Coding Practices.pdf

SECURITY CODING PRACTICES E N S U R I N G S O F T W A R E R E S I L I E N C E A N D I N T E G R I T Y  SECURITY CODING PRACTICES SECURITY CODING PRACTICES AND VULNERABILITY PREVENTION In this lesson, we'll explore the essential p...

SECURITY CODING PRACTICES E N S U R I N G S O F T W A R E R E S I L I E N C E A N D I N T E G R I T Y  SECURITY CODING PRACTICES SECURITY CODING PRACTICES AND VULNERABILITY PREVENTION In this lesson, we'll explore the essential practices that help safeguard software systems against vulnerabilities and threats. We'll evaluate the effectiveness of these practices and discuss how to apply system design, security, and coding patterns to real-world problems. SECURITY CODING PRACTICES What are security coding practices? Guidelines that developers follow to build secure systems.  SECURITY CODING PRACTICES WHY ARE THEY IMPORTANT? Rising cybersecurity risks: increased attacks like ransomware, phishing, and advanced persistent threats (APTs). Compliance with industry regulations (GDPR, HIPAA). Protect user data and maintain system integrity. SECURITY CODING PRACTICES COMMON SOFTWARE VULNERABILITIES SQL Injection: Attackers manipulate database queries to steal or corrupt data. Example: SELECT * FROM users WHERE username = 'admin' -- AND password = '' bypasses authentication. Cross-Site Scripting (XSS): Injection of malicious scripts into web pages viewed by other users. Example: alert('Hacked'); injected into a comment section. SECURITY CODING PRACTICES COMMON SOFTWARE VULNERABILITIES Cross-Site Request Forgery (CSRF): Tricks users into performing unwanted actions without their knowledge. Example: A hidden form that submits a bank transfer request using a logged-in user’s credentials. Buffer Overflow: Attackers exploit buffer limits to execute arbitrary code. Example: Sending excessive input data causing memory corruption and possibly allowing remote control. SECURITY CODING PRACTICES COMMON SOFTWARE VULNERABILITIES Insecure Authentication & Session Management: Weak authentication allows attackers to hijack sessions or compromise credentials. Sensitive Data Exposure: Failure to encrypt sensitive data can lead to its theft or manipulation. Security Misconfiguration: Poorly configured systems expose sensitive information. Insufficient Logging & Monitoring: Lack of monitoring means security incidents can go unnoticed. SECURITY CODING PRACTICES INPUT VALIDATION & OUTPUT ENCODING Prevent attacks like SQL Injection, XSS, and buffer overflow by sanitizing user inputs. Best Practices: Whitelisting Inputs: Allow only specific, known-safe data. Example: In a username field, allow only alphanumeric characters. Validate Input Length and Type: Restrict inputs to expected length and format to avoid buffer overflow. Example: Limiting a username to 20 characters. Escape and Encode Outputs: Ensure that any output displayed to the user is properly encoded to prevent script execution. Example: Convert into its HTML-encoded version, <script>. SECURITY CODING PRACTICES SECURE AUTHENTICATION & SESSION MANAGEMENT Prevent unauthorized access and protect against session hijacking. Best Practices: Enforce Strong Password Policies: Minimum length of 8 characters with uppercase, lowercase, numbers, and symbols. Encourage the use of password managers for complex passwords. Multi-Factor Authentication (MFA): Combine something the user knows (password) with something the user has (mobile device or token). Secure Password Storage: Use strong hashing algorithms like bcrypt, PBKDF2, or Argon2. Never store passwords in plain text! SECURITY CODING PRACTICES SECURE AUTHENTICATION & SESSION MANAGEMENT Prevent unauthorized access and protect against session hijacking. Best Practices: Session Expiration: Set sessions to automatically expire after a period of inactivity (e.g., 15 minutes). Use Secure Cookies: Set the HttpOnly and Secure flags to prevent access via JavaScript and to enforce HTTPS. Example of Best Practice: Google uses MFA to enhance the security of Gmail accounts.  SECURITY CODING PRACTICES USE OF PARAMETERIZED QUERIES Prevent attackers from altering SQL queries with malicious input. Best Practices: Parameterized Queries (Prepared Statements): Rather than directly embedding user input into queries, use placeholders and bind variables. Example: SELECT * FROM users WHERE username = ? AND password = ? Avoid String Concatenation: Never directly concatenate user input into queries. Parameterized queries render SQL injection attacks ineffective by separating data from code SECURITY CODING PRACTICES ERROR HANDLING & LOGGING Prevent attackers from gaining information about the system's internals through error messages and logs. Best Practices: Display Generic Error Messages: Avoid showing detailed system errors to users (e.g., database errors). Example: Replace a SQL error message with “An error occurred. Please try again later.” Log Detailed Errors for Developers: Ensure logs capture sufficient details (stack traces, error codes) but do not leak sensitive information. Ensure Logs Are Properly Protected: Restrict access to log files. Rotate and archive logs to prevent overwriting. SECURITY CODING PRACTICES ERROR HANDLING & LOGGING Prevent attackers from gaining information about the system's internals through error messages and logs. Best Practices: Monitoring Tools: Implement real-time monitoring with tools like Splunk or Elastic Stack to quickly detect abnormal behavior.  SECURITY CODING PRACTICES PROPER DATA ENCRYPTION Protect sensitive data both at rest and in transit to prevent unauthorized access. Best Practices: Use Strong Encryption Algorithms: AES-256 for data at rest (e.g., stored passwords, sensitive records). TLS/SSL (TLS 1.2 or higher) for data in transit (e.g., when transferring data over the internet). Encrypt Sensitive Fields: Example: Encrypt fields like credit card numbers, social security numbers, and personal addresses. Secure Key Management: Store encryption keys securely (e.g., hardware security modules, HSMs). Regularly rotate encryption keys. Even if attackers gain access to the database, encrypted data will be unreadable without the key.  SECURITY CODING PRACTICES PRINCIPLE OF LEAST PRIVILEGE (POLP) Minimize the potential damage from compromised accounts or processes by restricting access to the minimum required level. Best Practices: Grant Users Only What They Need: Example: A cashier only needs access to payment systems, not customer records. Apply Role-Based Access Control (RBAC): Group users by roles (e.g., admin, user, manager) and assign permissions accordingly. Limit Process Privileges: Ensure that system services and applications also run with minimal privileges. Regularly Audit Permissions: Periodically review and adjust permissions to ensure they are still valid. Reduces attack surface and limits the potential damage of insider threats or compromised accounts.  To Be SECURITY CODING PRACTICES Continued...