What are the most important security checks for new web applications?

Question

I'm wondering what are the top priority security checks you should make befor launching a new webapp?

I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you absolutely have to check even if you have no time for it?

Answer 1

OWASP has so called Top Ten Project, that shows which the most popular vulnerabilities are. But you should never limit yourself only on those checks that are listed there. I never liked how it sounds - "show me top 10 vulnerabilities". Quite similar answer is here: http://questions.securitytube.net/questions/1764/top-3-c-security-concerns, in the mean of philosophy. The first paragraph fully expresses my opinion. Let me cite:

If your intention is to write secure code, then I would recommend to avoid such questions like "top10 vulnerabilities". There is no point in focusing only on some desired sort of bugs, because there are quite similar chances to introduce bug of typecasting, integer overflow, off-by-one, stack overflow and others if your knowledge in C/C++ is weak and you have small experience in programming.

Answer 2

I think Ams has it right, however in terms of your greatest exposure, it is worth looking at the statistics. Check out the Verizon Data Breach Report, the Krebs Java Security Report and the WHID Security Report for some great sources of information on what attacks are really happening on the Internet.

Answer 3

If I were really critical on time I would make sure my application is checked for the following:

• Input sanitation! Find a good library to clean your data before they are used by the underlying system. XML-, SQL-, Html-, Command-injections are so dangerous!
• CSRF
• Uploading possibilities need focus on not allowing path traversal and uploading malicious scripts which is parsed by the server

I would care for "brute forcing" abilities. Ofcourse users need strong passwords, and also directory structure and files can always be bruteforced. Remember that security by obscurity does not work alone :)

Answer 4

SQL Injection is a big one if you have any sort of database interaction, and is relatively easy to test for. Cross-Site Request Forgery (CSRF) is another one that I don't go without. It's also a good idea to check for file canonicalization attacks, especially if you support user uploads or downloads of any kind.

The rest really depends on your app, the type of data it contains and who the users are.