Selva Sharing

Web Application Security

22. Sign up for notices about web application updates.
23. Update your web applications promptly.
24. Scan web applications using remote security tools such as Nessus.
25. Use a web application firewall.
26. Test file upload fields to assure code cannot be uploaded.
27. Have custom code reviewed for security issues.
28. Use coding frameworks with good security history.
29. Do not rely solely on obscure directory/file names for security.
30. Secure web application admin areas with IP based restrictions.
31. Sanitize user input.
32. Put sensitive files outside of document root or restrict access.
33. Avoiding using shell commands within scripts.
34. Don’t trust HTTP Referrer fields as they are easily forged.
35. Use POST instead of GET to submit data so sensitive information is not in the URL.
36. Validate data server-side not client-side.
37. Do no rely on relative file and path names. Always set base directories.
38. Specify permissions when creating files.
39. Limit file upload, creation activities to specific directories.
40. Create safe error messages by not disclosing sensitive information in errors.
41. Be careful of what data you trust from a cookie; it can be manipulated.
42. Encrypt configuration files that contain sensitive logins.
43. Guard against application level DOS attacks by limiting field input length.
44. Disable url fopen if possible.
45. Enable safe mode, include directory and open base restrictions if possible
46. Disable dangerous PHP functions if possible
47. Be careful of naming files *.bak, *.txt or *.inc within the web document root.
48. Be careful using version management tools on your doc root.
49. Set default reply-to’s for web applications and monitor the email for bounces.
50. Use version control systems.
51. Use bug tracking and change log systems

Law #1 Nobody believes anything bad can happen to them, until it does

This is probably the biggest stumbling block we encounter when working with small businesses. People like to think they are not targets, and to some extent, small businesses are not targets. The issue is that a significant amount of server compromises are not directed attacks but simply random scanning. If a bot scans your server and finds vulnerabilities, you quickly become a target. You don’t have to hang a “Can’t Hack This!” sign to solicit attention. If the random scanning turns up a juicy port or application, you become a target. So while you may not think it will happy to you, I can assure you that your server is being scanned frequently.

Law #3: If you don’t keep up with security fixes, your network won’t be yours for long

The key value of our Linux server management offerings is the software update service. Beyond the monitoring and help desk support, our routine application of security patches keeps minor exploits from becoming major ones and reduces the chance of a critical security failure. Staying on top of security threats and plugging holes is vital. The number one issue we see is web applications. While we can do everything to keep the server secure, if you don’t update your web applications, you can quickly become a victim. Web applications have quickly risen to the top of SAN’s Top 20 threats and will likely remain there until easier update methods emerge.

Law #6: There really is someone out there trying to guess your passwords

rackAID earns $1000’s per year fixing security issues that were directly attributed to poor password security. Nearly every month, we encounter some system with a very poor password or using the same password in multiple contexts. You can use Winguide’s Password Generator to make a strong password (8 characters with numbers, capitalization, and symbols). If you are worried about forgetting passwords, search for any number of password management tools.

Law #8: The difficulty of defending a network is directly proportional to its complexity

This is why when you want us to add some third party software we push back. Adding complexity should only be done when it is a business or technological necessity. As I pointed out with Red Hat Updates, keeping things stock is critical to easy server management.

Law #10: Technology is not a panacea

Too often people forget that there are other people out there trying to do bad things to their network. Clever security technology can be cracked by clever hackers. Planning for security, implementing those plans, and knowing what to do when something does go wrong is key. This is one reason we push ourCDP backup services. By retaining older backups, we can easily roll back a system to a pre-intrusion state. Our server backup services save many people after their outdated blog software was hacked.

These are some of the key issues we see impacting our clients. I recommend you review the full list of 10 Immutable Laws of Security Administration and 10 Immutable Laws of Security. Though written years ago, they are still relevant today.