Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I can't find how to determine what standards to look into. What approach should I take in determining some basic security standards?

share|improve this question
3  
Can you give us an approximate idea of what sort of data your application holds, and what sort of threats it faces? There are specific standards that apply to certain types of data (Credit Card data, Personally Identifiable Information, medical records etc.) –  Graham Hill Mar 14 '12 at 12:45

3 Answers 3

Depending on what data you are handling there might be different security minimums (encrypting data in the database). But I strongly advice you to start your search on the Open Webapplication Security Project (OWASP).

share|improve this answer

At a minimum:

  1. User Authentication (un/pw + salts stored using strong encryption in the DB at a minimum).
  2. SQL Injection protection.

As Graham pointed out, it does depend on the type of data you're handling and the threats to it.

share|improve this answer
    
Don't roll your own auth scheme. At the very least use bcrypt. –  rox0r Mar 15 '12 at 3:41

if you take inputs from a user please validate that input and also ensure that the web sever run with least privilege and also check OWASP top 10 , also check out this links they will help you

writing secure web applications

Sans on Deploying web apps securely

Microsoft improve web application security

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.