk assessment and figure out potential threats.

 Design: Review the architecture for security weaknesses.
 Implementation: Use secure coding practices and have code reviews.
 Testing: Perform vulnerability scans and penetration tests.
 Deployment: Make sure security configurations are correct, and keep software patched.
 Maintenance: Keep up with regular security updates and monitor for new threats.

By integrating these activities, organizations can ensure that security isn’t an afterthought but an
ongoing part of the development process.