The following document is intended as a guideline for developing secure web-based applications. It is not about how to configure firewalls, intrusion detection, DMZ or how to resist DDoS attacks. This is a task best addressed at system and network level. However, there is little material available today intended for developers. We have entered the dotcom age in which a web site is no longer an isolated site, but an extension of the internal business systems, yet there isn’t much about how to create this extension securely.

Traditionally, developers have worked on systems for environments where malicious intents were not a real threat: internal systems, software for home use, intranets. There may have been occasional exceptions, sometimes with embarrassing outcomes, but they could be dealt with at HR level and the example prevented others from attempting it again. An isolated (read: not linked with internal systems) web site is not far from the same scenario: the security was treated mostly at the system level by installing the necessary OS and web server fixes and applying correct settings and permissions. If a breach occurred, the system was taken offline, rebuilt better and the site put up again. Everything at a system administration level.

However, as the Internet becomes more and more commercial (after all, this is where the .com comes from), a web site becomes more and more an application. Thus, the team has more and more developers, skilled in web and traditional development. However, few resources for them focus enough on security to make them aware about what’s out there on the Internet. We often read that “this web site is secure because it uses 128-bit encryption”. Most often, programming books will have a single chapter on security, compressing SSL, signatures, permissions, cookies and other topics in 20 pages. Little if anything is said about how to think maliciously about your own code, trying to find out if it has a vulnerability. Little if anything is said about how to do security-focused code reviews.

Download pdf Best Practices for Secure Web Development