How to Ensure Web Security, for Small and Medium Scale Projects

Content

• What is web application security?
• How website or web application get hacked?
• Web application vulnerabilities
• How to make a website secure
• Web application security checklist

It is a process of protecting small and medium web projects and online services against different kinds of web security threats that exploit vulnerabilities in an application’s code or at the hosting server. Common targets for web application attacks are CMS like WordPress, Drupal, Shopify, etc.., application architecture, database admin tools (e.g., phpMyAdmin), SaaS applications, hosting servers, and infrastructure.

When website/ Web applications are considered high-priority targets:

• The fundamental complexity of source code increases the possibilities of forgotten vulnerabilities and malicious code manipulation.
• High-value rewards, including sensitive private data collected from successful source code manipulation.
• With the ease of implementation, most attacks can be easily automated and launched indiscriminately against thousands, or even hundreds of thousands of targets at a time.

Organizations that are not taking the security of their web applications as a priority can be at the risk of being attacked. With other effects, such negligence can result in information theft, revoked licenses, and legal proceedings.

Before knowing how to prevent your website or web applications from getting hacked, we should know how web apps are hacked.

No set way says that a website is hacked but there are few patterns. If your site has been hacked, you can smell it because something will be very wrong. Here are some common ways hacking presents itself:

• Ransomware – The hacker threatens to publish your data and withhold access to your site unless a ransom sum is paid.
• Gibberish hack – There may be loads of auto-created pages filled with keywords and gibberish on your site, aiming of getting them to rank on Google for key terms. They generally redirect to a dodgy site.
• Cloaked keywords hack – As like gibberish hack, but like sophisticated – at a first glance, these will look like your pages, but content is altered.
• Japanese keywords hack – Creates random pages in Japanese keywords full of affiliate links to stores selling fake merchandise.
• Malicious code/viruses – malicious code or a virus will force your site to go down, or you could be unable to access it. You may also find that your hardware is also affected.
• Denial of Service (DoS) – Hackers use bots to overload your website with requests and crash the server.
• Phishing – Scammers contact your clients with your branding as look-a-like web pages and pretend to be part of your business in the hope of finding personal information.

Let’s see a few web app vulnerabilities. Web application vulnerabilities are mainly the result of a lack of input/output decontaminate, which are often exploited to either manipulate source code or found unauthorized access.

Such vulnerabilities invite the different web attacks, including:

• SQL Injection – It Occurs when a hacker uses malicious SQL code to manipulate a backend database to reveal information about the web application. Its effects include the unauthorized viewing of lists, deletion/edition of tables, and unauthorized administrative access.
• Cross-site Scripting (XSS) – It is an injection attack targeting access accounts, activating Trojans, or modifying page content. XSS occurs when Trojans or malicious code is injected directly into an application code. Reflected XSStakes place when malicious script is reflected off of an application onto a user’s browser.
• Remote File Inclusion – This kind of attack happens on the server side. Generally, hacker uses this to remotely inject a file onto a web application server. This will execute the malicious scripts or code within the application, as well as creates data theft and manipulation.
• Cross-site Request Forgery (CSRF) – CSRF attacks causes the malicious user to execute actions using the credentials of another user without concerning the user’s knowledge. An attack that could result in a password change, unsolicited transfer of funds, or data theft. It’s caused when a malicious web application makes a user’s browser perform an unwanted action on a site to which a user is logged on.

Including these threats or vulnerabilities there are a few other common attacks/vulnerabilities which are:

• Clickjacking (https://developer.mozilla.org/en-US/docs/Learn/Server-side/First_steps/Website_security)
• Denial of Service
• Directory Traversal
• File Inclusion
• Command Injection`

Security is important for everyone. One research confirms that 35% of all web owner consider web security as their number one priority.

There are a few steps in your website and web application journey to secure them from different attacks and vulnerabilities. Such methods/steps are as below:

• Web Application Firewall (WAF) – WAFs are hardware and software solutions for the protection of applications from security threats. It is designed to examine incoming traffic to block attack attempts, thereby compensating for any code sanitization deficiencies.
• Install SSL – buy simple Secure Sockets Layer (SSL) certificate and install it on your website or web application.
• Anti-malware software – Buy and install anti-malware software to your server to scan for and prevent malicious attacks.
• Make your passwords uncrackable – Your password must be uncrackable.
• Keep your website up to date – Out dated software in your server is like leaving your back door without a lock.
• Don’t help the hackers – Always be conscious of phishing emails and other scams.
• Manually accept on-site comments – keep control over potentially dodgy comments.
• Run regular backups – Run your regular back to prepare for the worst-case scenario so you can use your latest backup restore in case of hacked.

Let’s see a few security checklist for your website or web application before, during and after going on online/virtual world. These processes should be part of any web application security checklist:

• Information gathering – Do proper QA. Manually test/review the application and check all entry points and client-side codes. Classify third-party hosted content.
• Authorization – Test the application for path traversals; vertical and horizontal access control issues; missing authorization and insecure, direct object references.
• Cryptography – Secure all data transmissions. Check that any portion of data has been encrypted? The algorithm is good? Do randomness errors exist?

Refer to the OWASP Web Application Security Testing Cheat Sheet for additional information for details study and information.

---