Security for Web Apps

Question

I'm working on a web application and we are getting ready to launch it. Because it will hold sensitive data for users, I want this to be as secure as possible. Here is a list of what we are currently doing...

• Running the app on Heroku (Ruby on Rails)
• Site is encrypted with 256 SSL (with forced SSL turned on)
• Cookies are encrypted and we pass the Firesheep test
• Their password and everything in the database is one way encrypted.. so even if someone got access to the database it would be useless.
• We do not store any keys or passwords openly in the source code but rather use Config Vars

Other than that what else should/could we be doing. We are considering McAfee's site scan but they quoted us $2,500 a year. I'm not sure it's worth it.

Does anyone have any suggestions at all?

Answer 1

You can find information about common Ruby on Rails application vulnerabilities and their countermeasures at the Zen Rails Security Checklist, including most of the OWASP Top 10 items.

Answer 2

I'd recommend checking out the OWASP Top 10: http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf

The OWASP Top Ten provides a powerful awareness document for web application security. The OWASP Top Ten represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.

To verify your SSL configuration, you can try https://www.ssllabs.com/ssldb/index.html.

If you're curious about the sheer variety of attacks, check out Jeremiah Grossman's post titled Top Ten Web Hacking Techniques of 2010 and scroll down until you see "The Complete List".

If you want to fire off a few web app vulnerability scans tools to catch the low hanging fruit you can try:

• skipfish: http://code.google.com/p/skipfish/ (free)
• netsparker community: http://www.mavitunasecurity.com/communityedition/ (free)
• look here for more https://security.stackexchange.com/questions/32/what-tools-are-available-to-assess-the-security-of-a-web-application/

If you're really concerned about security then adopting a secure development plan and working with someone trained in app security would obviously boost your confidence things are being done right.

Regarding development, you may like the ideas presented in Microsoft's simplified SDL:

"The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development."

"The process outlined in this paper sets a minimum threshold for SDL compliance. That said, organizations aren’t uniform – development teams should apply the SDL in a way that is suitable to the human talent and resources available, but doesn’t compromise organizational security goals."

Also it is important to note automated vulnerability scan tools fail to identify most logical vulnerabilities so don't rely solely on automated tools. For example (taken from OWASP):

"Setting the quantity of a product on an e-commerce site as a negative number may result in funds being credited to the attacker. The countermeasure to this problem is to implement stronger data validation, as the application permits negative numbers to be entered in the quantity field of the shopping cart."

Human intelligence is key to spot logical issues.

Security is also all about maintenance. Assigning someone or a team the responsibility to astutely play continuous defense is important.

Note: Encrypting the passwords doesn't imply infallible security. Dictionary/password lists/brute force attacks work all the time to reveal weak passwords. A very common attack is to use SQL injection to dump the user table (with password hashes) then use a password cracker to discover legitimate user/password pairs.

Answer 3

Make sure to read the OWASP Top 10. Also $2,500 is a rip off, Sitewatch is free. You should also consider running a Web Application Firewall like mod_security, but keep in mind this will cause problems for testing tools like McAfee or Sitewatch. You should configure mod_security to allow specific ip addresses. Or test your application before enabling the WAF.

Answer 4

After ruling out the usual suspects (XSS, SQL injection, mass assignment, etc), client side is where most problems come from, and this is often overlooked. I don't know what your site is about, but things like telling your users that they shouldn't follow links on emails they did not explicitly request usually delivers highest bang-for-the-buck.

Best regards,

-- J. Fernandes