Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm wondering what are the top priority security checks you should make befor launching a new webapp?

I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you absolutely have to check even if you have no time for it?

share|improve this question
1  
If it touches a SQL-based RDBMS: SQLi; LDAP store: LDAPi; Local files: RFI/LFI/CMDi; XML/XPath/XQuery stores: XPATHi; File upload functionality needs to be checked, Authentication is probably #1 –  atdre Nov 16 '10 at 14:53
    
Also: this is highly dependent on the language, framework, use of 3rd-party/external/contrib components, certain framework or developer features/patterns, use of VM, perhaps even OS level configuration, and many other factors such as the style, capabilities, and biases of the app developers –  atdre Nov 17 '10 at 22:05

4 Answers 4

up vote 13 down vote accepted

OWASP has so called Top Ten Project, that shows which the most popular vulnerabilities are. But you should never limit yourself only on those checks that are listed there. I never liked how it sounds - "show me top 10 vulnerabilities". Quite similar answer is here: http://questions.securitytube.net/questions/1764/top-3-c-security-concerns, in the mean of philosophy. The first paragraph fully expresses my opinion. Let me cite:

If your intention is to write secure code, then I would recommend to avoid such questions like "top10 vulnerabilities". There is no point in focusing only on some desired sort of bugs, because there are quite similar chances to introduce bug of typecasting, integer overflow, off-by-one, stack overflow and others if your knowledge in C/C++ is weak and you have small experience in programming.

share|improve this answer

I think Ams has it right, however in terms of your greatest exposure, it is worth looking at the statistics. Check out the Verizon Data Breach Report, the Krebs Java Security Report and the WHID Security Report for some great sources of information on what attacks are really happening on the Internet.

share|improve this answer
1  
There is a short overview of the WHID Security Report on this blog (blog.7elements.co.uk/2010/10/…) –  David Stubley Dec 2 '10 at 20:23
    
Of course - I should have popped that link up David. –  Rory Alsop Dec 2 '10 at 20:29

If I were really critical on time I would make sure my application is checked for the following:

  • Input sanitation! Find a good library to clean your data before they are used by the underlying system. XML-, SQL-, Html-, Command-injections are so dangerous!
  • CSRF
  • Uploading possibilities need focus on not allowing path traversal and uploading malicious scripts which is parsed by the server

I would care for "brute forcing" abilities. Ofcourse users need strong passwords, and also directory structure and files can always be bruteforced. Remember that security by obscurity does not work alone :)

share|improve this answer

SQL Injection is a big one if you have any sort of database interaction, and is relatively easy to test for. Cross-Site Request Forgery (CSRF) is another one that I don't go without. It's also a good idea to check for file canonicalization attacks, especially if you support user uploads or downloads of any kind.

The rest really depends on your app, the type of data it contains and who the users are.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.