Secure Coding Techniques for Password Validation | Exam SY0-601: CompTIA Security+

Addressing Security Best Practices for Password Validation

Prev Question Next Question

Question

Upon entering an incorrect password, the logon screen displays a message informing the user that the password does not match the username provided and is not the required length of 12 characters.

Which of the following secure coding techniques should a security analyst address with the application developers to follow security best practices?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

B.

The secure coding technique that needs to be addressed with the application developers is error handling (option B).

Error handling is an essential part of any software development process, as it helps to ensure that the application behaves as intended and is secure. In this scenario, the logon screen is displaying sensitive information (i.e., the password is not the required length of 12 characters), which could be used by an attacker to gain unauthorized access to the system. This type of error message provides valuable information to an attacker and could be used to launch a brute-force attack on the account.

As a best practice, error messages should be generic and not reveal any sensitive information about the application or the user. In this case, the error message should simply state that the password is incorrect without providing any additional information about the length of the password or the username. This would help to prevent attackers from using this information to gain unauthorized access to the system.

Input validation (option A) is another secure coding technique that is used to ensure that user input is correct and safe for the application to process. While input validation is important for security, it is not directly related to the issue described in the scenario.

Obfuscation (option C) is a technique used to make code more difficult to understand or reverse-engineer. While this technique can be used to improve security, it is not related to the issue described in the scenario.

Data exposure (option D) refers to the unauthorized disclosure of sensitive data. While this is a serious security issue, it is not related to the issue described in the scenario.