Application security is one of the major concerns today in the field of software engineering. It is the use of different hardware, software and methods used to protect application from threats that can occur within the system. In order to protect the system from viruses, hacks and vulnerabilities, application security is used.
Learning application security interview questions are a must for a security expert who wants to work on the related field of security. You should know the basics regarding vulnerabilities that can possibly occur, common security problems, and different methods to protect systems and identify the problems so that they don’t occur again.
The post attempts to include intermediate level application security questions to refresh your memory.
1. Why do you think you are likely to find netcat on a computer that is trojann-ed?
Answer: Because netcat can be used for port scanning. Attackers often use a trojann-ed computer as a pivot and use it for attacks.
2. To prevent sniffing in the network level, what would be used?
Answer: IPsec is used at network level to prevent sniffing.
3. Which mechanism is used by CISCO switches so as to prevent Address Resolution Protocol(ARP) cache poisoning?
Answer: It’s called Dynamic ARP inspection.
4. Say you are in charge wireless network for a small business. The company wants to have open authentication, but they you want you to work on network so that people in adjacent apartment won’t be able to see their network. Suggest a solution in this case.
Answer: I would suggest the company to set up a network with SSID broadcasting disabled from Access point(AP).
5. A client in your specialty gripe around a moderate Internet association. You screen the outside interface of your organization’s fringe switch and notification an enormous mount of half-open TCP associations. What kind of assault is your organization presently a casualty of?
Answer: The attack seems to be an attempted DOS(Denial of Service) attacks since it slows down internet connection and opens up half TCP connections.
6. In which case would an assailant imitate a disappointed client of an organization and asking for a secret key change on the client’s record?
Answer: This scenario is likely to happen because of a disgruntled employee.
7. What does injection flaws, in general mean?
Answer: Tricking an application into including unintended commands in the data sent to an interpreter cause injection attacks. Interpreters take string and tend to interpret strings as commands. Examples are OS injection, LDAP , SQL injection etc.
8. Propose solutions for unvalidated input problem, which is always the root cause of vulnerabilities in applications.
Answer: Possible solutions for unvalidated input problem can be categorized into:
- Architectural issues : Solving a single validation problem is not hard. Creating an architecture that prevents is.
- Create a library : The library should serve to validate and encode. Make sure that every input has to go through the validation. Instead of blacklist, always prefer a whitelist approach for doing this.
- Verify the implementation before taking any new feature to production.
9. What could be possible outcome of unvalidated input?
Answer: Majority of application security issues arise due to unvalidated input problem. Following are few consequence that could be led to:
- Destroy the app’s integrity
- Embed attacks using your application
- Trick you into becoming a pivot to attack third party
- Use errors to learn to attack better.
10. How do you find and fix the problem discussed above(unvalidated input problem)?
Answer: Unvalidated input problems can be found and fixed through the procedures mentioned below:
- Verify your architecture: Make sure your developers follow a guideline to handle user input.
- Validation should be pretty close to use so as to prevent maintenance problem
- Manual verification is necessary because no tools support architectural level testing.
These application security questions are some of the most encountered problems during a job interview for security expert. These questions are generally for intermediate level and are not so difficult to learn which should mean that freshers looking for a security job will find it useful.