QUESTION 1

(a)Register the OWASP Top 10 Web Application Security Risks for 2010.

(b)Why does software have to be intensively examined after a security fix?

(c)One security design principles is to expand applications such that all applications execute with least privilege. Thrash out two benefits of this design principle?

(d)Point out three threat Modeling methodologies.

(e)Briefly converse the four possible ways of responding to threats identified for an application.

(f)(i) How do attackers carry out fuzzing?

(ii) How can software be guarded against fuzzing attacks?

QUESTION 2

(a)Confer how an attacker can exploit a C program which is vulnerable to Stack buffer overflow.

(b)With the help of a drawing, differentiate between the Extended Stack Pointer (ESP) and the Extended Base Pointer (EBP).

(c)StackGuard uses a Canary-based defense to buffer overflow attacks in C language.
Explain how StackGuard prevents buffer overflow.

QUESTION 3

(a)Evaluate and contrast Forms authentication with Windows authentication.

(b)Write the code required in web config to allow right of entry as follows:

(i) Just authenticated users have access to the application, and

(ii) Only task "Administrator" has access to the "admin.aspx" page in application.
Your code should be such that access is in charge of is strictly secured.

(c)Frequently "forgotten password" functionality is provided by web applications. Converse the three possible vulnerabilities due to this feature?

(d)What is Index hijacking?

(e)(i) Why is the arbitrary number class of the .NET framework not suitable for cryptography purposes?

(ii) Which class is used instead?

QUESTION 4

(a)How does the "same origin" policy implemented by browsers provide security?

(b)Discriminate between Reflected XSS and Stored XSS attack.

(c)By means of a figure explain the different steps involved in a session hijacking attack via stored XSS.

(d)A web application is known to be vulnerable to cross-site request forgery (CSRF). The application developer made a decision to use SSL to enhance the security of the web application. Argue on the effectiveness of SSL in regard to the CSRF vulnerability.