Neglecting to take proper security measures at the application layer is one of the most common causes of data breaches, yet many companies still leave their applications unprotected. Securing your applications begins with developer training on the risks applications face and the methods required for vulnerability prevention. This infographic focuses on defining these risks and combating common flaws.
The cost of a data breach averages $5.5 million or $194 per customer record
Companies that take security seriously by employing a Chief Information Security Officer can reduce the cost per customer record by up to 62%.
So…what can Web developers be doing to PREVENT these data breaches and Web application vulnerabilities from happening in the first place?
(This is not a comprehensive list, as application security is a constant process)
Does the application properly encode or escape data prior to exchanging it with external components such as a database, LDAP server, web browser, etc?
Does the application encrypt sensitive information such as authentication credentials, sensitive customer data, etc. prior to transmitting such information across the network?
Does the application comply with the organization's existing security standards?
Does the application use thread-safe techniques to protect against race conditions that could harm system availability and/or data integrity?
Does the application ensure that numeric values are within expected ranges that do not result in unanticipated consequences when used in calculations or control structures?
Does the application properly control access to the server's file system?
Does the application use currently accepted, industry-standard cryptographic algorithms?
Has the application been deployed with secure default permissions?
Does the application protect against brute force attacks?
Does the application validate all input including parameters, arguments, cookies, anything read from the network, environment variables, request headers, URL components, e-mail, files, database records and any external system that provides data to the application?
Does the application verify the origin of sensitive requests through the use of unpredictable, unique nonces as hidden input form values?
Does the application fail gracefully and securely without divulging details of the underlying implementation to the end user?
Does the application store state information on the server side only or ensure client-side state variables have not been tampered with?
Does the application perform access control checks in a consistent manner across all potential execution paths?
Is the application free of hardcoded credentials and cryptographic keys?
Does the application use sufficient randomness for generating session ids or in other security-sensitive contexts?
Specific Examples of How to Combat Two Common Flaws
XSS (Cross Site Scripting) Flaws
You May Be Vulnerable If…
Input coming into your applications is not validated
Output to the browser is not properly escaped
How to Prevent It
Use the appropriate escaping method for the context you are in. Here are some examples:
HTML encode all user input returned as part of HTML
URL encode all user input returned as part of URLs (convert ?, &, /, <, >, and spaces to their respective URL encoded equals)
Convert all user input to a single character encoding before parsing
SQL Injection Flaws
You May Be Vulnerable If…
Unvalidated user input is concatenated into an ad-hoc SQL query
How to Prevent It
Use parameterized prepared statements
Use Input Validation for Length, Type, Syntax & Business rules
Use the lowest privilege database account possible
Really Want Secure Web Applications? Security is a Process: Test Everything!
Never assume security controls are effective until you can validate them with thorough testing.
Most security vulnerabilities will not be discovered during normal application use.
Allocate time for dedicated security testing within your project timeline.
Always test applications and application components, both in isolation and in the environment where the application is deployed.
Neil is a Marketing Technologist working on the Content and Corporate teams at Veracode. He currently focuses on Developer Awareness through strategic content creation. In his spare time you'll find him doting over his lovely wife and daughter. He is a Co-Owner of CrossFit Amoskeag in Bedford NH, his favorite topic is artificial intelligence, and his favorite food is pepperoni pizza.
Love to learn about Application Security?
Get all the latest news, tips and articles delivered right to your inbox.
Veracode is a leading provider of enterprise-class application security, seamlessly integrating agile security solutions for organizations around the globe. In addition to application security services and secure devops services, Veracode provides a full security assessment to ensure your website and applications are secure, and ensures full enterprise data protection. Application protection services from Veracode include white box testing, and mobile application security testing, with customized solutions that eliminate vulnerabilities at all points along the development life cycle.