> For the complete documentation index, see [llms.txt](https://abrahamreyes9.gitbook.io/cysa+/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abrahamreyes9.gitbook.io/cysa+/1.0-threat-and-vulnerability-management/1.7-given-a-scenario-implement-controls-to-mitigate-attacks-and-software-vulnerabilities.md).

# 1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities

* Attack types:
* XML attack: WAF; disable external entities; input validation; sensitive data not serialised
* SQL injection: WAF; input sanitisation; least privilege restrictions for databases
* Overflow attack:
  * Buffer: ASLR/DEP; NX bit; use secure functions; higher-level languages; input validation
  * Integer: range checking; prefer unsigned integers; use safer code implementations
  * Heap: higher-level languages; input validation; safe compilers; patching
* Remote code execution: avoid using user input inside evaluated code; strict file upload extensions etc.
* Directory traversal: ensure user cannot supply entire file path; accept known-good input
* Privilege escalation: avoid using administrative privileges; separate privilege areas
* Password spraying: MFA; strong passwords; user training; logging/monitoring
* Credential stuffing: MFA; CAPTCHA; unpredictable usernames; check against leaks
* Impersonation: use of session identifiers; packet filtering; DAI; encrypted protocols
* Man-in-the-middle attack: session encryption; ensure only valid certificates are used
* Session hijacking: key/cookie/link encryption; Secure & HttpOnly flags for cookies
* Rootkit: patching; layered security; heuristic analysis; antivirus
* Cross-site scripting:
  * Reflected: WAF; use appropriate response headers; avoid suspicious links
  * Persistent: WAF; filter input & encode data on output; escape HTML data on arrival
  * DOM: don't treat untrusted data as code; delimit untrusted data as quoted strings
* Vulnerabilities:
  * Improper error handling: info leak through over-detailed error messages => error handling policy; error logging; graceful handling of all possible errors
  * Dereferencing: get value (NULL) in memory pointed by pointer; process failure => higher-level programming languages; sanity-check pointers prior to use
  * Insecure object reference: (IDOR) exposure of reference to internal object => user authorisation; make objects harder to enumerate (e.g. random over increments)
  * Race condition: produces unexpected result when timing of actions impact other actions => careful programming; locking (at most one thread can modify database)
  * Broken authentication: brute-forcing credentials; unexpired session tokens => MFA; no default creds; password policy; delay failed attempts; session management
  * Sensitive data exposure: steal keys; MITM; steal plaintext data (server/transit/client) => data classification; secure encryption; key management; salted hashes
  * Insecure components: public exploits for known vulnerabilities => check product versions; monitor for unmaintained products (virtual patch/WAF)
  * Insufficient logging and monitoring: lack of timely response; late detection/monitoring => failure logging; centralised logs; tamper prevention; timely incident response
  * Weak or default configurations: unpatched flaws; default accounts; unprotected files => hardening; minimalistic platforms; segmentation; review & update configurations
  * Use of insecure functions:
    * strcpy: allows BOF => input validation; use secure functions