A company's security policy states that its own internally developed proprietary Internet facing software must be resistant to web application attacks. Which of the following methods provides the…

Question

Options

• ARequire all development to follow secure coding practices.
• BRequire client-side input filtering on all modifiable fields.
• CEscape character sequences at the application tier.
• DDeploy a WAF with application specific signatures.

• A
  72% (26)
• B
  8% (3)
• C
  17% (6)
• D
  3% (1)

Explanation

The question asks for the MOST protection against unauthorized access to stored database information, which primarily means defending against SQL injection and similar attacks. Answer A (secure coding practices) is correct because it addresses the root cause - it encompasses parameterized queries, input validation, output encoding, and other techniques baked into the development lifecycle. Option B (client-side filtering) is easily bypassed by an attacker who intercepts requests. Option C (escape character sequences at the app tier) is a useful tactic but is narrower than a full secure coding program. Option D (WAF) is a perimeter compensating control that can be bypassed with obfuscation and does not fix vulnerabilities in the code itself. Secure coding practices provide defense-in-depth at the source.

No community discussion yet for this question.