Vulnerability Management
& Application Security

Exam review: Lessons 8 and 11
recap with Security+ SY0-701
practice questions.

Operating systems

Every operating system has its weak spot

Windows · massive install base makes it a top target; buffer overflows, input validation and privilege flaws

macOS · UNIX roots affect access controls and secure boot; "safer" reputation breeds complacency

Linux · kernel flaws and misconfigurations matter because it runs the cloud

Mobile · Android fragmentation; iOS targeted by nation-states; rooting, jailbreaking and sideloading weaken protections

Legacy/EOL · Windows 7 and Server 2008 get no security updates

Real world: WannaCry ransomware used the EternalBlue exploit in 2017; MS08-067 spread Conficker in 2008.

Below the operating system

Below the OS: firmware, VMs and zero-days

Firmware

Meltdown and Spectre impacted nearly all modern processors.

LoJax (2018)

First UEFI rootkit in the wild; persists even after a hard drive replacement.

VM escape

Code breaks out of a VM to reach the host, e.g. VMware "Cloudburst".

Zero-day

Unknown flaw, no patch. Stuxnet used four zero-days to damage Iranian nuclear centrifuges.

Small settings, huge breaches: misconfiguration, cloud and crypto

100M+

Capital One: a misconfigured firewall let an attacker reach an S3 bucket, exposing data of over 100 million customers.

Misconfiguration · default credentials ("admin/admin") and overly permissive cloud storage buckets

Cloud attacks · side-channel exploits, cryptojacking, Shared Responsibility Model gaps

Crypto · MD5, SHA-1, DES are insecure; use AES and SHA-256

Application attacks

Application attacks to recognize on sight

Buffer overflow / memory injection

Redirects execution to malicious shellcode.

Race condition / TOCTOU

Attacker acts in the gap between check and use. Example: Dirty COW in Linux.

XSS

Reflected, stored, DOM-based. The Samy worm (stored XSS) infected over a million MySpace accounts in 20 hours.

SQL injection

e.g. ' OR 1=1#. Heartland (2008) lost 130 million cards and over $140 million.

Supply chain

Trusted code can be the attack: the supply chain

Malicious updates · CCleaner (2017) and SolarWinds (2020) used legitimate update channels to distribute backdoors

Log4Shell (2021) · a flaw in a tiny logging library affected billions of devices

Shellshock (Bash) and Heartbleed (OpenSSL) · library flaws that could compromise millions of systems

The defense: SBOM

An inventory of all components to find and patch vulnerable third-party libraries.

Identification and analysis

Find it, then score it

Scan

OpenVAS and Nessus find missing patches and misconfigurations.

Gather intel

Threat feeds: IBM X-Force Exchange, AlienVault OTX. OSINT: Shodan and Maltego reveal exposed devices and threat networks.

Pen test

Human ingenuity finds chained flaws and logic errors scanners miss.

Prioritize

Score with CVSS to rank remediation.

0–10

CVSS score range used to prioritize remediation

Remediation and secure apps

Fix it and build it right

Remediate

Patching, network segmentation, compensating controls.

Secure protocols

HTTPS replaces HTTP, SSH replaces Telnet, SFTP replaces FTP.

Email

SPF authenticates senders, DKIM checks integrity, DMARC prevents forgery.

Input validation

Allowlisting, type checking, encoding; prepared statements stop SQLi.

SAST vs DAST

SAST examines source code before execution; DAST tests the running app.

Self-test · cover the answers

Practice questions: Part 1

A web form accepts ' OR 1=1# and returns every user record. Which attack is this, and the best mitigation?

Answer: SQL injection; parameterized queries

A company still runs Server 2008 on a critical system. What vulnerability type is this?

Answer: Legacy / end-of-life system with no security updates

Malware survives a full OS reinstall and drive replacement. Where does it most likely live?

Answer: Firmware (UEFI), as with LoJax

Self-test · cover the answers

Practice questions: Part 2

An analyst needs to rank 400 scan findings by severity. What should they use?

Answer: CVSS scores

Which control helps a team quickly find every app using a vulnerable library like Log4j?

Answer: A software bill of materials (SBOM)

A developer wants to test code for flaws before it is ever run. SAST or DAST?

Answer: SAST