I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have incredible security in place.
So far, my solutions contain methods that:
- Login via SSL only
- Token NONCE Tokens (preventing token hijacking)
- Locking down DB access to only authorized clients (web servers)
- SQL Injection Protection
- XSS Protection
- Protect the passwords by hashing with a Salt and Pepper
- CSRF tokens
- Site Code Signing (using RSA/DSA)
- All Servers only accessible with Private Key's
So, is there any information on how it was done, so that I could build safeguards into my software to prevent similar things happening to my sites?