Top three lists regarding web application security

When it comes to websites, WhiteHat Security found some interesting data that should be considered required reading for all web developers. Not to make your job more complicated, but to give you a better understanding of what threats your sites face.

• Most websites were exposed to at least one serious* vulnerability every day of 2010, or nearly so (9–12 months of the year). Only 16% of websites were vulnerable less than 30 days of the year overall.
• 71% of Education, 58% of Social Networking, and 51% of Retail websites were exposed to a serious* vulnerability every day of 2010.
• During 2010, the average website had 230 serious* vulnerabilities.
• SQL Injection vulnerabilities, despite large numbers of them being found and fixed during 2010, still occurred in 14% of websites.

So what does this mean for the average web developer? That we have to take a good look at the security of our websites because there is a pretty good chance we left an opening somewhere in our site.

KNOWING THE THREATS

Understanding what threats we face when writing code can help establish a foundation that can be used to help protect web sites against attackers. According to WhiteHat, the most prevalent vulnerabilities found in web site code are as follows:

1. Information leakage
2. Cross-site scripting
3. Content spoofing
4. Cross-site request forgeries
5. Brute force attacks
6. Insufficient authorization
7. Predicable resource location
8. SQL injection
9. Session fixation
10. Abuse of functionality

LEAST SECURE LANGUAGE

Knowing what coding languages are the least secure can also help you write more secure code. According to a report that ranked programming languages common to web development and ranked them by the average number of serious vulnerabilities found per site developed in them. The results are:

1. Perl – 44.8
2. Cold Fusion – 34.3
3. PHP – 26.6
4. JSP – 25.8
5. Microsoft ASP – 25
6. Struts DO – 19.9
7. Microsoft ASPX – 18.7

BEST PRACTICES FOR SECURE DEVELOPMENT

Finally, we turn to OWASP for the best practices they recommend for web developer to as guidance on implementing security mechanisms and avoiding vulnerabilities.

1. Validate user input
2. Use secure authentication services
3. Make sure only authorized users can perform actions allowed within their privilege level
4. Practice good session management
5. Protect your code against attacks from common interpreters
6. Protect confidentiality and integrity with cryptography
7. Use best practices when it comes to error handling
8. Protect the file system
9. Make sure your code runs securely out of the box, don’t assume it is the responsibility of the operator to secure it
10. Be aware that Web 2.0 technologies also pose security risks

Again, having knowledge of the different types of vulnerabilities that can threaten your code will not make you a security expert. However, having a understanding of what threats you face can help you write more secure code and in the long run, this can certainly make you a valuable asset to any development team.