27. Web Application Issues — Security

CSS Optional — Paper-II, Section-B · P-II.VI.27 · CSS 2021 asked for the different security mechanisms used to encrypt the contents of a website and to explain one in detail (6 marks) — model answer in section 5 (HTTPS/TLS).

1. Goals — CIA Triad (+ more)

• Confidentiality: only authorized parties read data (encryption, access control).
• Integrity: data isn't altered undetected (hashing, digital signatures).
• Availability: service stays accessible (DDoS protection, redundancy).
• Also authentication (who you are), authorization (what you may do), non-repudiation (can't deny an action).

2. OWASP Top 10 (2021 edition)

The Open Web Application Security Project's list of the most critical web risks (check owasp.org for any newer edition):

1. Broken Access Control
2. Cryptographic Failures
3. Injection (SQL, OS command; XSS is grouped here)
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)

3. Common Attacks and Defences

SQL injection example

// VULNERABLE
$sql = "SELECT * FROM users WHERE email = '$email' AND pass = '$pass'";
// input pass:  ' OR '1'='1   -> WHERE ... AND pass = '' OR '1'='1'  -> always true

// SAFE
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);

4. Security Mechanisms for Encrypting Website Content (CSS 2021 — list)

1. HTTPS (HTTP over TLS) — encrypts all data in transit between browser and server.
2. Symmetric encryption (AES-128/256, ChaCha20) — one shared key; fast; used for bulk data.
3. Asymmetric (public-key) encryption (RSA, Elliptic-Curve) — public/private key pair; used for key exchange and digital signatures.
4. Digital certificates and PKI — X.509 certificates issued by Certificate Authorities bind a domain to a public key.
5. Hashing (SHA-256) for integrity; password hashing with salted slow algorithms (bcrypt, Argon2) — passwords are hashed, not encrypted.
6. Encryption at rest — database/disk encryption (e.g. MySQL TDE, encrypted cloud storage), encrypted backups.
7. HSTS header — forces browsers to always use HTTPS.
8. End-to-end encryption for messaging features; VPN for admin access.

5. Detailed Explanation — HTTPS / TLS

HTTPS is HTTP carried over TLS (Transport Layer Security), the successor of SSL. It provides confidentiality (encryption), integrity (message authentication codes) and authentication (certificates). Default port 443; the browser shows a padlock.

TLS handshake (simplified, TLS 1.2 style)

sequenceDiagram
    participant B as Browser
    participant S as Server
    B->>S: ClientHello (TLS versions, cipher suites, random)
    S->>B: ServerHello (chosen cipher, random) + Certificate (public key)
    B->>B: Verify certificate with trusted CA, domain, expiry
    B->>S: Key exchange (e.g. ECDHE share / encrypted pre-master secret)
    B->>B: Both sides derive the same symmetric session key
    S->>S: Derive session key
    B->>S: Finished (encrypted)
    S->>B: Finished (encrypted)
    B->>S: Encrypted HTTP request (AES)
    S->>B: Encrypted HTTP response

1. ClientHello: browser proposes TLS versions and cipher suites and sends a random number.
2. ServerHello + certificate: server picks the cipher and sends its X.509 certificate containing its public key, signed by a Certificate Authority.
3. Certificate verification: browser checks the CA signature, domain name and validity — this authenticates the server and defeats impersonation.
4. Key exchange: using asymmetric cryptography (modern: ephemeral Diffie-Hellman, ECDHE), both sides establish a shared secret without sending it over the network.
5. Session keys: both derive identical symmetric keys (e.g. AES) from the secret and randoms.
6. Finished messages confirm the handshake wasn't tampered with.
7. Encrypted data transfer: all HTTP traffic is encrypted with fast symmetric encryption and protected by integrity checks.

Why hybrid? Asymmetric crypto solves key distribution but is slow; symmetric crypto is fast — TLS uses asymmetric only to agree a symmetric key. TLS 1.3 (2018) shortens the handshake to one round trip, removes weak ciphers and makes forward secrecy mandatory.

Benefits: protects logins, card data and personal data from eavesdropping on public Wi-Fi; prevents tampering (injected ads/malware); proves site identity; required by browsers for many features; improves SEO ranking; builds user trust.

6. Other Security Best Practices

• Authentication: strong password policy, MFA, OAuth 2.0/OpenID Connect; authorization: role-based access control checked server-side.
• Security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options.
• Secure development: validate input, encode output, least privilege, keep dependencies patched, secrets outside code, security testing (SAST/DAST, penetration tests), logging and monitoring, WAF.
• Pakistan context: the Prevention of Electronic Crimes Act (PECA) 2016 criminalizes unauthorized access, data interference and electronic fraud.

---

🎯 CSS Exam Angle

For the 2021-type question: list 6–8 mechanisms briefly, then explain HTTPS/TLS in detail with the handshake diagram and the "why hybrid" point. For general security questions, use the attack → mechanism → defence table and cite OWASP.

📌 Past CSS Paper Frequency

⚠️ MCQ Traps

• Passwords are hashed (bcrypt/Argon2), not encrypted; MD5/SHA-1 are unsuitable for passwords.
• HTTPS uses port 443; HTTP uses 80.
• TLS uses asymmetric crypto for key exchange and symmetric crypto for data.
• XSS attacks users' browsers; SQL injection attacks the database; CSRF abuses a logged-in user's session.
• SSL is deprecated; modern sites use TLS 1.2/1.3.
• Client-side validation is not a security control.

---

✅ Self-Check (with Answers)

Q1. How does a prepared statement stop SQL injection?

Ans: The SQL command is sent and compiled first with placeholders; user input is sent separately as data and never parsed as SQL, so input like ' OR '1'='1 is treated as a literal string.

Q2. Differentiate XSS and CSRF.

Ans: XSS injects malicious script into a trusted site so it runs in victims' browsers (stealing data or sessions). CSRF tricks a logged-in user's browser into sending an unwanted request to a site that trusts it. Defences: output encoding/CSP for XSS; anti-CSRF tokens/SameSite cookies for CSRF.

Q3. Why does TLS use both asymmetric and symmetric encryption?

Ans: Asymmetric encryption securely establishes a shared key between strangers but is computationally slow; symmetric encryption is fast for bulk data. TLS uses asymmetric methods to agree a session key, then symmetric encryption for all traffic.

Q4. What role does a digital certificate play in HTTPS?

Ans: It binds the website's domain to its public key and is signed by a trusted Certificate Authority, letting the browser verify it is talking to the genuine server and not an impostor (preventing man-in-the-middle attacks).

Q5. Name four HTTP security headers and their purpose.

Ans: Strict-Transport-Security (force HTTPS), Content-Security-Policy (restrict script sources, mitigating XSS), X-Frame-Options (prevent clickjacking), X-Content-Type-Options: nosniff (prevent MIME-type sniffing).

Q6. Why should passwords be stored with bcrypt rather than SHA-256?

Ans: bcrypt is deliberately slow and salted, making brute-force and rainbow-table attacks expensive; fast hashes like SHA-256 can be computed billions of times per second by attackers.

📜 Past-Paper Questions & MCQs (CSS 2016–2026)

2021 · Paper-II · Q8(c) and 2025 · Paper-II · Q8(b) · 6 marks

Q. What are the different security mechanisms used for encrypting the contents of a website? Explain any one in detail.

Ans.

• Mechanisms:
  • SSL/TLS (HTTPS): encrypts data between browser and server.
  • Symmetric encryption (AES): one shared secret key, fast, used for the data itself.
  • Asymmetric (public-key) encryption (RSA, ECC): a public and a private key, used for key exchange and signatures.
  • Hashing (SHA-256, bcrypt) for passwords and integrity.
  • Digital signatures and certificates (PKI) to prove identity.
  • Database and file encryption at rest, VPNs, and HSTS and secure cookies.
• TLS in detail (the basis of HTTPS):
  • Step 1 · Client Hello: the browser sends its supported TLS versions and cipher suites and a random number.
  • Step 2 · Server Hello and certificate: the server chooses a cipher suite and sends its digital certificate (with its public key), signed by a Certificate Authority.
  • Step 3 · Authentication: the browser checks the certificate (trusted CA, valid date, matching domain).
  • Step 4 · Key exchange: using public-key cryptography (RSA or Diffie-Hellman), both sides create a shared session key.
  • Step 5 · Secure session: all further data is encrypted with the fast symmetric session key (such as AES) and protected by a message authentication code.
• What TLS gives: confidentiality (nobody can read the data), integrity (nobody can change it unseen) and authentication (you are talking to the real server).
• Where to see it: the padlock and https:// in the browser.