Chapter 1 Security Fundamentals - Alice and Bob Learn Application Security

preview_player
Показать описание
Questions to be answered
1. Bob sets the Wi-Fi setting on his pacemaker to not broadcast the name of his Wi-Fi. What is this defensive strategy called?

2. Name an example of a value that could be hard coded and why. (What would be the motivation for the programmer to do that?)

3. Is a captcha usable security? Why or why not?

4. Give one example of a good implementation of usable security.

5. When using information from the URL parameters do you need to validate that data? Why or why not?

6. If an employee learns a trade secret at work and then sells it to a competitor, this breaks which part(s) of CIA?

7. If you buy a “smart” refrigerator and connect it to your home network, then have a malicious actor connect to it and change the settings so that it’s slightly warmer and your milk goes bad, which part(s) of CIA did they break?

8. If someone hacks your smart thermostat and turns off your heat, which part(s) of CIA did they break?

9. If a programmer adds an Easter egg (extra code that does undocumented functionality, as a “surprise” for users, which is unknown to management and the security team), does this qualify as an insider threat? If so, why? If not, why not?

10. When connecting to a public Wi-Fi, what are some of the precautions that you could take to ensure you are doing “defense in depth”?

11. If you live in an apartment with several roommates and you all have a key to the door, is one of the keys considered to be a “factor of authentication”?

Рекомендации по теме
Комментарии
Автор

Tanya bringing value to the internet and lifting the appsec community, so good. 🙏🏼🙏🏼

christophers
Автор

I just recently purchased the Book, can’t wait for the next Book…I’m following the newsletter as best I can it is just SO MUCH!!!

anthonygardner
Автор

What an Awesome Enlightening person I just got the book (one year later) her book just like listening to her SPEAK!:You Learn a GREAT DEAL-just from the Intro I learn/relearn what the System Development Life Cycle is and my need to Study/Restudy the CISSP HANDBOOK Again

anthonygardner
Автор

Just got this book, can’t wait to read and learn a lot. Thank you!

pgallovich
Автор

Dude that example of food choice on an airplane as a privacy/confidentiality issue is 1, 000%

caseyshuniak
Автор

Tanya, is your book available on MS LIBRARY?

mayavik