SCT Unit-03

💡 Click on any image for better visualizing!

1)Access Control Mechanism and trusted objects:

It controls who can access the information and how they can use it
It includes:
1. subjects
  - User requests the system resources
2. objects
  - Objects are the system resources like files, memory, etc...
3. Access Rules
  - These are the rules for performing the operations like read, write and running the files
Managing Trusted Objects:
- ACL (Access Control List)
- RBAC (Role Based Access Control)
- MAC (Mandatory Access Control)
- DAC (Discretionary Access Control)
Protection of Trusted objects:
- Confidentiality
- Integrity
- Availability
- Encryption
- Authentication & Authorization

SCT Unit-03

2)Memory Management in Secure Coding:

Memory Management is the process of managing the memory so that programs run smoothly
1. Managed Code:
  - In Managed Code, Memory is controlled automatically
  - It removes the unwanted objects from the Memory
  - Example:
    - .NET, Java
2. Unmanaged code:
  - In Unmanaged code, Programmers are responsible for managing the memory
  - Example:
    - C, C++
3. Memory Safety:
  - Applications and Programs use only allocated memory
  - They protect the Memory from Unauthorized access
4. Type Safety:
  - It ensures that a variable's value matches its data type
5. ASLR:
  - Predictable Memory Usage can increase the Security risks
  - Use ASLR and other techniques to reduce these risks

SCT Unit-03

3)Sandboxing:

Sandboxing is a technique to run programs safely without affecting the system
Advantages of sandboxing:
- Independent
  - A problem in one program doesn't affect another program
- Security
  - Sandboxing protects the data from harmful code
- Web Browser Security
  - Browser uses Sandboxing to prevent malicious activities
- controls attack
  - If any attacks occur inside the sandbox, it controls the spread
- controls resources
  - sandbox limits the usage of resources like files, networks or hardware

SCT Unit-03

4)Error Handling Practices in Secure Coding

Input Validation:
- Program receives the data from various sources
- If input data isn't validated properly, then it leads to a system crash
- Proper Input Validation is the first line of defense
Authentication and Authorization:
- The process of verifying the identity of a user or device is called as Authentication
- Only Authorized users can access the data
Exception Handling:
- Improper Exception Handling reveals sensitive information like file path, Database Names, etc...
- Proper Exception Handling prevents Information Leakage
Error Protection:
- Applications run smoothly, even error occurs in the program
Storing Errors Securely:
- Application stores the error securely instead of showing errors to everyone

SCT Unit-03

5)Static Testing vs Dynamic Testing:

Static Testing:
- It prevents defects before execution
- Conducted at the early stage of software development
- It is performed before code deployment
- Code is not executed
- It uses a checklist for the testing process
- It takes less cost when compared to Dynamic Testing
- It takes less time to complete
Dynamic Testing:
- It finds and fixes defects during execution
- Conducted at a later stage of software development
- It is performed after code deployment
- Code is executed
- It uses test cases for the testing process
- It takes more cost when compared to Static Testing
- It takes more time to complete

SCT Unit-03

6)vulnerability scanning vs penetration testing

Penetration testing:
- It is for a critical system
- Penetration testing is intrusive
- It exploits a vulnerability
- It is ideal for the physical Environment
- It is performed by using Ethical Hackers
- It is done after vulnerabilities are identified
- It is more expensive when compared to Vulnerability Scanning
Vulnerability Scanning:
- It is for a non critical system
- Vulnerability Scanning is non intrusive
- It identifies vulnerability
- It is ideal for a Lab Environment
- It is performed by using tools
- It is done before penetration testing
- It is less expensive when compared to Penetration testing

SCT Unit-03

7)Declarative and Programmatic Security

Declarative Security:
- Security rules are written outside the code
- They are defined in configuration files
- They are independent of code
- It is managed by the system
- Declarative Security is highly flexible
- Declarative Security is Easy to Maintain
Programmatic Security:
- Security rules written inside the code
- They are defined in the Program code
- They are dependent of code
- It is managed by the developer
- Programmatic Security is less Flexible
- Declarative Security is complex to maintain

SCT Unit-03

8)Input Validation:

Program receives the data from various sources
If input data isn't validated properly, then it leads to a system crash
Proper Input Validation is the first line of defense
steps for Input Validation:
1. Data Type:
  - It checks whether the input field has the correct data type
  - Example:
    - Credit Card Number numeric format 16 digits
    - Expiry date MM/YY format
    - CVV 3 or 4 digits
2. Range and Length:
  - After checking the data type, verify the values that are within the range and length
  - Example:
    - Transaction Amount Max Transaction amount is based on the organization limits
3. Size:
  - Check the data size that must be not too small and not too large
4. Remove Special Characters:
  - Remove Special characters that are used in the Injection Attacks
5. Whitelist validation:
  - Allows only safe characters
6. Blacklist validation:
  - Blocks dangerous characters

SCT Unit-03

9)Session Management in Secure Coding:

When a user login to the application, a session is created
The Server assigns a unique session ID to the users
The session continues until the user logout from the application
Common Attacks:
1. Session Hijacking:
  - Attacker steals the session ID from the users and uses that session ID to act as the real user
2. Man In The Middle Attack:
  - Man In The Middle Attack happens when an attacker intercepts the communication between the user and the Application
Steps:
1. Unique Session ID:
  - Create Unique Session ID to the user by using Secure Random Functions
  - Don't Show Session IDs publicly
2. Regenerate Session ID:
  - After login to the Application, immediately generate a new session ID for the users
  - It prevents session fixation attacks
3. Secure Cookies:
  - Use Secure Cookies like HTTPS, HTTPOnly to prevent security attacks
  - Instead of using HTTP, use HTTPS for extra security
  - HTTPS performs Encryption while transmitting the data
4. Encryption:
  - The process of converting from plaintext to ciphertext by using a cryptographic algorithm is called as Encryption
  - Encrypt the session ID to maintain CIA

SCT Unit-03

10)HTTP vs HTTPS

HTTP:
- HTTP stands for Hypertext Transfer Protocol
- It does not perform Encryption and data is sent in plaintext
- It uses port 80 by default
- It does not require a certificate
- It works faster when compared to HTTPS
- It starts with http://
HTTPS:
- HTTPS stands for Hypertext Transfer Protocol Secure
- It performs Encryption and data is sent in ciphertext
- It uses port 443 by default
- It requires an SSL TLS certificate
- It works more slowly when compared to HTTP
- It starts with https://

SCT Unit-03

11)concurrency and configuration

Concurrency:
- The process of running multiple threads at the same time is called as Concurrency
- If threads aren't handled properly, it can lead to a Race Condition
- Uses Locks to avoid Race Condition
- It keeps the data safe
Configuration:
- The process of arranging the system or software is called as Configuration
- If the settings are weak, it causes security risks
- Uses Secure settings to provide security
- It keeps the system safe

SCT Unit-03

12)Logging and Auditing:

Logging records important events and errors for finding and fixing the problems
Logs are stored in Databases and Databases easily generate an audit report
Databases like SQL Oracle have built in Auditing Features
Types of Logging:
- There are mainly three types
  1. Error Logging
    - Error Logging records Errors and System Failure
    - They find and fix the problem
  2. User Action Logging
    - It records User Actions like reading writing creating and deleting
    - They find and fix the problem
  3. Administrative Logging
    - It records Administrative actions like creating users uploading data etc...
    - They find and fix the problem