Improving Web Application Security: Threats and - CGISecurity

120 Part II:Designing Secure Web ApplicationsHow Do You Secure Encryption Keys?The encrypted data is only as secure as the key. To decipher encrypted data, anattacker must be able to retrieve the key and the cipher text. Therefore, examine yourdesign to ensure that the encryption keys and the encrypted data are secured.Consider the following review questions:● How do you secure the encryption key?If you use DPAPI, the platform manages the key for you. Otherwise, theapplication is responsible for key management. Examine how your applicationsecures its encryption keys. A good approach is to use DPAPI to encrypt theencryption keys that are required by other forms of encryption. Then securelystore the encrypted key, for example, by placing it in the registry beneath a keyconfigured with a restricted ACL.● How often are keys recycled?Do not overuse keys. The longer the same key is used, the more likely it is to bediscovered. Does your design consider how and how often you are going torecycle keys and how they are going to be distributed and installed on yourservers?Parameter ManipulationExamine how your application uses parameters. These parameters include formfields, query strings, cookies, HTTP headers, and view state that are passed betweenclient and server. If you pass sensitive data, such as session identifiers, usingparameters such as query strings, a malicious client can easily bypass your serverside checks with simple parameter manipulation. Table 5.8 shows the most commonparameter manipulation vulnerabilities.Table 5.8 Common Parameter Manipulation VulnerabilitiesVulnerabilityFailing to validate all inputparametersImplicationsYour application is susceptible to denial of service attacks andcode injection attacks, including SQL injection and XSS.Sensitive data in unencryptedcookiesSensitive data in query stringsand form fieldsTrusting HTTP headerinformationUnprotected view stateCookie data can be changed at the client or it can be capturedand changed as it is passed over the network.This is easily changed on the client.This is easily changed on the client.This is easily changed on the client.