CISSP 21.7 - Application Security Controls

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series pivots from attacks to the controls that stop them within Domain 8. It walks through the safeguards a security professional actually recommends and audits, from server-side input validation and web application firewalls to database protection, safeguarding the code itself, and resilient design.

Frequently Asked Questions

How does input validation shut down bad input?

Input validation is your single most important application defense, because so many attacks begin with untrusted input. The strongest form is allow listing, where you define exactly what valid input looks like and reject everything else; when the valid set is too varied, you fall back to block listing the dangerous patterns, though it is easier to slip past. One rule is non-negotiable: validation must run on the server, never only in the browser, because client-side checks are trivial to bypass.

Why do metacharacters and parameter pollution complicate validation?

Some characters carry special programmatic power, like quotes, semicolons, and ampersands, and attackers exploit that power to break out of data and into code. The countermeasure is escaping, marking such a character as ordinary so it loses its meaning. But parameter pollution sneaks past filters by sending two values for the same input, betting the platform validates one and executes the other. No single filter is perfect, so you layer controls and keep platforms patched.

What is a web application firewall for?

A web application firewall adds a protective layer in front of your web server. Unlike a network firewall, it works at the application layer, inspecting the actual content headed to your app. It receives all incoming traffic, applies validation using allow lists or block lists, and blocks malicious requests before they reach the server. It does not replace secure coding, since applications still contain flaws, but it catches a great deal on the way in.

How do you keep a database from betraying its data?

Two ideas matter. First, defend the queries: parameterized queries and stored procedures separate code from data so user input can never be executed as a command, which defeats injection. Second, defend the data itself: data minimization is strongest because you cannot lose what you never held, tokenization swaps a real identifier for a random stand-in with a guarded lookup table, and hashing replaces a value with an irreversible fingerprint made tougher by salting.

How do you build applications that scale without breaking?

Resilient design relies on two related properties. Scalability means an application can take on more resources as demand grows, either by beefing up an existing instance, called scaling up, or by adding more instances to a pool, called scaling out. Elasticity goes further and does this automatically, provisioning resources when load rises and releasing them when it falls, which controls both performance and cost. These traits are hallmarks of cloud platforms.

Reference: This article is based on concepts discussed in CISSP 21.7 - Application Security Controls.