Vaidas Žilionis Internetas, technologijos, programavimas…

Beskaitant rytinę rss naujienų dozę radau vieną įrašą “Web Application Security Reviews” patiko keletas tesisingų minčių. Štai ir jums paskaityti orginalia kalba

1. All important work processes must include a maker and a checker. In other words, if i make an important request (the maker), then someone else must check and authorize (the checker).
2. All transactions must store an unique ID, parties who were active in the transaction, the data that was changed (before and after) and a timestamp.
3. All database passwords used in PHP/ASP must be encrypted.
4. Tripwire (to detect files that have been modified) must be installed if the web app is open to the Internet.
5. Database connection (and password decryption) must be made through DLL or compiled script.
6. The password key should not be stored in clear text in the compiled code, but obfusticated or split into multiple parts.
7. Users must change passwords on first login.
8. All database passwords must be encrypted using the bank’s favorite algorithm (eg. SHA-1, 3DES, AES, etc).
9. All user passwords must be encrypted using the bank’s favorite algorithm (eg. SHA-1, 3DES, AES, etc).
10. Users are locked out after X failed attempts. An exception is made for the main administrator.
11. Users can be barred from logging in.
12. All critical passwords of powerful accounts have to be split and held by 2 people.
13. All passwords must be a mix of alpha and numeric, and of a configurable minimum length.
14. Passwords must be changed every X days, typically 30-90 days.
15. Passwords cannot be repeated X times; the highest value i have seen is 24.
16. Passwords must not begin with the first X characters of user id.
17. Session keys must be regenerated on every login [use regenerate_session_id()]. In one case, the audit team used a http proxy server to confirm this and the next item.
18. Cookies must not hold important information, eg. only the session id and similar info.
19. Cross-site scripting was tested. The same audit team entered <script>alert(‘attack’)</script> in a sampling of our input fields.
20. Reports such as “accounts dormant for more than X days”, “login attempts and failures”, “user access matrix” have to be available.
21. File permissions are also audited and limited.
22. No service nor job is allowed to run with superuser rights.
23. Session timouts are configurable, and browser must logoff the user after timeout (this has to be done with Javascript as PHP sessions are not removed immediately)
24. Administrator can force a user to logout remotely (this means giving a UI for manually deleting the session records stored in the database)

Šaltinis PHPLens.com

Įdomu keliomis išjų laikomės mes ?