GIAC Foundational Cybersecurity Technologies Practice Test

What makes a web application particularly vulnerable to CSRF?

1. The use of session-based authentication

2. Having no CSRF protection in place

3. Using strong security certificates

4. Poor database management

The correct answer is: Having no CSRF protection in place

A web application is particularly vulnerable to Cross-Site Request Forgery (CSRF) when it lacks proper CSRF protection mechanisms. CSRF exploits the trust that a web application has in a user's browser. When a user is authenticated and uses their session, malicious sites can send unauthorized requests to the web application on behalf of the user if the application does not have measures in place to check the legitimacy of those requests. This vulnerability arises because, without CSRF protection, the web application cannot differentiate between legitimate requests from the user and forged requests initiated by an attacker. CSRF protection strategies typically involve the use of anti-CSRF tokens, which are secret, unpredictable values that are included in user interactions. If these tokens are missing or not validated by the web application, it becomes susceptible to this type of attack. The other options relate to security features or practices that do not directly cause CSRF vulnerabilities. For instance, session-based authentication can be secure if combined with proper CSRF defenses, while strong security certificates enhance the security of data in transit but do not prevent CSRF attacks. Poor database management, while critical to overall security, does not directly impact an application's susceptibility to CSRF specifically.