4.0 Application, Data and Host Security

4.1 Explain the importance of application security controls and techniques.

• Fuzzing
• Secure coding concepts
  • Error and exception handling
  • Input validation
• Cross-site scripting prevention
• Cross-site Request Forgery (XSRF) prevention
• Application configuration baseline (proper settings)
• Application hardening
• Application patch management
• NoSQL databases vs. SQL databases
• Server-side vs. client-side validation

4.2 Summarize mobile security concepts and technologies.

• Device security
  • Full device encryption
  • Remote wiping
  • Lockout
  • Screen locks
  • GPS
  • Application control
  • Storage segmentation
  • Asset tracking
  • Inventory control
  • Mobile device management
  • Device access control
  • Removable storage
  • Disabling unused features
• Application security
  • Key management
  • Credential management
  • Authentication
  • Geo-tagging
  • Encryption
  • Application whitelisting
  • Transitive trust/authentication
• BYOD concerns
  • Data ownership
    • Support ownership
    • Patch management
    • Antivirus management
    • Forensics
    • Privacy
    • On-boarding/off-boarding
    • Adherence to corporate policies
    • User acceptance
    • Architecture/infrastructure considerations
    • Legal concerns
    • Acceptable use policy
    • On-board camera/video

4.3 Given a scenario, select the appropriate solution to establish host security.

• Operating system security and settings
• OS hardening
• Anti-malware
  • Anti-virus
  • Anti-spam
  • Anti-spyware
  • Pop-up blockers
• Patch management
• Whitelisting vs. blacklisting applications
• Trusted OS
• Host-based firewalls
• Hardware security
  • Cable locks
  • Safe
  • Locking cabinets
• Host software baselining
• Virtualization
• Snapshots
• Patch compatibility
• Host availability/elasticity
• Security control testing
• Sandboxing

4.4 Implement the appropriate controls to ensure data security.

• Cloud storage
• SAN
• Handling Big Data
• Data encryption
  • Full disk
  • Database
  • Individual files
  • Removable media
  • Mobile devices
• Hardware based encryption devices
  • TPM
  • HSM
  • USB encryption
  • Hard drive
• Data in transit, data at rest, data in use
• Permissions/ACL
• Data policies
  • Wiping
  • Disposing
  • Retention
  • Storage

4.5 Compare and contrast alternative methods to mitigate security risks in static environments.

• Environments
  • SCADA
  • Embedded (printer, smart TV, HVAC control)
  • Android
  • iOS
  • Mainframe
  • Game consoles
  • In-vehicle computing systems
• Methods
  • Network segmentation
  • Security layers
  • Application firewalls
  • Manual updates
  • Firmware version control
  • Wrappers
  • Control redundancy and diversity