0

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of solutions you can look up...but most of the time you don't even know there's an issue. Consider. I've been working on a website. I thought everything was solid - it uses HTTPS, the passwords are hashed, CORS is enabled for specific domains, the whole nine yards. Everything was locked up as tight as could be. Or so I thought. Then, as I was browsing the internet, I discovered CSRF. I did not know this was something I had to watch out for, so the website is vulnerable to it.

Now, I've been programming for many years. I've read quite a bit on security, took a university class on cryptography, and (IMO) understand quite a bit about threat models, hash functions, and so forth. If I can so easily fall prey to an (apparently common) security vulnerability, what hope does an average learned-programming-last-year kind of person stand? How does the internet work AT ALL? It seems like just when I know all the things I have to watch for, turns out there's another. And another. Not even NEW things, like Heartbleed, but things that have ALWAYS been dangerous cases. I'm pretty confident that it's possible in theory to be perfectly secure, but there are so many things you're just supposed to magically know that it's effectively infeasible to actually be secure.

My question boils down to: is there a list where, if I do all the things, I am guaranteed to be safe? (Assuming flawless libraries, browsers, and hosts, etc.)

Now, I realize there are varying levels of answer to this question: a stateless server that serves only public static content and is incapable of saving data is invulnerable to almost anything. If you want state, the list of things you must do increases. Therefore, a good answer should either give a list which covers all cases, or give several lists each of which secure a certain common set of capabilities. (Links to lists are allowed, and perhaps even preferred.)

Improve this question

1 Answer 1

Reset to default
1

No, there is no comprehensive checklist that you can just complete and be "secure".

Security is not a destination, it's a mindset, and part of the product lifecycle. You need to re-evaluation as your product matures.

There are common exploits. Check the OWASP top 10 list. Since software is so custom, it wouldn't be very useful to have a list where 99% of the concerns wouldn't he applicable.

One common thing develelopers do is use static analysis code scanners to detect known vulnerabilities.

Improve this answer
3
  • 1
    Thanks for the top ten list; that's helpful. I've been doing research, and it turns out my premise was flawed. It is not necessarily possible to create a secure website, because browsers are habitually riddled with not only implementation flaws, but design flaws. (See MIT course videos such as youtube.com/watch?v=WlmKwIe9z1Q .) Where in cryptography land you can define a threat model and prove that crypto elements XYZ arranged just so will prevent an attack, it seems the best you can do with the web is apply a slew of walls and hope nothing else is broken.
    – JP45258
    Feb 5, 2019 at 4:12
  • I'll wait a day and see if anybody else posts anything, and otherwise accept your answer.
    – JP45258
    Feb 5, 2019 at 4:13
  • 1
    Correct. There can't be a complete list, as logical flaws in the application logic itself can lead to vulnerabilities as well. OWASP covers most common flaws and if all developers would consider it, we'd had much less trouble. :)
    – Euphrasius von der Hummelwiese
    Feb 5, 2019 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .