Secure Web Application Development Revision

Front 1

Feature Driven Development

Back 1

Develop Overall Model - High level walk-through of system scope and context involving the creation of domain models. One or more (combination) of these models is used to become the model for each domain area.

Build Feature List - Models created in the first stage are used to compile a list of features. Features should take no longer than two weeks to complete.

Plan by Feature - Development plan is produced and ownership of features is assigned.

Design by Feature - A design package is produced for each feature. Sequence diagrams are worked out for each feature. Class and method prologues are written followed by a design inspection.

Build by Feature - Class owners develop code for their classes. Unit testing and code inspection follow. Each completed feature is promoted to the main build.

Front 2

Test Driven Development Lifecycle

Back 2

The purpose is to test each component thoroughly before release.

Front 3

MVC Data Handling

Back 3

Front 4

Encryption

Back 4

To transform data to keep it secret from others. The goal is to ensure that the data cannot be seen by anyone other than the recipient(s). This process uses a secret key, the plaintext and the algorithm operation. The ciphertext, algorithm and key are all needed to return the plaintext.

Algorithms: AES, Blowfish, RSA

Front 5

Hashing

Back 5

Hashing is the process of turning text into a fixed length string of characters that is unintelligible. These cannot be decrypted.

Algorithms: SHA-3, MD5

Front 6

HTTP and Sessions

Back 6

HTTP is stateless, meaning that it does not require the server to retain session information or status about each communications partner for the duration of multiple requests.

Sessions are employed to overcome this. It acts as a workaround to support session state over a stateless protocol. This is achieved through the use of HTTP cookies. These are small pieces of data sent from the website to the user's computer.

Front 7

Session and Cookie Security Risks

Back 7

Cookie Theft - Can be done through XSS by posting malicious code to a website. The code could make a button appear that would (once clicked) send cookie information to a malicious web page.

DNS Cache Poisoning - Another way of stealing cookies. By fabricating a DNS entry, an attacker would be able to acquire a users cookies.

Session Hijacking

Front 8

Definition: Web Service

Back 8

An application developed as loosely coupled software components that is remotely available over TCP/IP.

Front 9

Web Services: Advantages

Back 9

- Deployability: Deployed over standard Internet technologies with SSL built in.

- Interoperability: Web services allow applications to talk and share data with each other.

- Low Cost for Communication: SOAP over HTTP. Low cost option.

- Platform Independence: Works on browsers

-Provides Functionality to other Services

Front 10

Web Services: Disadvantages

Back 10

- Vulnerable to DoS Attacks: The services can be overloaded with too many requests over a short space of time.

- Stateless: No information is retained by either sender or receiver. Sessions can be used to work around this.

Front 11

Prepared Statements

Back 11

Queries written with placeholders rather than actual values. This means that SQL statement syntax cannot be altered. SQL injection is prevented as a result of this.

Front 12

Behaviour Driven Development: Advantages

Back 12

- Provides a common domain language thar everyone understands.

- Provides the ability to create test cases prior to development.

Front 13

Behaviour Driven Development: Disadvantages

Back 13

- Not suitable for novice developers without TDD knowledge.

- Only works with Iterative lifecycle.

Front 14

SLIM

Back 14

A micro framework used to write simple and powerful web applications and APIs.

Micro-Framework - A lightweight, minimalistic framework. A small and concise code base that addresses a set of use cases and/or problems.

Routing - Mapping specific HTTP request methods and URIs to specific callback functions. Behaves as the controller section in MVC. Uses an htacess file for filtering.

Middleware - Allows code to be run before and/or after your SLIM application to manipulate the request and/or response.

Front 15

Validation

Back 15

Ensuring correct format of user input.

Front 16

Sanitisation

Back 16

Removal of illegal characters from user input.

Front 17

Code Example: Prepared Statements

Back 17

Front 18

WSDL Upload/Download from Server

Back 18

Front 19

Sanitisation and Validation: Code - Ints

Back 19

Front 20

Sanitisation and Validation: Code - Strings

Back 20

Front 21

EE M2M Messages

Back 21

Front 22

Latency Causes

Back 22

- High Quality Images

- Continuous Database Polling

- Large File Sizes

- Inefficient Code

- Geolocation

Front 23

WSDL

Back 23

Defines a web service API. Gives the SOAP action URL. Easy way of getting the web details for a service including its methods and location.