CSSLP · Question #272
A number of security patterns for Web applications under the DARPA contract have been developed by Kienzle, Elder, Tyree, and Edwards-Hewitt. Which of the following patterns are applicable to…
The correct answer is A. Authenticated session D. Password authentication E. Account lockout F. Password propagation. For web applications, key security patterns applicable to authentication include maintaining an authenticated session, using password authentication methods, implementing account lockout mechanisms to deter brute-force attacks, and managing password propagation securely.
Question
A number of security patterns for Web applications under the DARPA contract have been developed by Kienzle, Elder, Tyree, and Edwards-Hewitt. Which of the following patterns are applicable to aspects of authentication in Web applications?b Each correct answer represents a complete solution. Choose all that apply.
Options
- AAuthenticated session
- BSecure assertion
- CPartitioned application
- DPassword authentication
- EAccount lockout
- FPassword propagation
How the community answered
(65 responses)- A88% (57)
- B9% (6)
- C3% (2)
Why each option
For web applications, key security patterns applicable to authentication include maintaining an authenticated session, using password authentication methods, implementing account lockout mechanisms to deter brute-force attacks, and managing password propagation securely.
The Authenticated session pattern ensures that once a user is authenticated, their session maintains that authenticated state for subsequent requests, preventing the need for re-authentication on every action.
Secure assertion is a pattern related to securely transmitting identity information between systems (e.g., in federated identity), which typically follows an initial authentication, rather than being a core authentication pattern itself.
Partitioned application is an architectural pattern for segregating application components for isolation and resilience, which relates to overall system design, not directly to authentication processes.
Password authentication is a fundamental pattern where users prove their identity by providing a correct password, which is then verified by the system against stored credentials.
The Account lockout pattern is a critical security measure that temporarily disables a user's account after a specified number of failed authentication attempts to thwart brute-force attacks.
Password propagation refers to patterns and mechanisms for securely transmitting or sharing user credentials, or tokens derived from them, between different system components for authentication purposes.
Concept tested: Web application security patterns - Authentication
Topics
Community Discussion
No community discussion yet for this question.