Improving Web Application Security: Threats and - CGISecurity

620 Part V: Assessing Your Security●●Do you log exception details?Check that exception details are logged at the source of the exception to assistproblem diagnosis.Do you use exception filters?If so, be aware that the code in a filter higher in the call stack can run before codein a finally block. Check that you do not rely on state changes in the finally block,because the state change will not occur before the exception filter executes.For an example of an exception filter vulnerability, see “Exception Management”in Chapter 7, “Building Secure Assemblies.”Do You Use Cryptography?If so, check that your code does not implement its own cryptographic routines.Instead, code should use the System.Security.Cryptography namespace or use Win32encryption such as Data Protection Application Programming Interface (DPAPI).Review the following questions to help identify potential cryptography relatedvulnerabilities:● Do you use symmetric encryption?If so, check that you use Rijndael (now referred to as Advanced EncryptionStandard [AES]) or Triple Data Encryption Standard (3DES) when encrypted dataneeds to be persisted for long periods of time. Use the weaker (but quicker) RC2and DES algorithms only to encrypt data that has a short lifespan, such as sessiondata.● Do you use the largest key sizes possible?Use the largest key size possible for the algorithm you are using. Larger key sizesmake attacks against the key much more difficult, but can degrade performance.●●Do you use hashing?If so, check that you use MD5 and SHA1 when you need a principal to prove itknows a secret that it shares with you. For example, challenge-responseauthentication systems use a hash to prove that the client knows a passwordwithout having the client pass the password to the server. Use HMACSHA1 withMessage Authentication Codes (MAC), which require you and the client to share akey. This can provide integrity checking and a degree of authentication.Do you generate random numbers for cryptographic purposes?If so, check that your code uses theSystem.Security.Cryptography.RNGCryptoServiceProvider class to generaterandom numbers, and not the Random class. The Random class does not generatetruly random numbers that are not repeatable or predictable.