Architecture and Design Considerations - Build Security In - US-CERT

» Configure your TLS provider to only support strong (e.g. FIPS 140-2 compliant) algorithms.
» Ensure your certificate is valid, not expired, not revoked, and matches all domain used by the site.
» Backend and other connections should also use TLS or other encryption technologies.
Securing the Password Process
The username and password are important forms of authenticating the user, but with weak passwords and poorly developed
“forgot-password” features, a user’s account can be easily infiltrated. To protect the users from creating weak passwords,
passwords should have strongly enforced rules and expectations; OWASP’s Secure Coding Practices Quick Reference Guide
suggests the following:
» Enforce password complexity requirements established by policy or regulations. Authentication credentials should be
sufficient to withstand attacks that are typical of the threats in the deployed environment. An example of password
complexity is requiring alphabetic as well as numeric and/or special characters in the password.
» Enforce a minimum length requirement for the password, as established by policy or regulations. OWASP
recommends at least eight characters, but sixteen characters or the use of multi-word pass phrases will provide a
better solution.
» Enforce password changes based on requirements established in policy or regulations. Critical systems may require
more frequent password changes.
» Prevent password re-use; passwords should be at least one day old before they can be changed.
» Disable the account after a certain number of failed login attempts.
» Display generic error messages when a user types in an incorrect username or password.
» Store passwords in the database as salted hash values.
Carefully thought-out security measures for passwords are often broken when a user forgets his or her password. When
developing the “forgot-password” feature, Dave Ferguson recommends that the application performs the following procedure
before allowing the user to change their password:
1. Ask for the username and hard data. Examples of hard data are the user’s last four digits of their social security
number, telephone number, birth date, zip code, and/or customer number. The application should display a generic
error message, such as “Sorry, invalid data”, if the data provided is incorrect.
2. Ask the user to answer two or more of the user’s pre-established personal security questions; when developing these
security questions, do not allow the user to type in their own questions.
3. Finally, allow the user to reset their password but with password complexity requirements that exist throughout the
application, avoid sending the username as a parameter when the form is submitted.
To add additional security to this process, Ferguson recommends that after Step 2, the application sends a randomly-generated
verification code (8 or more characters) to the user’s phone or email, and then require the user to type the verification code into
the application as they perform Step 3 (resetting their password). The downside to this approach is the phone or email stored
within the system might be obsolete or invalid.
Preventing Content Injection
Content injection attacks occur when attackers insert malicious code or content into a legitimate site. During a content injection
attack, attackers inject malicious content using Cross-Site Scripting (XSS), Cross Site Request Forgery (CSRF), and/or SQL
injection. Although many sites are aware of these threats and have programs in place to find and remediate the vulnerabilities,
the sheer size and complexity of the websites can make complete remediate of the security weakness implausible.
Content Security Policy (CSP) is one of the many mechanisms used to mitigate broad classes of content injection vulnerabilities.
CSP is a declarative policy framework that enables web authors and server administrators the ability to specify the permitted
content in their web applications and the ability to restrict the capabilities of that content. CSP provides a method for the server
to communicate with the browser, by providing a policy on how content on their website is expected to behave. With proper
implementations of CSP, it can mitigate and detect content injection attacks such as XSS and CSRF.
Architecture and Design Considerations for Secure Software 20