Cybersecurity and OWASP in an Increasingly Digital World

Clear and simple standards are important when it applies to things like overly complicated code. Sometimes, in the drive to make sure that code is secure, developers might forget to also take into account the best practices of application development, especially considering the immense time pressures they are under.

This is where the Open Web Application Security Project (OWASP) becomes a valuable guide. OWASP is a set of strict guidelines and criteria for application security. The OWASP checklist helps developers more easily integrate the recommended security standards while also helping to avoid coding flaws that can compromise security.

While OWASP is quite large in terms of how it goes about ensuring standards, here’s a quick review at the different methods it uses:

• Output Encoding: Any information entered by a user has to be encoded before being committed since it is a possible vector for attack. This means output needs to be contextually sanitized using a standard testing routine. In fact, .Net Core has output encoding built-in.

• Input Validation: It’s important to make sure that data that is input by a user is valid and doesn’t allow for any form of attack. This often takes the form of checking against a variety of lists that make sure that input data is either secure or not going to lead to some form of injection attack.

• Session Management: Ensuring the ability to handle several connections to a web app at the same time is vital to security. This is where HTTP as well as other techniques such as generating new session IDs on re-authentication and having session inactivity timeouts play a role.

• Cryptographic Practices: As with anything on the web, it is extremely important to maintain strict confidentiality and integrity of the data. Good cryptographic practices including secure failing of cryptographic modules, policies for cryptographic key management, and the use of and implementation of a trusted system are essential to achieve this.

• Communication Security: Man-in-the-middle attacks are much too common, and this is where it’s important to make sure that not only is the data secure from outside interception but that it’s also easily understandable by the authorized receiver. Strong implementation of TLS is important along with the appropriate configuration of the protocol.

• Database Security: Valid database credentials and turning off unnecessary features are paramount to ensuring database security standards.

• Memory Management: With a variety of memory-leak-related security breaches recently, it’s important to keep memory at the forefront of security considerations. For example, a buffer-overflow can be a huge security hole, and the same applies to a reliance on ‘garbage collection’ such as connection objects and file handles.

Given that there is often a disconnect between the most recent technologies and current skill levels, it can be important to get back to the basics when it comes to programming and cybersecurity. 

Keeping up to date with encryption standards is an important task that a lot of SecOps professionals might overlook or feel too busy to do. Similarly, keeping code simple is often something that more experienced developers tend to forget, and this can cause issues down the line for everybody involved.

Conclusion