11 application security fundamentals - part 2 - security mechanisms - summary
- 2. Security Mechanisms to Achieve Goals onfidentiality ntegrity vailability Authentication Authorization Session Management Data Validation Error Handling Logging Encryption
- 3. Good practices cheat-sheet Authentication Enforce basic password security Implement an account lockout for failed logins “Forgot my password” functionality can be a problem For web applications, use and enforce POST method Authorization Every function (page) must verify authorization to access Every function (page) must verify the access context Any client/server app must verify security on the server Error Handling Don’t disclose information that should remain private Remember to cleanup completely in an error condition Encryption If storing passwords – hash with a salt value If you’re using authentication – encrypt in transmission Properly seed random number generators Data Validation Validate data before use in SQL Commands Validate data before sending back to the client Validate data before use in ‘eval’ or system commands Validate all data lengths before writing to buffers Session Management Enforce a reasonable session lifespan Leverage existing session management solutions Force a change of session ID after a successful login Logging Avoid logging sensitive data (e.g., passwords) Beware of logging tainted data to the logs Beware of logging excessive data Beware of potential log spoofing