Home → Cyber Security → Unit V

Web Security & Incident Response

Prevent, detect, and respond

OWASP Top 10

  • Broken Access Control → enforce server-side checks, least privilege, deny by default.
  • Cryptographic Failures → use TLS 1.3, AEAD, rotate keys, don’t roll your own crypto.
  • Injection (SQL/OS/LDAP) → parameterized queries, input validation, ORM, escaping.
  • Insecure Design → threat modeling, secure patterns, defense in depth.
  • Security Misconfiguration → hardened baselines, remove defaults, IaC with policy.
  • Vulnerable Components → SBOM, patch/upgrade, vulnerability scanning (SCA).
  • Identification & Auth Failures → MFA, lockout, secure session mgmt, password policies.
  • Software & Data Integrity Failures → signed artifacts, checksums, CI/CD signing.
  • Logging & Monitoring Failures → centralize logs, alerts, retention, tamper protection.
  • SSRF → egress filters, metadata service protection, URL allow-lists.

Web Security Controls

  • Headers: CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
  • Cookies: Secure + HttpOnly + SameSite=Lax/Strict; short-lived session IDs.
  • CSRF: anti-CSRF tokens, SameSite cookies, double-submit; use POST for state change.
  • Input: validate whitelist on server, encode output to prevent XSS, sanitize uploads.
  • DoS: rate limiting, WAF/CDN, circuit breakers, exponential backoff.

CSP Example

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example; object-src 'none'; frame-ancestors 'none'

Incident Response

Phases: Preparation → Detection/Analysis → Containment → Eradication → Recovery → Lessons Learned.

  • Preparation: contacts, tooling, playbooks, log coverage, tabletop exercises.
  • Detection: triage alerts, scope affected assets, preserve evidence (chain of custody).
  • Containment: isolate hosts, block indicators, disable compromised creds/tokens.
  • Eradication: remove malware, patch, rotate secrets, close initial access vector.
  • Recovery: restore from backups, monitor for reinfection, staged return to service.
  • Lessons: root cause, control gaps, action items with owners and deadlines.

Legal & Ethics

  • Privacy & data protection: minimize data, lawful basis, consent, retention policies.
  • Cyber laws/compliance: follow regional regulations; maintain audit trails.
  • Responsible disclosure: coordinated vulnerability disclosure; avoid unauthorized access.
  • Digital evidence: maintain integrity, timestamps, and chain-of-custody documentation.

Quick Revision

  • Sanitize inputs and use parameterized queries to stop injection.
  • Set strong security headers (CSP, HSTS) and secure cookies (HttpOnly, Secure, SameSite).
  • Practice IR playbooks; isolate first, then eradicate and recover; always review lessons learned.
  • Keep SBOM and patch components regularly.