I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I can't find how to determine what standards to look into. What approach should I take in determining some basic security standards?
Depending on what data you are handling there might be different security minimums (encrypting data in the database). But I strongly advice you to start your search on the Open Webapplication Security Project (OWASP).
If you take inputs from a user please validate that input and also ensure that the web server runs with least privileges. Also check the OWASP top 10, and these links which will help you:
I work in the IT Security profession as an IT auditor. In your case, you would need to protect both the information at rest while stored in the database and during transit, while the data is being written to the database from the application. In addition, you need to defend against common attacks against web applications.
Protecting data in transit
Following the confidentiality principle of the security triad, you would want to encrypt the data to protect against MITM attacks. Be sure to use a strong encryption method such as TLS version 1.2 with AES encryption algorithm and key length of at least 128.
Protecting data at rest
Data, depending on the classification or value should also be encrpyted at rest while stored in the database. If there are credentials stored in the database, such credentials should be hashed using a strong hashing algorithm. Do not use SHA 1 because its insecure.
Defending against attacks aimed at web applications
In addition to protecting data in transit and at rest, you also need to defend against common web-based attacks such as
SQL injection, XSS, cross site request forgery (CSRF / session riding), and attacks on sessions like fixation.
The main defense for SQL injection and XSS attacks is validation of user input on your site through escaping of dangerous input (ex: SELECT * FROM) and use of parameterized functions. For session fixation attacks, the main defense is disallowing session IDs in POST statements and regenerating the session ID upon each request from the client. For CSRF, the main protection is using additional data in the client authentication request that allows the server to detect and deny requests coming from outside the established session.