M7A2 Lab.docx - 1 M7A2 Lab: Designing the Secure Database...

1
M7A2 Lab: Designing the Secure Database
Christapher M. Bess
Excelsior College
CYS470
Laurel Schneider
20 June, 2021

2
I will identify the High-level findings that begin with Cleartext Password over HTTP, 2 cross site
scripting, Session Cookie Without HttpOnly Flag, and Session Cookie Without Secure Flag.
Passwords should never be sent over an insecure channel without being encrypted end to end as
well establishing a distinctive hash that can be verified on both ends. This will be rectified by
only sending passwords to HTTPS targets. Having any level of password out in the open allows
for a malicious actor to have an open door into the system. Wreaking havoc as they see fit, as
well depending on the level of access gaining administrative control and locking anyone else out.
The following cross site scripting findings are also a part of the unsecure password and
information transfer that is asking for log in credentials in an insecure location and the then
allowing user input. These are simple to correct by knowing the language and platform
techniques to filter the untrustworthy data. By allowing this the malicious actor can input code