I'm working on an small web application (Flask). The application is only for distributed internal usage, e.g. only users with credentials created by the organization will have access to the services beyond the Login page and the organization creates the users. It needs to be distributed because some of the user base is traveling. The data hosted on the application is day to day operation stuff, inventories, invoices, clients contacts & similar. It is organization-sensitive in the sense that you wouldn't want competitors or third parties sniffing it out. No financial transaction, or bank accounts data are stored there.

From a security perspective, my thinking is that proper user management system with a solid implementation is a sufficient level of security for this, or more specifically:

  • CSRF protection for anything getting user inputs (which Flask provides if using Flask Forms, or pluggins exists otherwise)
  • XSS protection (Jinja templating goes a long way to protect from that). At any rate, all user inputs are sanitized and no html (or css) is served based on raw user inputs.
  • And basically everything outlined in Flask's Security Considerations is followed & properly implemented, as relevant in the use case.
  • An ORM is used, so that anything that goes in the DB is properly parametrized to prevent SQL injections.
  • At any rate, only trusted users can connect to this beyond the login page (therefore the above protection would get into play only if, say, a malicious user managed to gain control of a user account, and use it to try to inject code)
  • The application is containerized on Docker. No container runs with root, meaning that any attacker who would infiltrate a container would not be able to break out of that container, and all Docker recommendations are followed. In addition, the only container that is actually open to the web (e.g. the only port opened on the host) is the nginx one.
  • App runs on https
  • Nginx for reverse proxy, to provide a layer of abstraction between the server itself and any user, as well to add protection against DDOS (though unlikely in our use case), serve static files etc.
  • As users are also a weakling in any security system, it will be recommended to connect to the application only thru trusted wifi or data from their own simcard/ISP. Humans being humans, this may or not be followed in all cases.
  • There will be different user profiles, each having access only to the parts of the data that are actually relevant for their job.

Seems to me this results in a robust enough application from a safety standpoint. Do I have obvious blind spots here? In which case would a security specialist start to consider "no, that's not enough, we really need to add a VPN connection on top of this"?

  • A VPN would be a good solution but there is another alternative that is able to narrow down the list of attackers and possible attacks: use https with client cert authentication. Assuming only the https port is open and required https client cert auth accepting only certs of e.g. a private CA would make it extremely hard for an attacked to get access even to the login/start page. – Robert Jan 19 at 20:15
  • That's interesting and seems lighter than a VPN to use/setup. I wasn't aware of that. Thanks for the info. Still remains to be seen if I need to add that extra layers of security (along with the little hassles) or not. – Francky_V Jan 19 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.