Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security.

I am wondering from where to start? Is there a famous audit forms to analyze and evaluate the security of a website? An online free tool to make the first check?

The website in question is a very basic one developed in PHP.

share|improve this question
1  
This is my first post in IT-Security. I can edit it as much as you ask ! – ALJI Mohamed Dec 2 '12 at 14:25

2 Answers

up vote 5 down vote accepted

Have a look at the OWASP Top 10 Project.

OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.

In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.

As far as tools go - recommendations are beyond the scope of the site. There are far too many out there. The BackTrack distribution comes with many great ones. It can be quite confusing for a beginner though.

share|improve this answer
excellent , it seems a very good start. – ALJI Mohamed Dec 2 '12 at 15:48
up vote 2 down vote

As Terry suggested OWASP is the first place anyone should start off especially w.r.t. Web App Security. In addition to that, I would suggest you to also look into WASCv2 and SANS CWE Top 25.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.