Apps & Data Security · 5.1
💉 Application & Data Vulnerabilities
SQL injection, XSS, and buffer overflow — how attackers exploit broken applications⏱ ~3 min
The Three States of Data
| State | Definition | Risks | Protections |
|---|---|---|---|
| Data at Rest | Stored on a device, server, or backup — not currently moving or being used | Device theft, storage media loss, unauthorized access to files | Full-disk encryption (BitLocker, FileVault), access controls, physical security |
| Data in Transit | Moving across a network — being sent from one place to another | Interception, man-in-the-middle, packet capture on open WiFi | TLS/HTTPS encryption, VPN, certificate validation |
| Data in Process | Actively being used — decrypted in RAM, displayed on screen, in clipboard | Memory scraping, screen capture, clipboard hijacking, process injection | Lock screen when away, minimize clipboard use of sensitive data, trusted software only |
⚠ WarningCommon misconception: 'HTTPS protects my files.' HTTPS only protects data in transit between your browser and the web server. It does NOT protect data at rest on your device. A stolen unencrypted laptop exposes all stored files regardless of whether the websites you visited used HTTPS.
SQL Injection — The #1 Web Application Attack
📝SQL injection: turning a form into a database command
A login form expects you to type your username. Instead, you type: admin' OR '1'='1. The application builds the SQL query by concatenating your input directly into the code. The single quote closes the intended string, 'OR 1=1' makes the condition always true, and the comment (--) removes the rest of the query. The database returns all records, granting access without a valid password. The root cause: user input was treated as code, not as data.
Three Major Application Attack Types
| Attack | How It Works | CIA Impact | Prevention |
|---|---|---|---|
| SQL Injection (SQLi) | Malicious SQL inserted into form fields or URL parameters; database executes attacker's commands | C: data theft; I: data modification/deletion; A: can delete entire database | Parameterized queries (prepared statements); input validation; least-privilege DB accounts; WAF |
| Cross-Site Scripting (XSS) | Attacker injects malicious JavaScript into a web page; victim's browser executes it | C: cookie theft (session hijacking); I: page defacement; A: page crash; affects all users who view the page | Output encoding; Content Security Policy (CSP); input sanitization; HttpOnly cookie flag |
| Buffer Overflow | Attacker sends more data than a program's buffer can hold; overflow corrupts adjacent memory | C: memory leakage reveals secrets; I: attacker overwrites return address to run their code; A: crashes the program | Safe languages (Go, Rust); bounds checking; ASLR; stack canaries; DEP/NX bit |
Data Classification & Legal Protections
- •PII (Personally Identifiable Information) — name, SSN, birthdate, phone, email, address; any data that identifies a specific individual
- •HIPAA — Health Insurance Portability and Accountability Act; protects medical records and health information; violations can result in $100–$50,000 per violation
- •FERPA — Family Educational Rights and Privacy Act; protects student education records (grades, transcripts, attendance); schools risk losing federal funding for violations
- •PCI-DSS — Payment Card Industry Data Security Standard; mandates protection of credit/debit card data; required for any business that processes card payments
- •Data classification levels: Public → Internal → Confidential → Restricted — each level requires stronger access controls, encryption, and monitoring
★ FactThe Equifax breach (2017) exposed SSNs, birthdates, addresses, and driver's license numbers for 147 million Americans. Root cause: a known Apache Struts vulnerability (CVE-2017-5638) that had a patch available for 2 months before exploitation. Equifax's vulnerability scanning missed the unpatched server. The company paid $575 million in FTC settlements. A single patch would have prevented one of the largest data breaches in history.
🧠Quick Checkfirst try = +5 XP
A student's school has a web-based grade portal. A malicious student enters the following into the 'Student ID' search field: 1 OR 1=1; DROP TABLE grades;-- . If the application is vulnerable to SQL injection, what are the potential impacts on the CIA triad?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days