20. A company's internet-facing web application has been compromised several times due to identified design flaws. The company would like to minimize the risk of these incidents from recurring and wants to shift left. Which of the following are the best options to help identify flaws within the system? (Select two)
Answer: C,F
Contracting a penetration test and implementing threat modeling are the best options to help identify flaws within the system.
Both contracting a penetration test and implementing threat modeling are proactive strategies that can significantly enhance the identification of design flaws within a web application.
A) Deploying a WAF
Deploying a Web Application Firewall (WAF) is primarily a defensive strategy aimed at filtering and monitoring HTTP traffic to and from a web application. While it may help mitigate certain threats, it does not actively identify design flaws or vulnerabilities within the application itself.
B) Performing a forensic analysis
Performing a forensic analysis is typically a post-incident activity that investigates security breaches to determine how they occurred. While it can provide insights into existing vulnerabilities, it does not proactively identify new design flaws before they can be exploited.
C) Contracting a penetration test
Contracting a penetration test is an effective approach to identifying vulnerabilities within a system by simulating attacks on the application. This method allows the company to understand potential weaknesses in their design and implement necessary fixes before a real attack occurs.
D) Holding a tabletop exercise
Holding a tabletop exercise is a valuable training and planning activity that helps teams prepare for incident response scenarios. However, it does not directly identify design flaws within the application, making it less effective in this context.
E) Creating a bug bounty program
Creating a bug bounty program encourages external security researchers to identify vulnerabilities in the system. While it can lead to the discovery of flaws, it relies on external participants and is not a proactive measure like threat modeling or penetration testing.
F) Implementing threat modeling
Implementing threat modeling is a systematic approach to identifying potential threats and vulnerabilities during the design phase of an application. By analyzing the architecture and design, it allows teams to address potential flaws early in the development process.
Conclusion
Both contracting a penetration test and implementing threat modeling are integral to effectively identifying and addressing design flaws in a web application. While other options may contribute to security, they do not provide the same proactive insights necessary for minimizing risks related to design vulnerabilities.