JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV Year WEB SECURITY Previous Question Paper (February/March - 2022 - R18)

A web security problem refers to any vulnerability, threat, or attack vector that compromises the confidentiality, integrity, or availability of web-based applications, services, and their underlying data. These problems arise because web applications are exposed to the public internet, making them accessible to malicious actors who exploit flaws in code, server configurations, or user authentication mechanisms.

Key aspects include:

• Vulnerabilities: Weaknesses in software design or implementation, such as SQL Injection, Cross-Site Scripting (XSS), or insecure direct object references.
• Threats: Potential actions by attackers, such as unauthorized data access, session hijacking, or denial-of-service (DoS) attacks.
• Impact: The consequences of a security breach, including financial loss, theft of sensitive user information (PII), loss of reputation, and legal liability.

Legal restrictions on cryptography are governed by national and international regulations aimed at balancing individual privacy with national security and law enforcement requirements. These restrictions typically fall into several categories:

• Export Controls: Many countries, including those under the Wassenaar Arrangement, restrict the export of strong cryptographic software and hardware to prevent potential adversaries from accessing advanced encryption tools that could hinder intelligence gathering.
• Import Restrictions: Some nations limit the import of encrypted devices or software to ensure that local authorities can monitor communications or to protect domestic cryptographic industries.
• Key Escrow and Lawful Access: Governments may mandate that cryptographic systems include "backdoors" or key escrow mechanisms, allowing law enforcement agencies to decrypt communications with a legal warrant.
• Usage Regulations: Certain jurisdictions regulate the strength of encryption allowed for commercial use, sometimes prohibiting the use of high-bit-length encryption without specific government authorization or licensing.

These restrictions create a constant tension between the need for robust cybersecurity to protect digital infrastructure and the government's desire for oversight of encrypted traffic.