01. Keep software up to date
It may seem obvious, but ensuring you keep all software up
to date is vital in keeping your site secure. This applies to both the
server operating system and any software you may be running on your
website such as a CMS or forum. When website security holes are found in
software, hackers are quick to attempt to abuse them.
02. SQL injection
SQL injection attacks are when an attacker uses a web form
field or URL parameter to gain access to or manipulate your database.
When you use standard Transact SQL it is easy to unknowingly insert
rogue code into your query that could be used to change tables, get
information and delete data. You can easily prevent this by always using
parameterised queries, most web languages have this feature and it is
easy to implement.
03. XSS
Cross site scripting is when an attacker tries to pass in
JavaScript or other scripting code into a web form to attempt to run
malicious code for visitors of your site. When creating a form always
ensure you check the data being submitted and encode or strip out any
HTML.
04. Error messages
Be careful with how much information you give away in your
error messages. For example if you have a login form on your website you
should think about the language you use to communicate failure when
attempting logins. You should use generic messages like “Incorrect
username or password” as not to specify when a user got half of the
query right. If an attacker tries a brute force attack to get a username
and password and the error message gives away when one of the fields
are correct then the attacker knows he has one of the fields and can
concentrate on the other field.
05. Server side validation/form validation
Validation should always be done both on the browser and
server side. The browser can catch simple failures like mandatory fields
that are empty and when you enter text into a numbers only field. These
can however be bypassed, and you should make sure you check for these
validation and deeper validation server side as failing to do so could
lead to malicious code or scripting code being inserted into the
database or could cause undesirable results in your website.
0 comments: