Application Security : Focus Area

In our previous posts we talked about type of Threats and discussed in details Top Threats for Web Application security. Today we shall talk about the points a developer should consider while security Applications.

Focus Area

• Website Authentication
• Resource Authorization
• Input Validation & HTTP validation and encoding
• Parameter Handling
• Session Data Handling
• Sensitive Data Protection
• Web Services
• Exception Handling
• Web Config Management
• Privilege Management
• Deployment

Website Authentication

1. Ensure SSL Encryption is implemented
2. Ensure strong Password policy is applied
3. Confirm that cookies are stored only after encryption.
4. Avoid storing any sensitive information in XML files.
5. Monitor unsuccessful login activities.

Resource Authorization

1. Confirm role based authorization is applied.
2. If Application requires any File system access, ensure that windows authentication is applied.
3. Confirm principal permission demand is applied in classes and members in source code.

Input Validation

1. Ensure text is duly validated in using RequiredFieldValidator, RangeValidator, RegularExpressionValidator, Text Length.
2. Encode output using urlEncode and HtmlEncode.
3. Confirm Free form input is sanitized to thwart LFI or RFI attacks.
4. Evaluate Input before applying it directly to the Data Model or SQL Query.

Parameter Handling

1. Confirm query strings data are duly encrypted.
2. Confirm form viewstate is encrypted.
3. Confirm Page.ViewStateUserKey is implemented to defend against one-click attacks.
4. Ensure most database operations are handled using Stored Procedures.

Session Data Handling

1. Confirm redundant session services are disabled.
2. Confirm session cookies data are hashed.
3. Confirm connections strings are encrypted
4. Ensure session state service is running with least privileges.

Sensitive Data Protection

1. Confirm SSL is applied to protect communication.
2. Confirm sensitive data does not reside in cookies, query strings, and hidden forms fields.
3. Confirm server side state management is applied for clear text passing of data across the pages.
4. Confirm output caching is disabled of sensitive encrypted data.
5. Confirm sensitive data is not stored in web.config file in plain text

Web Services

1. Confirm redundant Web service protocols, including HTTP GET and HTTP POST, are disabled.
2. Confirm Input to Web methods is validated for, length, type, range, and format.
3. Confirm Web service running with least-privileged process account.
4. Confirm Messages are digitally signed to certify that they cannot be tampered by malicious parameter manipulation.
5. Confirm XML input data is substantiated based on an agreed-upon schema.
6. Confirm publicly accessible Web methods are restricted by using declarative principle permission demands.

Exception Handling

1. Confirm every occurred exception is recorded on the server.
2. Confirm structure exception handling is applied to each code file.
3. Confirm Page level & Application level exception handling is applied.
4. Confirm generic error page is configured for unexpected error occurrences.

Web Config Management

1. Confirm enableViewState is disabled, if application doesn’t rely on view state.
2. Confirm httpMaxLength to prevent users from being able to upload a large-sized file.
3. Confirm ASP.NET account is running with least privilege by this setting.
4. Confirm unused file type handlers is mapped to Forbidden handler.
5. Confirm automatic generation of WSDL is disabled.

Privilege Management

1. Confirm impersonate account has Read permission to GAC.
2. Confirm process account has Read and Execute permission to solution content directory.
3. Apply necessary permission for temporary folders.
4. Enable Read and execute permission to the framework directories.
5. Monitor any violations (if any)

Deployment

1. Ensure debug compilation is disabled.
2. Confirm Trace is disabled.
3. Confirm Bin directory doesn’t have read or write permission or directory browse permissions.

Above list is not final, as everyday many more threats are discovered and necessary patches are applied. But as developer you need to ensure your application is threat proof. All testers should try to hack-test the system and ensure all necessary application security parameters are applied.

Hope the above information is useful, in next post we shall talk exclusively about SQL INJECTION.

 

I hope you would find above article informative and  interesting. In case you need any further information, please feel free to comment , I shall try to reply the comment at the earliest. If you like this article, please like my Facebook page and advise/suggest me for more topics of your interest. Happy Coding!