Improving Web Application Security: Threats and - CGISecurity

Chapter 5: Architecture and Design Review for Security 117How Do You Store Sensitive Data?If you store sensitive application data, such as custom credit card details, examinehow you protect the data.● What encryption algorithm do you use? You should encrypt the data using astrong encryption algorithm with a large key size, such as Triple DES.● How do you secure the encryption keys? The data is only as secure as theencryption key, so examine how you secure the key. Ideally, encrypt the key withDPAPI and secure it in a restricted location, for example, a registry key.Do You Pass Sensitive Data Over the Network?If you pass sensitive data over the network, check that the data is either encrypted bythe application or that the data is only passed over encrypted communication links.Do You Log Sensitive Data?Examine whether or not your application (or the host) logs sensitive data such as useraccount passwords in clear text log files. You should generally avoid this. Make surethe application does not pass sensitive data in query strings because these are loggedand are also clearly visible in the client’s browser address bar.Session ManagementBecause Web applications are built on the stateless HTTP protocol, sessionmanagement is an application-level responsibility. Examine the approach to sessionmanagement by your application because it directly affects the overall security ofyour application. Table 5.6 shows the most common vulnerabilities associated withsession management.Table 5.6 Common Session Management VulnerabilitiesVulnerabilityImplicationsPassing session identifiers over Attackers can capture session identifiers to spoof identity.unencrypted channelsProlonged session lifetimeInsecure session state storesSession identifiers in querystringsThis increases the risk of session hijacking and replay attacks.Attackers can access the private session data of a user.Session identifiers can easily be modified at the client to spoofidentity and access the application as another user.