Introduction to Application
Security
Security threat is the most serious issue experienced by all not in application but
also in all space, how a house without proper security amenities will possess
security threat from the foreign objects similar to that web applications are also
possess the vulnerable attacks by the unintended users, Because of this critical
part the intended users of the web application faces the loss of their privacy,
integrity sometimes their resources also.
What is Application Security?
Application security is a mechanism, Practices & procedures to safeguard the
resources of the application, ensure the proper privacy of the users and their
information’s, proper privileges & rights management.
Application security principles
1.
Principle of least privileges to be
adopted: - To avoid and limit the impending damage processing of script or the
execution of code should be routed via least privileged account.
2.
Practice the defense mechanism should be in
depth: - Place the check point in each & every layer of the application and
validate the credentials and authorize the users to access the next levels.
3.
Do not trust on user input: - Validate
the all user inputs before computing any operations and preventive measure to be
taken.
4.
Practice secure defaults: - Employ common
security standards to application to reduce the settings of security.
5.
Validate input at the gate: -
Authenticate the user at the entry level of the application will minimize the
security risks.
6.
Fail to a secure mode:
– inform the user by limited error message if application fails
and do not leave valuable data unprotected.
Types of Common web application
attacks
There are several attacks which are frequently exploited by hackers and some common
attacks are,
1.
SQL Injection
2.
Cross Site Scripting (XSS)
3.
Malware Execution
4.
Denial of service
5.
Cracking unsecured passwords
6.
Breaking of insecure Session Management
Security Practices in .Net
The basic security feature Authentication and Authorization should be used in
applications to avoid and minimize the security threats. Let's
see what is Authentication and authorization,
Authentication: -“ Authentication is the mechanism whereby systems may securely identify their clients positively. Authentication systems provide answers to the questions:
·
Who is the user?
·
Check whether the user exist or not in the system?
Types of Authentication:-
1.
Forms based Authentication :- The logon form prompts credentials of user and the inputs are
authenticated by means of the server
2.
Windows Authentication :- Authenticate the users to accessing the application by having
their existing user accounts within the local user database of the Web server or
Active Directory.
3.
Passport authentication :- Authenticate by means of web service provided by
Microsoft's Passport, Which is a centralized authentication
service provided by Microsoft that offers a single logon and core profile services
for member sites.
Authorization: - It is the mechanism by which a system determines what level of access a particular authenticated user should have to secure resources controlled by the system. In simple, user has right to access specific data or not.
Types of Authorization:-
1.
URL Authorization
2.
File Authorization
3.
Authorization based on ACLs
