Assessing the Security of Your Web Applications
Now we know in theory how a malicious user thinks. We also have some idea about who may be at risk. The remainder of this article will focus on security issues and measures that can be implemented by web site developers in protecting an organization's assets. This is important because the web site administrators cannot easily enforce the client-side security measures. What follows is a list and description of security-related exposures.
A cookie is a small piece of data which is sent from a web server to a web browser when that browser visits the server's site. The cookie is stored on the user's machine, but it is not an executable program and cannot do anything to that machine. However, cookies may allow a malicious user to hijack web sessions and view, modify or otherwise exploit the information related to another user's session. A hacker may obtain the cookie by various means, including physical access or network sniffing, as well as guessing the cookie's contents. Next, the hacker can try to impersonate the user by hijacking the user's sessions. This is an especially serious issue with shared workstations, cyber cafés and public kiosk environments.
Sometimes cookies are used to store information such as user host name, password, account ID, session ID and other user profile information. Cookies are often used to maintain session information between the user and his shopping cart. Two types of cookies exist:
Persistent cookies have an expiration date and are stored on a user's hard disk until that date. A persistent cookie can be used to track a user's browsing habits by identifying her whenever she returns to a site.
Non-persistent cookies are stored in the web browser's memory. They last only until the browser is closed and are then destroyed.
If a user is able to capture the cookies by sniffing on the network, or by any other means, he may be able to gain unauthorized access to personal information, including credit card number, passwords, user ID and mailing address.
The security measures you can take are:
Use non-persistent cookies instead of persistent cookies.
If you must use persistent cookies, then specify a short duration for the cookie's life. The longer the time until cookie expiration, the larger the risk.
Avoid application features that use persistent cookies to store privacy-related information. Example: “Please check to remember user name and password.”
Use the secure tag, so that the cookie is sent only if a secure channel (https) is being used.
Encrypt the information in the cookies. Some web sites split one cookie into many cookies that are further encrypted.
Very simply, form manipulation involves saving a web site's form and editing it off-line. Many times, this involves adding more entries to pull-down lists or increasing the size of text fields. The intent is usually to cause a buffer overflow on the server. In the past, client-side form validation has been used to offload the performance load from the server. While client-side validation is a good technique from a performance point of view, it is not the preferred solution from a security point of view. Poorly designed web applications may contain hidden fields that contain user IDs, account IDs or other key fields that define user sessions. Again, all this information can be manipulated off-line to gain access to another user's session.
Form manipulation is a simple technique and requires only a knowledge of HTML. Experienced programmers may be able to alter and submit forms by guessing the server-side code used to process the forms.
The following measures should be implemented to improve the security of an application against form manipulation:
Perform referrer checks on the server side. This will ensure that a given form was reached from the page that contains the hyperlink providing access to the form.
Process and validate the form input field values entered by the user for range, expected input (e.g., numeric vs. alphabets), strange characters and any other associations specific to the user.
Do not store critical user information in hidden fields in the form.
Practical Task Scheduling Deployment
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.View Now!
|The Firebird Project's Firebird Relational Database||Jul 29, 2016|
|Stunnel Security for Oracle||Jul 28, 2016|
|SUSE LLC's SUSE Manager||Jul 21, 2016|
|My +1 Sword of Productivity||Jul 20, 2016|
|Non-Linux FOSS: Caffeine!||Jul 19, 2016|
|Murat Yener and Onur Dundar's Expert Android Studio (Wrox)||Jul 18, 2016|
- The Firebird Project's Firebird Relational Database
- Stunnel Security for Oracle
- My +1 Sword of Productivity
- SUSE LLC's SUSE Manager
- Non-Linux FOSS: Caffeine!
- Managing Linux Using Puppet
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Google's SwiftShader Released
- Parsing an RSS News Feed with a Bash Script
- Doing for User Space What We Did for Kernel Space
With all the industry talk about the benefits of Linux on Power and all the performance advantages offered by its open architecture, you may be considering a move in that direction. If you are thinking about analytics, big data and cloud computing, you would be right to evaluate Power. The idea of using commodity x86 hardware and replacing it every three years is an outdated cost model. It doesn’t consider the total cost of ownership, and it doesn’t consider the advantage of real processing power, high-availability and multithreading like a demon.
This ebook takes a look at some of the practical applications of the Linux on Power platform and ways you might bring all the performance power of this open architecture to bear for your organization. There are no smoke and mirrors here—just hard, cold, empirical evidence provided by independent sources. I also consider some innovative ways Linux on Power will be used in the future.Get the Guide