Web 2.0 Security Part 5: Strategies to CUT RISK

Over the past few weeks we've examined the issues inherent with Web 2.0 and in particular AJAX-based applications. These issues need to be dealt with, but they should not be considered "show stoppers" to moving ahead with your Web 2.0 initiative. Consider the security ramifications of the design, implementation, and deployment of your new application carefully. Build security into your new application up front and you'll certainly be able to decrease the potential risks associated with this growing technology.

Consider the following methods to CUT the RISK associated with deploying Web 2.0 applications:

•Check VA tools for AJAX support. Validate that the assessment and test tools you use to verify the security of your applications are capable of:

• Interpreting and evaluating dynamic URLs from JavaScript
• Creating (or capturing at a minimum) requests in the appropriate markup languages
• JSON, XML, D/HTML

•Understand the application. Document and examine regularly:

• Scripts associated with the application
• Data sources accessed
• Access patterns
• Cookies used

•Trust no client. Implement policies that assumes the request is coming from an attacker

• Validate input
• Validate request
• Validate client

•Reduce the number of scripts. If possible, reduce the number of scripts/applications to reduce the entry points through which attackers can gain entry/access to the application

•Invest in a web application firewall. Web Application Firewalls mediate between client and server and provide:

• Application security through request verification
• Client security through response verification
• Not a panacea, but a first line of defense
• Cannot stop logic layer attacks

•Secure sensitive data using SSL.

• SSL for transport layer encryption
• Cookie encryption

•Kick back suspicious data. Data Integrity should be validated on both request and response

• Stop sensitive data from leaving the organization
• Stop malicious data and code from entering the organization
• Choose from one or more options: code (custom), software, hardware

Imbibing: Coffee