4

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I can't find how to determine what standards to look into. What approach should I take in determining some basic security standards?

closed as too broad by Anders, Xander, CaffeineAddiction, Steffen Ullrich, Rory Alsop May 11 '17 at 21:01

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Can you give us an approximate idea of what sort of data your application holds, and what sort of threats it faces? There are specific standards that apply to certain types of data (Credit Card data, Personally Identifiable Information, medical records etc.) – Graham Hill Mar 14 '12 at 12:45
  • This question is way to broad. – Little Code May 10 '17 at 7:37
7

Depending on what data you are handling there might be different security minimums (encrypting data in the database). But I strongly advice you to start your search on the Open Webapplication Security Project (OWASP).

2

At a minimum:

  1. User Authentication (un/pw + salts stored using strong encryption in the DB at a minimum).
  2. SQL Injection protection.

As Graham pointed out, it does depend on the type of data you're handling and the threats to it.

  • Don't roll your own auth scheme. At the very least use bcrypt. – rox0r Mar 15 '12 at 3:41
2

If you take inputs from a user please validate that input and also ensure that the web server runs with least privileges. Also check the OWASP top 10, and these links which will help you:

0

I work in the IT Security profession as an IT auditor. In your case, you would need to protect both the information at rest while stored in the database and during transit, while the data is being written to the database from the application. In addition, you need to defend against common attacks against web applications.

Protecting data in transit

Following the confidentiality principle of the security triad, you would want to encrypt the data to protect against MITM attacks. Be sure to use a strong encryption method such as TLS version 1.2 with AES encryption algorithm and key length of at least 128.

Protecting data at rest

Data, depending on the classification or value should also be encrpyted at rest while stored in the database. If there are credentials stored in the database, such credentials should be hashed using a strong hashing algorithm. Do not use SHA 1 because its insecure.

Defending against attacks aimed at web applications

In addition to protecting data in transit and at rest, you also need to defend against common web-based attacks such as

SQL injection, XSS, cross site request forgery (CSRF / session riding), and attacks on sessions like fixation.

The main defense for SQL injection and XSS attacks is validation of user input on your site through escaping of dangerous input (ex: SELECT * FROM) and use of parameterized functions. For session fixation attacks, the main defense is disallowing session IDs in POST statements and regenerating the session ID upon each request from the client. For CSRF, the main protection is using additional data in the client authentication request that allows the server to detect and deny requests coming from outside the established session.

Not the answer you're looking for? Browse other questions tagged or ask your own question.