Understanding Application Security, Threats, and Attacks
Domain 1: Understanding Application Security, Threats, and Attacks
This domain tests whether you can identify an application's assets, the actors and conditions that endanger them, and the controls that reduce exposure. Expect questions that separate a threat from a vulnerability and a risk, and that ask you to choose a control appropriate to a specific attack class.
Core rules and concepts
- Confidentiality, integrity, and availability are the security goals for assets; authentication, authorization, accountability, and non-repudiation support them.
- A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited; risk combines likelihood and impact in a given context.
- Attack surface includes entry points, APIs, files, dependencies, credentials, and trust boundaries. Reducing it is a design decision, not only a testing task.
- Common application attacks include injection, cross-site scripting, cross-site request forgery, broken access control and IDOR, SSRF, insecure deserialization, and supply-chain compromise.
- Threat modeling identifies assets, actors, entry points, trust boundaries, and mitigations; STRIDE is a mnemonic for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
- Defense in depth assumes a control can fail; least privilege limits what a successful attack can do.
Worked example
A login form builds SQL by concatenating the submitted username. The asset is account access; the threat is an attacker seeking unauthorized login; the vulnerability is unsafe query construction; the risk is account takeover, especially for administrative accounts. Input validation alone is weaker than parameterized queries because the database still receives executable syntax. A sound answer uses parameterized queries, validates and length-limits input, stores password hashes with a modern password-hashing function, applies least privilege to the database account, and logs failed attempts without recording passwords.
Traps that cost marks
Do not call a missing patch a threat; it is a vulnerability. Do not say HTTPS removes injection. Do not treat client-side validation as a security boundary. Do not label every risk high without context. Do not confuse an attack technique with the weakness it exploits.