The security of information systems is a wide area. Its development followed that of information systems, whose development in turn followed advances in hardware. As computers and software have developed real fast: “To put it quite bluntly: as long as there were no machines, programming was no problem at all; when we had a few weak computers, programming became a mild problem, and now we have gigantic computers, programming had become an equally gigantic problem.” [1], so have developed the possibilities for security breaches.
Read the rest of this entry »

• 0 Comments

A Word About Secure Database Access
Unfortunately, this database access code exhibits insecurities of its own. For example, you should never use the sa account (or an equivalent) to access databases from Web applications. Instead, use weak accounts that lack permission to drop tables, insert, update, and delete records, and the like. In addition, you should use stored procedures or parameterized commands in lieu of dynamic SQL commands for added protection against malicious input parameters. Finally, consider encrypting database connection strings to minimize the risk of information disclosure if your source code falls into the wrong hands. And note that truly paranoid ASP.NET programmers encrypt connection strings and store them in ACLed registry keys. When it comes to Web security, a little paranoia can be a good thing.
Read the rest of this entry »

• 0 Comments

Information and communication technologies continue to pervade our lives in various aspects which include health, education, entertainment and ecommerce. People need to be able to trust computer systems as the dependence on them increases. The Trustworthy Computing vision (CRA, 2003) refers to computer systems that are intuitive, controllable, reliable and predictable and that ensure availability and security. Secure cod- ing is not trivial and poor code security management may leave the developed web application vulnerable to attack or turn the application into a launch pad for serious attacks.
Read the rest of this entry »

• 0 Comments

The following document is intended as a guideline for developing secure web-based applications. It is not about how to configure firewalls, intrusion detection, DMZ or how to resist DDoS attacks. This is a task best addressed at system and network level. However, there is little material available today intended for developers. We have entered the dotcom age in which a web site is no longer an isolated site, but an extension of the internal business systems, yet there isn’t much about how to create this extension securely.
Read the rest of this entry »

• 0 Comments

E-commerce, pay-per-use online services, user-authentication and tracking for e-learning, online gaming, contests… What do all of these applications have in common? The need for secure transfer of encrypted data between client workstations and server applications. According to a study by Gartner Consulting, the growing concern for Internet security parallels the evolution of e-business. In the earliest days of Internet development, the emphasis was on distributing content over the web and making it available to anyone. Now, as the Internet matures, clients are more concerned with ensuring that their assets, both monetary and intellectual, are protected from those who may commit fraud or abuse them. This is why more and more developers have been looking for security solutions.
Read the rest of this entry »

• 0 Comments

Most Internet servers sit behind firewalls and use detection scripts to send alerts when break?ins are attempted. Some system administrators even run software to detect portscanners and denial?of?service attempts. However, many system administrators still overlook security problems in CGI scripts and web applications.
Read the rest of this entry »

• 0 Comments

SSH (Secure SHell) is a network protocol which provides a replacement for insecure remote login and command execution facilities, such as telnet, rlogin and rsh. SSH encrypts traffic in both directions, preventing traffic sniffing and password theft. SSH also offers several additional useful features:
• Compression: traffic may be optionally compressed at the stream level.
• Public key authentication: optionally replacing password authentication.
• Authentication of the server: making ”man-in-the-middle” attack more difficult
• Port forwarding: arbitrary TCP sessions can be forwarded over an SSH connection.
• X11 forwarding: SSH can forward your X11 sessions too.
• File transfer: the SSH protocol family includes two file transfer protocols.
Read the rest of this entry »

• 0 Comments

In the past, most Web content was static and predictable. But today’s reality is that Web content—even from so-called “trusted” sites—is constantly changing with end-users encouraged to post, edit, or manipulate content. The most popular and heavily-trafficked sites that make the most use of dynamic Web 2.0 content, are also the most vulnerable to attack. In fact, according to Websense® research covering the first half of 2008, over sixty percent of these top 100 sites either hosted malicious content or contained a masked redirect to an illegitimate site.
Read the rest of this entry »

• 0 Comments