ISC2 CISSP (Certified Information Systems Security Professional)Software Development SecurityMedium
A security architect is reviewing the design of a new critical financial application. The application will process high-value transactions and is being developed using a complex object-oriented programming language. To ensure the integrity and confidentiality of sensitive data within the application's memory, which secure coding principle is MOST relevant to prevent data exposure through memory management flaws?
- APracticing secure memory deallocation and overwriting sensitive data.
- BEnsuring proper error handling and logging mechanisms.
- CImplementing robust input validation and sanitization.
- DUtilizing parameterized queries to prevent SQL injection.
Show answer & explanationAnswer & explanation
Correct answer: A. Practicing secure memory deallocation and overwriting sensitive data.
Memory deallocation and overwriting sensitive data (e.g., cryptographic keys, passwords) after use are crucial for preventing data exposure through memory dumps, buffer overflows, or use-after-free vulnerabilities. This directly addresses the integrity and confidentiality of data within the application's memory.
Why the other options are wrong
- B. Error handling is important for application stability and security but doesn't specifically prevent sensitive data from lingering in memory.
- C. Input validation prevents injection attacks but does not directly address memory management issues or data exposure in memory.
- D. Parameterized queries protect against SQL injection, a database-related vulnerability, not memory management within the application itself.
Secure Memory Management
Practices to protect sensitive data stored in application memory, including proper allocation, deallocation, and overwriting of data when no longer needed.
- Prevents sensitive data from lingering in memory after use.
- Mitigates risks like memory dumps, buffer over-reads, and use-after-free.
- Involves zeroing out or overwriting memory regions containing secrets.
Memory trick: Memory leaks are like forgotten secrets; wipe them clean.