Certified Incident Handler (CIH) Practice Ecam

Which of the following practices will not help in eradicating web application incidents?

1. Use custom error pages to protect web applications

2. Implement proper session management

3. Utilize input validation

4. Regularly update software and dependencies

The correct answer is: Use custom error pages to protect web applications

Using custom error pages is a practice that primarily focuses on user experience and security through obscurity, rather than eradicating web application incidents. Custom error pages can help prevent the disclosure of sensitive information about the web server or application, but they do not directly address vulnerabilities or systematically mitigate the risks that lead to incidents such as injection attacks, session hijacking, or other common web application exploits. On the other hand, proper session management is crucial for maintaining user sessions securely and minimizing the risk of session-related attacks. Utilizing input validation helps ensure that all incoming data is checked and sanitized, significantly reducing the risk of attacks that exploit improper handling of user input, such as SQL injection or cross-site scripting. Regularly updating software and dependencies is vital for patching vulnerabilities and ensuring that the application runs on the latest, most secure version, minimizing potential exploit opportunities. Thus, while custom error pages can enhance security by preventing information leakage, they do not actively contribute to eliminating the root causes of web application incidents compared to the other options listed.