You are managing a cloud-based social media application that has been flagged for multiple security issues. During an assessment, you discover that…

The most effective and fundamental method to mitigate vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection is to address them at the source: in the application's code. Implementing strong input validation ensures that any data received by the application conforms to expected formats and values, rejecting malicious payloads. Output encoding ensures that data sent back to the user's browser is treated as text rather than executable code, neutralizing XSS attacks. This approach fixes the root cause of the vulnerabilities, providing a more robust and reliable defense than external or detective controls.

B. A WAF is a valuable defense-in-depth layer, but it is a compensating control that can be bypassed and is not as effective as fixing the underlying code flaw.

C. Security scanning is a detective control used to find vulnerabilities. It identifies problems but does not mitigate or fix them.

D. Updating dependencies is critical for patching known vulnerabilities in third-party libraries but does not fix custom code flaws like XSS or SQLi in the application itself.

1. OWASP Foundation. (2021). OWASP Top 10:2021. A03:2021-Injection. The primary prevention guidance is to use safe APIs and perform server-side input validation. For XSS (now part of the Injection category), it recommends encoding data on output.

2. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-95: Guide to Secure Web Services. Section 4.2.1, "Validate All Inputs," and Section 4.2.2, "Filter Outputs," describe these actions as essential security measures for web applications.

3. Johns, M. (2008). An Analysis of Cross-Site Scripting and SQL-Injection in Web Applications. In S. Jajodia & J. Lopez (Eds.), Secure Data Management (SDM 2008). Lecture Notes in Computer Science, vol 5208. Springer. This paper analyzes the root causes and confirms that proper input/output handling is the primary mitigation. (DOI: 10.1007/978-3-540-85269-01).