Information and communication technologies continue to pervade our lives in various aspects which include health, education, entertainment and ecommerce. People need to be able to trust computer systems as the dependence on them increases. The Trustworthy Computing vision (CRA, 2003) refers to computer systems that are intuitive, controllable, reliable and predictable and that ensure availability and security. Secure cod- ing is not trivial and poor code security management may leave the developed web application vulnerable to attack or turn the application into a launch pad for serious attacks.

This paper is organized as follows: Section 2 provides background information to secure coding in web applications. Section 4 outlines the aims and objectives of the project. Section 5 briefly describes the design of the developed secure framework. Section 6 highlights the achievements of the project and Section 7 presents a conclusion. 2 Background Security vulnerabilities in a system can be at the application, server and network level. Unpatched software, viruses and trojan horses may all expose a system to attack. These security issues should be addressed in any system; however these can easily be bypassed with an attack on a web application. The aim of this project is to focus on the application-level security vulnerabilities which are introduced in the next subsections. (Howard and LeBlanc, 2003)

Web Application Vulnerabilities
This section presents a brief overview of the most common security vulnerabilities found in ecommerce web applications.

Cross-Site Scripting
Cross-Site Scripting is a form of input validation vulnerability (Howard et al, 2005). Any web application that directly echoes the user input to a webpage without validation has an input trust issue and is vulnerable with Cross-Site Scripting. Echoed input might be a client-side script which is then executed by the browser and runs in the context of the vulnerable domain, having access to the client side cookies.

SQL Injection
SQL injection is a common form of input validation vulnerability (Howard et al, 2005) resulting from the improper string concatenation of SQL commands with non-validated user input. The following code fragment builds a string containing an SQL statement constructed by concatenating SQL commands with user input.

Download pdf Secure Ecommerce Framework for the .NET Environment