6 steps for securing a web application

Cyber ​​security issues and challenges have never been as critical for business leaders, IT managers, and other CIOs as they are today. Beginning from the assumption that the your web app’s host environment is already secure, this article will focus on detailing some of the steps necessary to secure your web app internally.

Of course, we should note that this article doesn’t claim to be a complete and perfect guide to ensuring the security of your web application 100% – but we will still try to provide some useful courses of action to take and consider.

1. Make your web app’s security a central issue

Your company’s security policy should be strong and comprehensive. In the same way that you would approach health and safety rules within your organization, transpose the mentality to the safety of your application – which should meet certain safety and hygiene rules.

The flaw that’s most widely-exploited by hackers is the human. Human errors are made constantly when handling of online software tools, such as:

• ‘Unique’ passwords used more than once.
• Weak passwords.
• Poor data security: we have all seen a list of passwords saved on a computer’s notepad, a cell phone or even on a piece of paper a desk …
• Extremely easy password access levels.

All of these flimsy gateways are potential entry points for people with malicious intentions.

2. Keep it simple and stick with what’s useful.

Are all the elements that make up your IT system useful?

The goal is to reduce the surface area that can be attacked to a bare minimum. There is an urgent need to minimize the potential entry points for hackers.

To do this, review the digital assets used in all work environments: development, recipes, pre-production, and production. Are all the applications necessary for the proper functioning of your business? APIs, webservices – don’t forget to comb through everything.

3. Libraries: make the right choices and update them regularly!

More than three quarters of an application’s code is composed of libraries. These libraries are indeed “foreign” and were not developed by your developers.

A maintenance routine should be set up for these libraries.

In that routine, it will be necessary to carry out several maintenance operations:

• Step 1: Check that each library integrated into the web application has a use and therefore a justified presence.

• Step 2: Ensure that all the libraries being used are reliable and recognized by the community of developers using the language. In this way, we can avoid the worst: using a library in your web app that contains malicious code. Many libraries are classified as vulnerable. Do your research well before integrating external libraries with your own software.

• Step 3: Update the libraries, and maintain them. Set up a tool that will send an alert (notification) when the library needs updating. The updates can correct flaws, and are essential for stability, peace of mind and reducing the potential of attack.

4. Stay discreet

Keep the makeup of your application architecture to yourself and/or your team as much as possible – don’t be too talkative about it. Otherwise this confidential information can become a problematic information leak concerning the very skeleton of your web app.

One of your developers could, without malicious intent, copy a piece of code to a forum in order to get help from the community. Hackers can easily sneak into the community and get their hands on this piece of code, which can potentially give them access to critical components of your web app and ultimately your business.

So, in order to avoid revealing your code, your business logic or your architecture, train your teams to understand and apply these precautions.

5. Test and stress the functional uses of your application

In order to identify critical vulnerabilities, plan a review of the most critical use cases for your application – those with higher potentials for intrusion.

• Is the ‘forgot password’ process secure?
• Is the payment validation workflow very secure?
• Can the user change the content of their order after payment?

Here you can control the logic of the use cases and ensure that the security of the application is fully engaged when it is actually in use. Ensure that your software cannot be hijacked in some way. Don’t hesitate about going overboard when testing the processes in order to discover potential flaws.

6. Useful and protected data

Ensuring this step is normally pre-established by the need to comply with global data regulations such as the General Data Protection Regulation (GDPR), which entered into force in Europe in May 2018.

These regulations define several measures and precautions that companies and organizations should implement in order to safeguard the data they handle.

• Precaution n ° 1: Take an inventory of all the data entering, leaving, and passing through your web app: usernames, passwords, contact details, payment data, etc.

Regardless of whether your web app is small or large, you are a self-employed one-person business or a multinational, you have a responsibility to protect the data of all your users.

• Precaution n ° 2: Be a minimalist. Do not collect data if it is not useful for your app or business’ ability to provide the services that are expected of it. The more you collect a large – and above all diverse – volume of data, the more you are exposed to dangers and loopholes. Limit the diversity as well as the amount of data you collect. All data must have a specific utility and justification.

• Precaution n ° 3: Monitor the retention period of your sensitive data. The shelf life must also be justified.

• Precaution n ° 4: Ensure you are using sensitive data in a way that does not cross any moral or legal red lines. What you do with data will be one of the first points that you will need to explain, and prove the utility of.

• Precaution n ° 5: Ensure that the route your data passes through is well secured.

A solid data security policy is an element and process that needs to be constantly considered and applied.

As an offshore IT company, at Bocasay our offshore developers can carry out the technical reviews your application needs: security-oriented code reviews, web penetration testing, preparation for worst-case scenarios, etc. Send us a message and we’ll be happy to begin a conversation.  

For more information, discover the prices of our offshore developers.