Improving Web Application Security: Threats and - CGISecurity

38 Part I: Introduction to Threats and CountermeasuresPoor Key Generation or Key ManagementAttackers can decrypt encrypted data if they have access to the encryption key or canderive the encryption key. Attackers can discover a key if keys are managed poorly orif they were generated in a non-random fashion.Countermeasures to address the threat of poor key generation and key managementinclude:● Use built-in encryption routines that include secure key management. DataProtection application programming interface (DPAPI) is an example of anencryption service provided on Windows 2000 and later operating systems wherethe operating system manages the key.● Use strong random key generation functions and store the key in a restrictedlocation — for example, in a registry key secured with a restricted ACL — if youuse an encryption mechanism that requires you to generate or manage the key.● Encrypt the encryption key using DPAPI for added security.● Expire keys regularly.Weak or Custom EncryptionAn encryption algorithm provides no security if the encryption is cracked or isvulnerable to brute force cracking. Custom algorithms are particularly vulnerable ifthey have not been tested. Instead, use published, well-known encryption algorithmsthat have withstood years of rigorous attacks and scrutiny.Countermeasures that address the vulnerabilities of weak or custom encryptioninclude:● Do not develop your own custom algorithms.●●Use the proven cryptographic services provided by the platform.Stay informed about cracked algorithms and the techniques used to crack them.Checksum SpoofingDo not rely on hashes to provide data integrity for messages sent over networks.Hashes such as Safe Hash Algorithm (SHA1) and Message Digest compressionalgorithm (MD5) can be intercepted and changed. Consider the following base 64encoding UTF-8 message with an appended Message Authentication Code (MAC).Plaintext: Place 10 orders.Hash: T0mUNdEQh13IO9oTcaP4FYDX6pU=