CoreQ Academy4.2 Given a scenario, analyze vulnerabilities and attacks, and recommend solutions to reduce the attack surface.
Advanced practitioners map each vulnerability class to the design-level mitigation that eliminates it, not just a one-off patch.
Vulnerabilities and attacks
- Injection
- Untrusted input executed as code or queries.
- Cross-site scripting (XSS)
- Script injection into pages viewed by others.
- Unsafe memory utilization
- Use-after-free, out-of-bounds access and similar memory bugs.
- Race conditions
- Timing-dependent flaws.
- Cross-site request forgery
- Forcing a user's browser to perform unwanted actions.
- Server-side request forgery
- Making the server fetch attacker-chosen URLs.
- Insecure configuration
- Unsafe defaults or settings.
- Embedded secrets
- Credentials hard-coded in code or images.
- Outdated/unpatched software and libraries
- Known vulnerable components.
- End-of-life software
- No more fixes available.
- Poisoning
- Corrupting caches (DNS, web), data or models.
- Directory service misconfiguration
- Weak AD/LDAP permissions, delegation or certificate templates.
- Overflows
- Buffer and integer overflows.
- Deprecated functions
- Unsafe APIs such as strcpy or gets.
- Vulnerable third parties
- Risk inherited from suppliers and integrations.
- Time of check, time of use (TOCTOU)
- State changes between a check and its use.
- Deserialization
- Untrusted serialized objects leading to code execution.
- Weak ciphers
- Outdated algorithms or modes.
- Confused deputy
- A privileged program is tricked into misusing its authority on behalf of a less privileged caller, e.g. SSRF using a cloud role.
- Implants
- Malicious code or hardware planted for persistent access.
Mitigations
- Input validation
- Allow-list validation of type, length and format on the server.
- Output encoding
- Encoding output for its context (HTML, JS, URL) to stop XSS.
- Safe functions
- Using APIs that avoid common bugs.
- Atomic functions
- Operations that complete without interruption, preventing TOCTOU.
- Memory-safe functions
- Bounds-checked functions or memory-safe languages (Rust, Go, managed runtimes).
- Thread-safe functions
- Functions that behave correctly with concurrent access.
- Security design patterns
- Proven patterns such as centralised authorisation, secure defaults and parameterised queries.
- Updating/patching
- Keeping every layer current.
- Operating system (OS)
- Applying operating system security updates promptly.
- Software
- Updating applications and their libraries.
- Hypervisor
- Virtualisation platform patches.
- Firmware
- Device and BIOS/UEFI updates.
- System images
- Rebuilding golden images with current patches.
- Least privilege
- Minimal permissions for users, services and code.
- Fail secure/fail safe
- Fail secure keeps protection when failing (deny access); fail safe prioritises human safety (e.g. doors unlock in a fire).
- Secrets management
- Vaulting and injecting secrets at runtime.
- Key rotation
- Regularly replacing keys and credentials.
- Least function/functionality
- Removing unnecessary features and services.
- Defense-in-depth
- Layered controls.
- Dependency management
- Tracking, pinning and updating third-party components.
- Code signing
- Ensuring only trusted, unmodified code runs.
- Encryption
- Protecting data even if accessed.
- Indexing
- Maintaining searchable inventories of assets, code and data so exposures are found quickly.
- Allow listing
- Only explicitly approved items are permitted.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.2 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.