| Database Security Vulnerabilities | Prevention, Detection, and Response Techniques for Yahoo.com |
| Potential SQL Injection Vulnerability for SQL Database | Database Backend and Front End Content Managent |
| (Yahoo records) Public Users | Threat Vector: Attacker crafts an SQL statement to retrieve records from Yahoo database example: SELECT * FROM Users WHERE UserId = 105 OR 1=1; |
| Content Management Engine | Mitigation Procedure: Parameterized Querys and Sanitization, Whitelist Input Validation |
| Cloud Data Spoofing | Cloud DMZ and ISP Network Configurations |
| Network Traffic Redirect of valuable cloud information | Threat Vector: Cloud Storage For user Access may be spoofed by an attacker and this may lead to data being written to the attacker's target instead of Cloud Storage For user Access |
| ISP and DMZ Routers are misconfigured | Mitigation Procedure: Standard authentication mechanism to identify the destination data store. Black list of BOGON IP's with IPS logging and session sniping |
| Denial Of Service | Bandwidth Constraints and Traffic Redirection |
| Excessive Resource Consumption for Yahoo Inc Webserver | Threat Vector: External user(s) accessing Yahoo servers may consuming CPU resources and Bandwidth, the Hardware and software resources are insufficient or misconfigured |
| | Mitigation Procedure: Load Balancing and testing load capacity i.e. concurrent connections consuming normal resources. Upgrade Hardware and use different paths of last resort for external users to retrieve resources when resources become scarce |
| Privilege Escalation | Authenication Systems, Methods, and Security Control types |
| Elevation of Privilege | Threat Vector: Yahoo Inc Webserver External Users may be able to impersonate the context of Authentication Mechinism Provider External Users in order to gain additional privilege |
| Entire Network Infrastructure | Mitigation Procedure: Upgrade and or Harden existing authentication mechnisms to include two factor authentication and stronger passwords. Enforce least privilege and log/alert Administrative account access |