Scribd Logo
Upload

Welcome to Scribd!

  • 11 views

    Establishing Application Security

    Uploaded by

    Karl Alvin Reyes Hipolito
    The document discusses establishing application security. It covers secure coding concepts like error handling and input validation. Application security issues like ActiveX controls, Java, scripting, browsers and cross-site scripting are also examined. Prevention techniques include validating all user input, applying patches, and establishing a configuration baseline for applications.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Establishing Application Security

    Uploaded by

    Karl Alvin Reyes Hipolito
    11 views6 pages
    The document discusses establishing application security. It covers secure coding concepts like error handling and input validation. Application security issues like ActiveX controls, Java, scripting, browsers and cross-site scripting are also examined. Prevention techniques include validating all user input, applying patches, and establishing a configuration baseline for applications.

    Original Description:

    Original Title

    Establishing Application Security (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses establishing application security. It covers secure coding concepts like error handling and input validation. Application security issues like ActiveX controls, Java, scripting, browsers and cross-site scripting are also examined. Prevention techniques include validating all user input, applying patches, and establishing a configuration baseline for applications.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    11 views6 pages

    Establishing Application Security

    Uploaded by

    Karl Alvin Reyes Hipolito
    The document discusses establishing application security. It covers secure coding concepts like error handling and input validation. Application security issues like ActiveX controls, Java, scripting, browsers and cross-site scripting are also examined. Prevention techniques include validating all user input, applying patches, and establishing a configuration baseline for applications.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 6

    Network Security

    1
    Establishing Application Security

    Module 6 ESTABLISHING APPLICATION


    SECURITY
    At the end of this chapter, students will:
    1. Learn the importance of Secure Coding Concepts.
    2. Understand the need for applying application patches and keep your
    system up-to-date and make sure that the administrators follow the
    secure coding concepts.
    3. Acquire knowledge about application hardening concepts and what
    you can do to help prevent security issues

    MITIGATING SYSTEM AND NETWORK SECURITY THREATS

    ESTABLISHING APPLICATION SECURITY

    An overlooked aspect of security is that the security within the applications we use
    today. It is very important to learn and understand how hackers are hacking the systems
    through the use of applications that are running on a company’s systems. It is a must that the
    network administrator must keep all the application updated and follow secure coding
    concepts to prevent hackers from gaining access on the system easily.

    Testing the system is crucial in every organization and they should always test and
    examine all the applications they are creating by putting any invalid data on it to make sure
    that it only accepts correct types of information. This step of testing the software inputs if
    it’s invalid or not into input fields of any application is called fuzzing.

    SECURE CODING CONCEPTS


    As stated before, a big part of hardening your system security is to ensure that
    the application that are running on the systems should always been developed in a
    secure way. To the application or software developers, they need also to learn secure
    ways of developing an application so that any hackers cannot hack through
    applications in order to gain access to the system. There are two important parts in
    developing a secure code, these are writing good exceptions- handling routines and
    validating all data passed to the application.

    Error and Exception Handling


    When the software or application developers create an application,
    they sometimes forget to look at any possibilities that errors can occur in
    different situations. For example, most common error is when creating a file
    dialog open box is not preparing for the users choosing to open a file from the
    CD or DVD drive when no VD/ DVD has been placed in the system when user
    Course Module
    is using or accessing the application. It normally causes a system runtime
    error- an error that only occurs when the user is up and running. Meaning to
    say, there was no sign to the software developer that the error would exist
    when they were creating the application.
    These runtime errors will occur since the developer cannot force any
    user to place a CD/DVD into the CD/DVD tray before browsing to that source.
    So, the developer needs to is trap the error that occurs at that point. Trapping
    an error means that instead of the error happening, the programmer captures
    the error and displays a warning message instead of the application crashing
    because runtime errors cause the application to crash.

    Exception handling is an advanced method of error handling. Exception


    is another term for a runtime error, and most programmers such as Java or
    .NET developers will implement this exception-handling code. Exception-
    handling code uses what is called a try/catch block syntax that means “try this
    code and catch any errors.” The following code is an example of a try/catch
    block and is very useful in handling errors on the application:

    Try
    MessageBox.Show(cdbl(txtTotalAmount.text) +
    cdbl(txtTotalTax.text))
    Catch ex as InvalidCastException
    MessageBox.Show("Please supply 2 numbers as input")
    Catch ex as Exception
    MessageBox.Show("An error has occurred. Please try again.")
    End Try

    Input Validation

    Software developers need to strictly follow the concept that when


    someone enters any information into an application and clicks a button like
    Save, the system must validate the input first before using it somewhere in the
    application. Validating an input means that the developer checks all the data
    to make sure that the information provided by the user in the application is
    valid and correct for the type of data that the application is expected. Any
    invalid input should not proceed and should be modified first before the
    process pushed through.
    Let say for example, if you created a login system, the user must need
    to provide his username and password. There are some rules that the
    username must contain fewer than 14 characters only. The programmer
    should check on this input and make sure that the username provided by the
    user meets the required number of characters.
    Network Security
    3
    Establishing Application Security

    APPLICATION HARDENING

    Application Security Issues

    To help establish a more secure environment, you should be familiar first with
    several common application security issues. The following shows security issues to
    the systems today:

    ActiveX controls
    The use of ActiveX controls area an area of concern with applications.
    If one application or website is using this ActiveX control, it is not necessarily
    a bad thing, but it does show a security apprehension because the ActiveX
    controls can manipulate your system including the deletion of the important
    files on your computer.

    Java
    This Java applications are different from ActiveX controls since they
    run in what is known to as a sandbox. Sandbox is a restricted area with a
    resource that these Java applications can access.

    Scripting
    There are lots of application environments including web sites that
    supports scripting. A scripting is a security concern because most scripting
    languages can make some changes to your system. Example, before, a script in
    Microsoft Office could loop through your address book using Outlook and then
    send an e-mail to all your contacts without your consent but today, they have
    now a macro security feature to prevent this from happening.

    Browser
    All browsers can be a huge security issue since most web sites have
    different types of contents that can be run by the browser. Most active
    content that is to be run in a browser needs to have an add-on that are
    installed in a browser to make sure that the content will be executed and run
    properly.

    Cross-site scripting (XSS)


    This cross-site scripting or XSS, the hacker inserts a script code into a
    form on a site so that when the page is displayed by another user, the browser
    will read the inputter scripts and executes those commands.

    Cookies
    Cookies are logon information from all the websites you visit and is
    stored in memory on computer. There are some security issue surrounding
    storing information in cookies. One of this is that if the information is stored
    in a text file and if someone gain an access to this, they will know the

    Course Module
    information that you have provided or gathered on that file and might use it
    against you.

    Instant messaging
    Instant messaging applications grows for fast that it become one of the
    big security issues nowadays. This instant messaging software allows worm
    viruses such as the W32.Seesix worm replicate itself within your system. Not
    only that, instant messenger applications also allow files sharing and it’s
    possible to the hacker to gain access on your systems and gather important
    information on your network.

    P2P
    This type of file sharing applications is also having a security risk since
    the users are downloading files from untrusted sources. Downloading any files
    or software from any untrusted sources will put you on risk because most of
    the times there are malicious code attached to that file that will cause harm to
    your system when executed.

    Buffer overflow
    As we discussed earlier, a buffer overflow attack is an attack when the
    hackers send too much amount of data to an application and is being able to
    run random code that might results in administrative access to the system.

    Prevention Techniques

    Following are the best application security practices that are essential. There
    are two major categories- making sure that you validate first the input and that you
    apply patches to the application that you are using. Following are some other ways
    to protect and save your system from attacks:

    Application configuration baseline

    Make sure that each of the applications are configured with


    security. It means that with every single application, you must go
    through the options and check each application are configured in the
    most secure state. For example, Internet Explorer comes with a
    different number of options that control what type of content is allowed
    or not in the browser. Another example is that Microsoft Office comes
    with a macro security feature that you can configure to allow or
    prohibit macros from running.

    Application hardening
    It is important to disable any features in applications that you
    don’t want users to use. Let say that your company wants to use instant
    messaging applications, in order to make it more secure, you can just
    disable the file-transfer and desktop-sharing features in the software
    and only allow chatting.

    Application patch management


    You should always need to patch the applications on your
    system together with the operating system.
    Network Security
    5
    Establishing Application Security

    Cross-site scripting prevention

    Preventing cross-site scripting is important method in


    hardening your system. It typically validating the input first into a web
    site for any illegal characters or invalid inputs in a particular field.

    Cross-site request forgery prevention

    Cross-site request forgery is an application vulnerability where


    a web page may have code that uses another site and that is
    automatically uses the user’s cookie data for validation if the cookie is
    existing and has not yet expired. To avoid and prevent this type of
    attack, users should always not choose the “Remember Me” option
    when logging in to any web site. Also, for any application developers,
    they should make cookies expire in a short time possible.

    NoSQL databases vs. SQL databases

    The NoSQL database is the idea of developing a database system


    to store and retrieve large volumes of data also known as Big Data. The
    NoSQL database is designed in a different way than a traditional
    relational database system since the NoSQL database should be
    enhanced for retrieval of large amounts of data. Relational database
    management systems are normally not optimized for retrieval of large
    data but are improved for insert and updates of records in the database.

    Server-side vs. client-side validation

    Application developers must validate any input that the


    application accepts. The validation code can be applied either at the
    client a.k.a client-side validation or at the server a.k.a server-side
    validation. Developers should always implement validation at both the
    client and the server to obtain high security level. Client-side validation
    will ensure that any unnecessary traffic will not be submitted to the
    server when data is valid, and implementing server-side validation will
    gives you an extra layer of security by making sure that everything
    reaches the server is then re-validated again.

    Course Module
    References and Supplementary Materials
    Online Supplementary Reading Materials

    1. 7 must-dos for delivering app-focused security; https://techbeacon.com/security/7-


    must-dos-delivering-app-focused-security; January 2020
    2. Application Security: How to Secure the Many Apps in Your Enterprise;
    https://www.esecurityplanet.com/applications/application-security.html; January
    2020
    3. HOW TO: Secure Applications That Are Built on the .NET Framework;
    https://support.microsoft.com/en-ph/help/818014/how-to-secure-applications-that-
    are-built-on-the-net-framework; January 2020
    4. 5 Common Network Security Problems and Solutions;
    https://www.compuquip.com/blog/5-common-network-security-problems-and-
    solutions; January 2020

    You might also like