A security audit of a legacy financial data synchronization service reveals two key architectural flaws: bulk transaction records are encrypted using AES in Electronic Codebook (ECB) mode, and API client connections are allowed based solely on internal IP address ranges without individual user or service authentication. Which of the following security control and cryptographic weaknesses are present in this system? (Select TWO).
- Identical plaintext blocks produce identical ciphertext outputs, allowing eavesdroppers to infer structural patterns in encrypted data.Cevap
- BBulk data encryption performance is severely degraded because asymmetric key algorithms were selected for payload encryption instead of symmetric ciphers.
- Implicit trust based on network location creates an architectural vulnerability by bypassing continuous identity authentication.Cevap
- DThe trust chain is broken because the public key certificate was requested prior to generating the private key and Certificate Signing Request (CSR).
Cevap
The two weaknesses present are: (1) Identical plaintext blocks produce identical ciphertext outputs in ECB mode, exposing structural patterns, and (2) Implicit trust based on network location bypasses explicit identity authentication.
The system exhibits two distinct weaknesses. First, AES in Electronic Codebook (ECB) mode encrypts each plaintext block independently using the same key without randomized initialization vectors, causing identical plaintext blocks to produce identical ciphertext and revealing structural patterns in bulk payloads. Second, authenticating API connections using internal IP subnets relies on implicit network location trust rather than explicit identity authentication, creating a severe control weakness by allowing lateral movement if the internal network is breached.
Adım Adım Çözüm
Anahtar Kavram
Electronic Codebook (ECB) cipher mode pattern leakage and perimeter-based implicit network location trust vulnerabilities.