ISC2 CISSP Exam - Topic 3 Question 103 Discussion

Adding a new rule to the application layer firewall is the most suited to quickly implement a control for an input validation and exception handling vulnerability on a critical web-based system. An input validation and exception handling vulnerability is a type of vulnerability that occurs when a web-based system does not properly check, filter, or sanitize the input data that is received from the users or other sources, or does not properly handle the errors or exceptions that are generated by the system. An input validation and exception handling vulnerability can lead to various attacks, such as:

Injection attacks, such as SQL injection, command injection, or cross-site scripting (XSS), where the attacker inserts malicious code or commands into the input data that are executed by the system or the browser, resulting in data theft, data manipulation, or remote code execution.

Buffer overflow attacks, where the attacker sends more input data than the system can handle, causing the system to overwrite the adjacent memory locations, resulting in data corruption, system crash, or arbitrary code execution.

Denial-of-service (DoS) attacks, where the attacker sends malformed or invalid input data that cause the system to generate excessive errors or exceptions, resulting in system overload, resource exhaustion, or system failure.

An application layer firewall is a device or software that operates at the application layer of the OSI model and inspects the application layer payload or the content of the data packets. An application layer firewall can provide various functions, such as:

Filtering the data packets based on the application layer protocols, such as HTTP, FTP, or SMTP, and the application layer attributes, such as URLs, cookies, or headers.

Blocking or allowing the data packets based on the predefined rules or policies that specify the criteria for the application layer protocols and attributes.

Logging and auditing the data packets for the application layer protocols and attributes.

Modifying or transforming the data packets for the application layer protocols and attributes.

Adding a new rule to the application layer firewall is the most suited to quickly implement a control for an input validation and exception handling vulnerability on a critical web-based system, because it can prevent or reduce the impact of the attacks by filtering or blocking the malicious or invalid input data that exploit the vulnerability. For example, a new rule can be added to the application layer firewall to:

Reject or drop the data packets that contain SQL statements, shell commands, or script tags in the input data, which can prevent or reduce the injection attacks.

Reject or drop the data packets that exceed a certain size or length in the input data, which can prevent or reduce the buffer overflow attacks.

Reject or drop the data packets that contain malformed or invalid syntax or characters in the input data, which can prevent or reduce the DoS attacks.

Adding a new rule to the application layer firewall can be done quickly and easily, without requiring any changes or patches to the web-based system, which can be time-consuming and risky, especially for a critical system. Adding a new rule to the application layer firewall can also be done remotely and centrally, without requiring any physical access or installation on the web-based system, which can be inconvenient and costly, especially for a distributed system.

The other options are not the most suited to quickly implement a control for an input validation and exception handling vulnerability on a critical web-based system, but rather options that have other limitations or drawbacks. Blocking access to the service is not the most suited option, because it can cause disruption and unavailability of the service, which can affect the business operations and customer satisfaction, especially for a critical system. Blocking access to the service can also be a temporary and incomplete solution, as it does not address the root cause of the vulnerability or prevent the attacks from occurring again. Installing an Intrusion Detection System (IDS) is not the most suited option, because IDS only monitors and detects the attacks, and does not prevent or respond to them. IDS can also generate false positives or false negatives, which can affect the accuracy and reliability of the detection. IDS can also be overwhelmed or evaded by the attacks, which can affect the effectiveness and efficiency of the detection. Patching the application source code is not the most suited option, because it can take a long time and require a lot of resources and testing to identify, fix, and deploy the patch, especially for a complex and critical system. Patching the application source code can also introduce new errors or vulnerabilities, which can affect the functionality and security of the system. Patching the application source code can also be difficult or impossible, if the system is proprietary or legacy, which can affect the feasibility and compatibility of the patch.