Contents
Are security questions Effective?
Unfortunately, security questions are not very effective for security in the age of the internet. They are often easy to guess (your mother’s maiden name, which may still be her last name, is widely accessible information).
What does Owasp recommend for implementing proper password strength controls Choose all that apply?
Implement Proper Password Strength Controls Minimum length of the passwords should be enforced by the application. Passwords shorter than 8 characters are considered to be weak (NIST SP800-63B). Maximum password length should not be set too low, as it will prevent users from creating passphrases.
What are good secret questions?
Here are examples of some common security questions:
- In what city were you born?
- What is the name of your favorite pet?
- What is your mother’s maiden name?
- What high school did you attend?
- What is the name of your first school?
- What was the make of your first car?
- What was your favorite food as a child?
How to protect the security of an OWASP application?
If the application will be accessed from publicly shared computers such as libraries, the following may protect its security. Avoid caching the site’s pages on the system by setting the correct cache control directives. Exclude sensitive information from the site’s URLs since the history of the client browser will store these.
What is the OWASP application security verification standard ( ASVs )?
The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.
What is a typical authentication flow in OWASP?
A typical authentication flow would be: The user enters their username and password. If the username and password are correct, the user is presented with the security question (s). If the answers are correct, the user is logged in.
How to query for username and password in OWASP?
Suppose the user enters the following: Username : Obelix and Password : Dogmatix This input is then used to build a query dynamically which would be something like: SELECT * FROM Users WHERE username= ‘Obelix’ and password=’Dogmatix’ This query would return to the application a row from the database with the given values.