Certified Cloud Security Professional (CCSP)Cloud Application SecurityEasy
A cloud application development team is implementing a new feature that allows users to upload profile pictures. They need to implement a mechanism to prevent malicious files from being uploaded and processed by the application. Which of the following is the MOST effective control to implement at the upload stage?
- AStore all uploaded files directly in a publicly accessible S3 bucket.
- BImplement server-side content-type validation and file signature checks.
- CRely solely on client-side file type validation.
- DUse a Web Application Firewall (WAF) to block all 'image' file extensions.
Show answer & explanationAnswer & explanation
Correct answer: B. Implement server-side content-type validation and file signature checks.
Server-side content-type validation ensures the file type declared by the client is checked, and file signature (magic number) checks verify the actual file format, making it much harder for malicious files to masquerade as benign ones. This combines two strong server-side checks.
Why the other options are wrong
- A. Storing files directly in a publicly accessible bucket without proper validation and access control creates a significant security vulnerability.
- C. Client-side validation is easily bypassed by an attacker and is not a sufficient security control.
- D. Blocking all 'image' file extensions is an overreach that would prevent legitimate functionality and is not a precise method for detecting malicious content within images.
Secure File Uploads
Implementing robust server-side validation and sanitization processes to prevent malicious files from being uploaded, stored, or executed within a cloud application, protecting against various attack vectors.
- Always validate on the server side, not just client side.
- Check both file name/extension and actual content (magic numbers).
- Scan for malware and restrict execution permissions.
Memory trick: Don't trust the sender; check the package inside and out on arrival.