130k views
4 votes
After analyzing code, two developers at a company bring these samples to the security operations manager:

Example Language: Java
# Java Web App ResourceBundle properties file
...
.username=secretUsername
webapp...
...

Which of the following would BEST solve these coding problems?

A. Use a privileged access management system
B. Prompt the administrator for the password
C. Use salted hashes with PBKDF2
D. Increase the complexity and length of the password

User Beezz
by
8.7k points

1 Answer

4 votes

Final answer:

The best way to solve the Java coding security issue is by implementing a privileged access management system and using salted hashes with PBKDF2 to secure stored passwords. Increasing password complexity doesn't address the core issue of insecure storage.

Step-by-step explanation:

The question pertains to how to resolve a coding security issue found in a Java web application's properties file where a username is stored in plaintext. The best solution in this context would involve improving security measures within the code to protect sensitive information.

To address this problem, the developers should consider the use of a privileged access management system (Option A). This system would manage and audit user access, ensuring only authorized users can retrieve sensitive information, like usernames and passwords. Option B, prompting the administrator for the password, is more of a real-time security practice but does not resolve the underlying issue of storing sensitive information insecurely. Option C, using salted hashes with PBKDF2, is a robust method of storing passwords securely by adding a unique salt to each password before hashing it, making them difficult to crack. Finally, Option D, increasing the complexity and length of the password, may deter some attackers but does not address the fundamental problem of storing sensitive data insecurely.

It is recommended that the developers implement a strategy that includes securing sensitive data using best practices like PBKDF2 with salted hashes and potentially integrating a privileged access management system.

User Itzmekhokan
by
8.2k points