I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I can't find how to determine what standards to look into. What approach should I take in determining some basic security standards?

  • 4
    Can you give us an approximate idea of what sort of data your application holds, and what sort of threats it faces? There are specific standards that apply to certain types of data (Credit Card data, Personally Identifiable Information, medical records etc.) Commented Mar 14, 2012 at 12:45
  • This question is way to broad. Commented May 10, 2017 at 7:37

4 Answers 4


Depending on what data you are handling there might be different security minimums (encrypting data in the database). But I strongly advice you to start your search on the Open Webapplication Security Project (OWASP).


At a minimum:

  1. User Authentication (un/pw + salts stored using strong encryption in the DB at a minimum).
  2. SQL Injection protection.

As Graham pointed out, it does depend on the type of data you're handling and the threats to it.

  • Don't roll your own auth scheme. At the very least use bcrypt. Commented Mar 15, 2012 at 3:41

If you take inputs from a user please validate that input and also ensure that the web server runs with least privileges. Also check the OWASP top 10, and these links which will help you:


I work in the IT Security profession as an IT auditor. In your case, you would need to protect both the information at rest while stored in the database and during transit, while the data is being written to the database from the application. In addition, you need to defend against common attacks against web applications.

Protecting data in transit

Following the confidentiality principle of the security triad, you would want to encrypt the data to protect against MITM attacks. Be sure to use a strong encryption method such as TLS version 1.2 with AES encryption algorithm and key length of at least 128.

Protecting data at rest

Data, depending on the classification or value should also be encrpyted at rest while stored in the database. If there are credentials stored in the database, such credentials should be hashed using a strong hashing algorithm. Do not use SHA 1 because its insecure.

Defending against attacks aimed at web applications

In addition to protecting data in transit and at rest, you also need to defend against common web-based attacks such as

SQL injection, XSS, cross site request forgery (CSRF / session riding), and attacks on sessions like fixation.

The main defense for SQL injection and XSS attacks is validation of user input on your site through escaping of dangerous input (ex: SELECT * FROM) and use of parameterized functions. For session fixation attacks, the main defense is disallowing session IDs in POST statements and regenerating the session ID upon each request from the client. For CSRF, the main protection is using additional data in the client authentication request that allows the server to detect and deny requests coming from outside the established session.

Not the answer you're looking for? Browse other questions tagged .