PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

362 Chapter 16 Web Application Security
with the appropriate balance between the need to protect ourselves and the need to
actually do business and have a working application.
Start with the Right Mindset
Security is not a feature.When you are writing a web application and deciding the list of
features that you want to include, security is not something that you casually include in
the list and assign a developer to work on for a couple of days. It must be constantly part
of the core design of the application, and it is a never-ending effort, even after the application
is deployed and development has slowed, if not outright ceased.
By thinking of and planning for, right from the beginning, the various ways in which
our system could be abused or through which attackers might try to compromise it, we
can design our code to reduce the likelihood of these problems occurring.This also saves
us having to try to retrofit everything later on when we finally do turn our attention to
the problem (when we are almost certain to miss many more potential problems).
Balancing Security and Usability
One of the greatest concerns we have when designing a user system is the users’ passwords.
Users will often choose passwords that are not particularly difficult to crack with
software, especially when they use words readily available in dictionaries.We would like a
way to reduce the risk of a user’s password being guessed and our system being compromised
through this.
One possible solution is to require each user to go through four login dialogs, each
with a separate password.We can also require that the user change these four passwords
at least once a month and make sure they never use a password they have used in the
past.This would make our system much more secure, and crackers would have to spend
significantly more time getting through the login process and into the compromised system.
Unfortunately, our system would be so secure that nobody would bother to use it—at
some point they would decide that it was simply not worth it.This illustrates the point
that just as it is important to worry about security, it is also important to worry about
how this affects usability. An easy-to-use system with little security might prove attractive
to users, but will also result in a higher probability of security related problems and possible
business interruptions. Similarly, a system with security that is so robust as to be
borderline unusable will attract few users and also very negatively affect our business.
As web application designers, we must look for ways to improve our security without
disproportionately affecting the usability of the system. As with all things related to the
user interface, there are no hard and fast rules to follow, so instead we must rely on some
personal judgment, usability testing, and focus groups to see how users react to our prototypes
and designs.