85% of cyber-attacks target application vulnerabilities! With an application landscape ripe with an extensive variety, today’s developers leverage a potent mix of commercial, custom, and open source code in order to create quick and robust applications. With the rising complexity of these applications, application security has become profoundly important. This is the first post in a series of 2, where we’re going to holistically address the concept, importance and best practices of Application Security in today’s world.

What is application security and why we need it?

Hackers use unlawful code to manipulate your applications and access, steal, modify, or delete sensitive data. Application security solutions help minimize the risk of security breaches using a structured methodology which involves an array of hardware, software, and operational policies. You need appropriate security measures built into your applications in order to shield your applications from crumbling to misuse.

Application security vs software security

Have you wondered whether the terms application security and software security imply the same thing?Are these two one and the same?

According to Gary McGraw (a computer scientist, researcher and author of 12 books), Software Security is much bigger in comparison to application security. He elucidates that software security is a proactive approach while application security is a reactive approach. Gary maintains that application security takes place once software has been deployed (which makes it reactive)while software security, takes place within the per-deployment phase (which makes it proactive).

What are your thoughts on these? Do you think Application Security is merely reactive? Let us know in the comments. In the modern world of applications that range from simple productivity tools to intense gaming and enterprise-level apps, does application security still function only as a reactive approach?

What are Counter Measures?

Countermeasures, quite like the name suggests, are measures or actions taken to minimize the risk of a security breach. A basic countermeasure that most of you must be aware of is a Firewall!

Some common countermeasures are:

  • Routers
  • Encryption &decryption programs
  • Anti-virus programs
  • Spyware detection & removal programs
  • Bio-metric authentication systems.

What is threat modeling

Before getting into Threat Modeling, we want you to ponder over what a “Threat” is, in the realm of application security. A threat is a malicious or unplanned event, which has the potential to compromise an enterprise’s assets. A DoS (denial-of-service) attack can be classified as a malicious event while the failure of a storage device is an unplanned event. Either ways, both of these are potential threats to your application.

If you’ve ever prepared for ISO 27001 certification in your enterprise, you’d find it easier to understand Threat Modeling. Allow us to try to break it down to you.

A rigorous process that involves the following steps:

  • Carefully defining all enterprise assets
  • Identifying what each application does (or will do) with respect to these assets
  • Creating a security profile for each application
  • Identifying and prioritizing potential threats that could affect these applications and in turn the enterprise assets.
  • Documenting what countermeasures or actions can be taken when faced with a threat.
  • Documenting adverse events that have occurred and the actions taken in each case.

If you remember the DDoS attack from back in Oct 16, we’re about to tell you that they have only grown over the past year! Here’s how DDoS attacks are projected up to 2020.

What can you do stay safe and steer clear of these malicious events that haven’t even spared big hosting providers like Dyn? We’re going to follow up on this post with 10 best practices for Application Security. While you watch out for our next blog post where we’ll discuss about the 10 best practices to consider in Application Security, we want you to reach out to us for any security concerns you may have with your existing applications!

Staying on top of application security isn’t easy as pie and in most cases often done wrong without professional guidance. To have a plan in place is the very beginning of establishing a tough front against attacks like the massive DDoS attacks from Oct ’16. We’ve outlined 10 best practices to consider when taking an organized approach to web application security. When you sit down with your IT team and create a strong plan, do keep these in mind.

10 Best Practices for Web Application Security

Enough about us, without much ado we’re going to dive into outlining the 10 Best Practices for Web Application Security.

Here’s a list to help:

  • Establish basic security
  • Start with a blueprint
  • Create application inventory
  • Prioritize applications
  • Identify and prioritize susceptibilities
  • Adjust the privileges that your application use
  • Use cookies securely
  • Implement HTTP with SSL/TLS
  • Other little tips
  • Awareness trainings

Establish Basic Security

When it comes to implementing Application Security, it’s safe to assume that it will take anywhere between a few weeks to a few months even for a fairly small organization. There’s much to do and you must already realize that with the above-stated list. To successfully prepare a list of web applications and outline all nitty-gritty associated, you will take a substantial amount of time. In the interim, it isn’t wise to leave your business exposed and vulnerable. We recommend that you put in place, a few basic security measures even before you kick-start the actual process.

a. Remove unnecessary functionalities from applications. Uncalled and unused functionalities are best turned off. They pose a risk being identified and not modernized to handle potential threats. So turn them off for good.

b. A web application firewall (WAF) is the simplest and the most basic countermeasure, which helps protect against most exposures. A WAF can not only block unwanted traffic, but also helps steer clear from the likes of XSS, SQL injection etc.

Start with a Blueprint

There are three ways to deal with application security:

  • You choose to do so manually
  • through a cloud solution
  • through software that you have on site
  • Choose a local managed service provider
  • Choose to employ a remote team of specialists

Start with understanding who you’re going to engage with and then move on to charting out the steps. Create a simple blueprint of your organization and define where you’d start. Outline your organization’s goals, and if your organization is large enough, identify and include names of people responsible in the blueprint.

Create Application inventory

Create a detailed inventory of all the applications your organization relies on. This could be a daunting task even for a small organization. While you may think you already have a list, there are many applications running right now, which you don’t ever remember installing. We call these rogue applications that go unnoticed unless a critical issue arises.

While creating the inventory, ensure that you also note down what the purpose of each application is. Chances are that when you’re done with this inventory, you’d be able to point out many redundant and pointless apps. “Do not miss even a single application” goes without saying!

Important note:

While creating the inventory, also make note of the permissions each of these applications employs. We will discuss more on this in #6.

Prioritize these Applications

Regardless of what you perceive, we’re going to tell you that the inventory is going to be pretty long. So the next step would be to break it down using proper prioritization.

Use these 3 categories to sort your apps:

  • High
  • Medium
  • Low

High

What goes into high, medium and low? “High” should ideally comprise of applications that deal with sensitive data (such as customer data) or are liaising with external entities. These apps are the most likely and vulnerable targets for hackers.

Medium

“Medium” should contain apps that are used for internal purposes and occasionally interact with sensitive information.

Low

“Low” as you might’ve already guessed, is a list of apps that have far less exposure and while they aren’t pressing, they must be included down the road.

Susceptibilities: Identify and Prioritize

With your application inventory ready, the logical next step would be to identify the susceptibilities of these applications. As you put together your list of web applications, you need to prioritize the identified vulnerabilities. This basically means which of the risks need mitigation and which of these you’d accept.

Simply put, you’ll create action plans for the susceptibilities that are marked high priority and risk acceptance for the other. When Sucuri analyzed 9000 infected websites in Q2 ‘16 and categorized them by platform here’s the result:

Keep in mind that when actual testing happens, you may realize that you overlooked some of the issues. It happens and shouldn’t stop you from hitting the brakes temporarily in order to recheck your list and plan again. Since you’re starting from scratch now, it will be a lot easier down the road. So move on to testing now and give it your best shot!

Adjust Application privileges to a minimum

Every web application runs using specific privileges. These privileges provide it access to both, local and remote computers. It is imperative that we adjust these privileges to a bare minimum in order to avoid threats or attacks via the applications.
user Profiling

Adjust user privileges as well for every application. For most application only the admin or the super admin would need complete access. You need to button it down for all other users. If a user need for permission arises at a later point, it can be addressed via a proper workflow/process. Most users can accomplish their regular tasks with minimal permissions except some high-level business users. Perform a little routine of user-profiling to address this.

Use Cookies Securely

Cookies are incredibly convenient for businesses and users alike – there are an overwhelming set of advantages when your application uses cookies. For instance, cookies help greatly in re-targeted advertisements and for providing a personalized experience to returning patrons. But cookies also are a major weak-link that hackers are great at exploiting.

Stop using Cookies? Hell no! Just be clever with adjusting the settings.

3 ways

  • Cookies shouldn’t be used to store sensitive information. E.g. user passwords.
  • Don’t keep everlasting cookies, no matter how appealing that sounds! Set expiration dates to avoid misuse by hackers.
  • Use adequate encryption to ensure your cookies aren’t easily readable by external sources.

Implement HTTP with SSL/TLS

This might seem a bland statement but trust us, this implementation is supremely helpful. The history of cyber-attacks statistically states that HTTPS implementation has innocuously helped in guarding against 30% of attacks!

So here’s what you should do – implement HTTPS! But that alone isn’t enough – that’s about half the job done. You need to work on the DNS side of things and redirect all your traffic to HTTPS! A pro tip would be to use an updated version of TLS instead of relying on SSL. There are numerous reasons why but that beats the purpose of this post. Remind us to blog on that another day

Good to know

Here are a few“immediate” web application security suggestions that you can implement as a business or website owner. Follow these quick tips:

  • Implement x-xss-protection security header.
  • Implement a content security policy.
  • A string password policy is a must.
  • Apply subresource integrity (SRI) to resource’s

Why Dolphin 24×7

We’re the infrastructure mavens who can help you with all-thing-infra. Right from modernizing infrastructure to setting up scalable robust ones, we can do it all! For server setup and management, web hosting support, help desk support and anything under the roof, call us at +1-516-717-2049 and rest assured, your infrastructure will be as tough as our expertise!