Academic Integrity: tutoring, explanations, and feedback — we don’t complete graded work or submit on a student’s behalf.

Lake Point Consulting Services (LPCS) provides security consulting and assurance

ID: 3752882 • Letter: L

Question

Lake Point Consulting Services (LPCS) provides security consulting and assurance services to over 500 clients across a wide range of enterprises in more than 20 states. A new initiative at LPCS is for each of its seven regional offices to provide internships to students who are in their final year of the security degree program at the local college. Like Magic is a national repair shop that specializes in repairing minor car door "dings," windshield repair, interior fabric repair, and scratch repair. Like Magic allows customers to file a claim through a smartphone app and its website. Recently, however, Like Magic was the victim of an SQL injection attack that resulted in customer account information and credit card numbers being stolen. Several security personnel were fired due to this breach. The vice president of LIke Magic is adamant that this will never happen again to them, and has contacted LPSC to help provide training to the technology staff to prevent further attacks. After the presentation LIke Magic asks LPSC to address other weaknesses in their system. You have been placed on the team to examine potential networking-based attacks.

One of your tasks is to create a report for a presentation; you are asked to write a one-page narrative providing an overview of the different types of networking-based attacks of interception and poisoning.

Explanation / Answer

Lake point consulting services

A Presentation on

Data security

Cross – site attacks

ØCross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client side scripts into web pages viewed by other users.

ØA cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.

Cross – site attacks

Attack Techniques

ØReflected (non-persistent) XSS Flaw

ØPersistent (or stored) flaw

ØServer-side versus DOM-based vulnerabilities

Ø

ØSelf-XSS

ØMutated XSS (mXSS)

Defensive Techniques

ØContextual output encoding/escaping of string input

ØSafely validating untrusted HTML input

ØCookie security

ØDisabling scripts

ØEmerging defensive technologies

Injection Attacks

SQL injection is a code injection technique, used to attack data-driven applications, in which nefarious SQL statements are inserted into an entry field for execution

SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed.

Injection Attacks

Attack Techniques

ØIncorrectly filtered escape characters

ØIncorrect type handling

ØBlind SQL injection

ØConditional responses

ØSecond order SQL injection

Defensive Techniques

ØTrust no-one

ØEnforcement at the coding level

ØDon't use dynamic SQL when it can be avoided

ØUpdate and patch

ØFirewall

ØReduce your attack surface

ØUse appropriate privileges

ØDon't divulge more information than you need to

ØBuy better software