Application Security

Broken Access Control vulnerabilities exist when a user can access resource or perform an action that they are not supposed to be able to access or do.

A Brute Force password attack is a method of accessing a secured device or application by attempting multiple combinations of accepted character sets of usernames and\or passwords, using guessing tools and scripts, in order to try all the combinations of well-known usernames and passwords.

Business logic vulnerabilities are design and implementation flaws in applications that allow attackers to manipulate legitimate functionality to achieve malicious goals, such as bypassing security controls, stealing data, or gaining unauthorized access.

Cache keys are parts of an HTTP request that the cache will use to uniquely identify a response.

Cache poisoning refers to a security vulnerability where invalid entries can be placed into a cache, which are then assumed to be valid when later used.

API security solutions discover, test, and protect APIs from abuse and business logic attacks. Best for: runtime WAAP protection (Radware), enterprise behavioral defense (Salt Security), edge-scale coverage (Akamai), and CI/CD testing (StackHawk).

The CIA Triad is a model for the development of security policies used in identifying problem areas, along with necessary solutions in the arena of information security.