Computer Security Applicationsintermediate
Explain how parameterized queries, least privilege, and security logging contribute differently to reducing the risk of a database-backed web application.
Answer
Parameterized queries separate user values from query instructions and prevent input from changing query structure. Least privilege limits the actions available to the application's database account if it is compromised. Security logging records relevant events so suspicious activity can be reviewed and investigated. These controls address prevention, impact limitation, and detection respectively.
Explanation
### What a good answer covers
- Explain that parameterized queries keep user values separate from database instructions.
- State that least privilege limits the database account's permissions to what the application needs.
- Describe logging as a record that supports review and investigation of suspicious events.
- Distinguish prevention, impact limitation, and detection as different control roles.
### Terms
- **Parameterized query**: a query that supplies input values separately from its instructions.
- **Least privilege**: limiting an account to the permissions required for its work.
- **Security logging**: recording events that can be reviewed to identify suspicious activity.
### Remember
One control prevents a flaw, another limits damage, and another helps identify activity.
Related Questions
- A database-backed application needs to stop showing detailed database errors to ordinary users while retaining information for investigation. Which approach best matches the lesson?(intermediate)
- Regular security audits and penetration tests can help identify and fix application weaknesses before attackers exploit them.(basic)
- A Web Application Firewall (WAF) should be treated as a replacement for secure query construction.(basic)
- A database account should have only the permissions required for its task. This is the principle of _____.(basic)
- In blind Structured Query Language (SQL) injection, the attacker cannot directly see the result and instead infers information from application behavior.(basic)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free