The best way to prevent Web application attacks is through education and vigilance. Developers should be educated on secure coding practices, and management should be educated on the risks involved in taking a system live before it has been thoroughly tested. Additionally, administrators and security professionals should constantly monitor vendor Web sites, security Web sites, and security mailing lists to ferret out potential vulnerabilities in the applications and servers used by their Web applications.

Secure coding is only one of many components needed to develop a secure Web application. Ideally, security should be discussed, planned for, and included in all phases of application development, and procedures should be established for ongoing monitoring and maintenance of the Web application. When this occurs, the end result will be a stable, secure Web application.

Developers take notice

* First and foremost, developers should learn never to trust incoming data. A heightened distrust of the end-user goes a long way toward developing a secure Web application; developers should trust only what they control. Because they cannot control the end-user, developers should view all data inputs as potentially hostile and should design controls in the application to validate end-user data inputs.

For example, never assume that anything sent to a client's browser is returned unchanged or that the data entered into a Web form is what it should be. Does a form field that asks for a customer's address really need to contain a "<" symbol? Such symbols usually indicate code to a hacker. Adding filters and input checks significantly reduces the risk of many types of Web application attacks.

* Developers should include all security measures in the application as they are coding it. Using an anonymous Web server account during development to save time even though each end-user will authenticate to the live application with a user name and password can cause problems. Bugs may arise in the authentication code, not to be discovered until a few days before, or even after, the application goes live. Finding bugs at the last minute means that the application launch will be delayed or that it will be launched with bugs. Neither choice is optimal; so include all of the application's elements throughout the development process.

Whenever possible, do not use administrator or superuser accounts to run the application. Although you may save yourself time dealing with access rights and permissions, running everything as root is asking for trouble. With a superuser account, the Web application user will have write access to all database tables. Modifying a few URLs with SQL code, a malicious user can easily wipe out the entire database. Following the security principle of "least privilege" is a must. Least privilege means giving a user the lowest level of permissions necessary for performing a certain task. The user can still enjoy the Web application, and the company can feel safe by knowing that malicious users cannot easily perform illegal operations because their access does not allow it.

* Using HTTP GET requests to send sensitive

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine