11: Enhance Application Security Capabilities

What is DNS filtering?

Blocking or redirecting DNS lookups for known-malicious or policy-violating domains, stopping the connection before it's ever made.

What is a DNS sinkhole?

A DNS server that returns a false or internal address for malicious domains, redirecting infected hosts away from command & control (C2) servers and revealing which machines are compromised.

What is DNSSEC?

Adds digital signatures to DNS records so resolvers can verify the response is authentic and unmodified. Defends against DNS spoofing and cache poisoning. It authenticates but does not encrypt.

What are DoH and DoT?

DNS over HTTPS and DNS over TLS — encrypt DNS queries so they can't be read or tampered with in transit. They protect privacy but can bypass corporate DNS filtering.

What is SPF?

Sender Policy Framework — a DNS record listing which mail servers are authorized to send mail for a domain. Receivers reject mail from unlisted servers.

What is DKIM?

DomainKeys Identified Mail — the sending server digitally signs outbound messages, and the receiver verifies the signature against a public key in DNS. Proves the message wasn't altered and came from the domain.

What is DMARC?

Builds on SPF and DKIM by telling receivers what to do when a message fails — none, quarantine, or reject — and where to send reports. Ties the checks to the visible From address.

What is a secure email gateway?

An appliance or service that filters inbound and outbound mail for spam, phishing, malware, and policy violations before delivery.

What is email sandboxing / attachment detonation?

A gateway opens suspicious attachments or links in an isolated environment to observe their behavior before releasing the message.

What is S/MIME?

Secure/Multipurpose Internet Mail Extensions — uses certificates and PKI to digitally sign and encrypt email, providing confidentiality, integrity, and non-repudiation.

What is PGP/GPG?

Pretty Good Privacy and its open implementation — encrypt and sign email using a web-of-trust model rather than a centralized PKI.

What is email banner tagging?

Automatically prepending a warning to messages from outside the organization, prompting users to treat unexpected requests with suspicion.

Why must insecure legacy protocols be replaced?

Telnet, FTP, HTTP, SNMPv1/v2, and LDAP send data and credentials in cleartext, exposing them to sniffing and on-path attacks.

What is the secure alternative to Telnet and FTP?

SSH replaces Telnet for remote administration. SFTP (over SSH) or FTPS (over TLS) replaces FTP for file transfer.

What is HTTPS, and what protocol secures it?

HTTP wrapped in TLS, encrypting web traffic and authenticating the server via its certificate. Runs on port 443.

What is SNMPv3, and how does it improve on earlier versions?

The network management protocol with added authentication, encryption, and message integrity. Earlier versions passed community strings in cleartext.

What is LDAPS?

LDAP over TLS — encrypts directory service queries and authentication traffic that plain LDAP sends in cleartext. Uses port 636.

What is IPSec, and what are AH and ESP?

A suite that secures traffic at the network layer, commonly for VPNs.

AH (Authentication Header) provides integrity and authentication only

ESP (Encapsulating Security Payload) also provides encryption

What is the difference between IPSec transport and tunnel mode?

Transport mode encrypts only the payload, leaving the original IP header — used host-to-host. Tunnel mode encrypts the entire packet inside a new one — used for site-to-site VPNs.

What is SRTP?

Secure Real-time Transport Protocol — encrypts and authenticates voice and video streams in VoIP, preventing eavesdropping on calls.

What does port selection mean in implementing secure protocols?

Choosing the correct port for the secure version of a service and blocking the insecure counterpart, so traffic can't silently fall back — for example allowing 443 and 22 while blocking 80 and 23.

What is data loss prevention (DLP)?

Detects and blocks sensitive data from leaving the organization, inspecting content against policy and stopping unauthorized transmission or copying.

What are the three DLP deployment types?

Endpoint DLP — agent on the device, controls USB, clipboard, printing.

Network DLP — inspects traffic in transit at the perimeter.

Cloud/storage DLP — scans data at rest in cloud services and file shares.

How does DLP identify sensitive data?

Pattern matching against regex (SSNs, card numbers), keyword and dictionary matching, exact file fingerprinting, and metadata or classification labels.

What actions can a DLP system take on a violation?

Alert only, block the transfer, quarantine the file, encrypt it automatically, or notify the user with a policy prompt.

Why is data classification a prerequisite for DLP (Data Loss Prevention)?

DLP can only protect data it knows is sensitive. Classifying and labeling data first tells the system which content to enforce policy on.

What is input validation?

Checking all user-supplied data against expected type, length, format, and range before processing. The primary defense against injection attacks and buffer overflows.

What are secure cookies?

Cookies flagged Secure (sent only over HTTPS), HttpOnly (unreadable by JavaScript, blunting XSS), and SameSite (restricting cross-site sending, blunting CSRF).

What is code signing?

Digitally signing software with the developer's private key so users can verify its origin and confirm it hasn't been altered since publication.

What is sandboxing in application security?

Running code in an isolated environment with restricted access to the host's files, memory, and network — used to test untrusted software and contain applications like browser tabs.

How are web servers and databases hardened?

Web servers — disable directory listing and unused modules, remove default sites, enforce TLS, run as a non-privileged account. Databases — encrypt at rest, remove default accounts and sample databases, restrict network access, apply least-privilege grants.