1. It is critical to perform a penetration test on a web application prior to production implementation in order to catch any issues before the application hits the internet and open to malicious attacks.
2. A cross-site scripting attack enables attackers to inject client-side script into web pages viewed by other users.
3. A reflective XSS attack the attack is in the request itself or the URL.
4. The common method of obfuscation used in most real world SQL attacks are methods, including character scrambling and masking, numeric variance and nulling, rely on an array of built-in SQL Server system functions that are used for string manipulation.
5. SQL injections is the most prone to extract privacy data elements out of a database.
6. If I could monitor when SQL injections are performed on an SQL database I would recommend well-coordinated and regularly audited security checks as a security countermeasure to monitor the production SQL database.
7. To identify known software vulnerabilities and exploits on IIS and apache I would create a policy that involves regular audits, penetration tests, and constant monitoring.
8. To ensure that my organization incorporates penetrating testing and web application testing as part of its implementation procedures I would include these in my policy and ensure that all security staff know that these are requirements.
9. Some other security countermeasures that I recommend for web sites and web application deployment to ensure the C-I-A of the web application are:
• Regular security audits
• Penetration testing
• Security awareness training
• ADS/IDS
• Use of a DMZ
• Strict access policies
10. The security team or CIO is responsible and accountable for the CIA of production web applications and web servers.