Lesson 14
Summarizing Secure Application Concepts
Topic 14A
Analyze Indicators of Application Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 2
Syllabus Objectives Covered
• 1.3 Given a scenario, analyze potential indicators associated with application attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 3
Application Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 4
Overflow Vulnerabilities
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 5
Null Pointer Dereferencing and Race Conditions
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 6
Memory Leaks and Resource Exhaustion
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 7
DLL Injection and Driver Manipulation
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 8
Pass the Hash Attack
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 9
Topic 14B
Analyze Indicators of Web Application Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 10
Syllabus Objectives Covered
• 1.3 Given a scenario, analyze potential indicators associated with application attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 11
Uniform Resource Locator Analysis
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 12
Application Programing Interface Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 13
Replay Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 14
Session Hijacking and Cross-site Request Forgery (1)
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 15
Session Hijacking and Cross-site Request Forgery (2)
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 16
Cross-site Scripting (XSS)
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 17
Structured Query Language Injection Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 18
XML and LDAP Injection Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 19
Directory Traversal and Command Injection Attacks
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 20
Server-side Request Forgery
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 21
Topic 14C
Summarize Secure Coding Practices
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 22
Syllabus Objectives Covered
• 2.3 Summarize secure application development, deployment, and automation
concepts
• 3.2 Given a scenario, implement host or application security solutions
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 23
Secure Coding Techniques
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 24
Server-side versus Client-side Validation
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 25
Web Application Security
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 26
Data Exposure and Memory Management
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 27
Secure Code Usage
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 28
Other Secure Coding Practices
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 29
Static Code Analysis
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 30
Dynamic Code Analysis
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 31
Topic 14D
Implement Secure Script Environments
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 32
Syllabus Objectives Covered
• 1.4 Given a scenario, analyze potential indicators associated with network attacks
• 3.2 Given a scenario, implement host or application security solutions
• 4.1 Given a scenario, use the appropriate tool to assess organizational security
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 33
Scripting
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 34
Python Script Environment
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 35
PowerShell Script Environment
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 36
Execution Control
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 37
Malicious Code Indicators
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 38
PowerShell Malicious Indicators
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 39
Bash and Python Malicious Indicators
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 40
Macros and Visual Basic for Application (VBA)
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 41
Man-in-the-Browser Attack
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 42
Topic 14E
Summarize Deployment and Automation Concepts
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 43
Syllabus Objectives Covered
• 2.3 Summarize secure application development, deployment, and automation
concepts
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 44
Application Development, Deployment, and Automation
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 45
Secure Application Development Environments
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 46
Provisioning, Deprovisioning, and Version Control
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 47
Automation/Scripting Release Paradigms
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 48
Software Diversity
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 49
Lesson 14
Summary
CompTIA Security+ Lesson 14 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 50
