-1

I'm making a small social networking web site for a specific university's students (where I study) and I'm concerned about security (access to the database). What should I do? What I have to check for last time until I went online?

(Yeah, Facebook Facebook. Facebook don't have that community sense. You cannot find all your department mates on Facebook. You cannot see all foreign students on Facebook. You cannot hide your identity on Facebook while commenting, etc etc. Just please don't compare it with Facebook, we had a great local social network until it went public . * ))

Improve this question
3

7 Answers 7

Reset to default
8

Sanitize user input.

Don't trust any data given by the user. I cannot stress this enough.

Improve this answer
4
  • Don't trust anything that comes from the browser. The part of your security concept that is implemented in JavaScript, well, should be approximately 0 lines long.
  • Use HTTPS for transfer of passwords and other sensitive data.
  • Beware of cross-site-scripting. If you echo user input 1:1 in an error message, without sanitizing, it could contain javascript that the browser will execute in the security context of your website.
Improve this answer
3
  • 1
    lol, +1 for "The part of your security concept that is implemented in JavaScript, well, should be approximately 0 lines long"
    – TheLQ
    Mar 13, 2011 at 23:18
  • 2
    Should that not be "use HTTPS for everything"? When everyone is on the same LAN, cookie sniffing gets a bit easier.
    – Peter Taylor
    Mar 14, 2011 at 7:17
  • Peter Taylor: Depending on the desired level of security, probably yes.
    – user281377
    Mar 14, 2011 at 8:11
2

There are a lot of good answers here, but one thing that has not been said explicitly* yet is:

Prevent SQL Injection Attacks: Do not embed any user data in SQL queries.

You don't mention what language you're writing this app in. The way to avoid SQL Injection is to use "parameterized queries" or "prepared statements". There are examples for Java and PHP in that Wikipedia article. Whatever language you're using, you need to find out how to do it and do it. As a side effect, prepared statements should also make your queries run faster, too. (The SQL engine doesn't need to re-analyze the query and come up with a new execution plan for it just because the parameters changed.)

Using parameterized queries won't secure your database by itself, but failing to do so will guarantee that an attacker can own your database.

*It is implicit in the recommendation not to trust anything that comes from the browser, of course.

Improve this answer
1

As far as security with your database (which is the one thing you mentioned specifically:

As far as I know (and I'm not admitting to knowing everything... yet... ;) the only way to access the database (depending on the set up of the server its operating on of course) is directly (being at the terminal or via ssh) or via php or other web-languages (I don't thing JavaScript has db capabilities). In order for a web-language to communicate with the db they have to know:

  1. the address to the db server
  2. the username and password

Generally speaking the only way for them to get these pieces of information would be to get if from the site administrators directly or from some code that you had written that accessed the database. However they wouldn't be able to get at the later as long as your ftp/ssh is configured appropriately.

The things I'd recommend you keep an eye on or do would be:

  1. watch entry points into the server (make sure all external entry points such as ssh, ftp, etc are configured correctly and only trusted people ever get direct access to the servers).
  2. limit the number of people who have access to the server in any way other than viewing the site.
  3. see what logs are configured/available on your server. You might set up IP logging and Port logging so you can monitor if there is ever any high amounts of attempts to ftp or ssh into your server. This would almost always indicate someone attempting to hack your system.

There's obviously lots more but this is all I have time for at the moment.

Improve this answer
1

My quick answer would be to grab any of the vulnerability scanner tools and point it at your website. It's not the most scientific way of doing it but they will check the obvious things and teach you a lot about what to look for. Either go opensource, or many vendors have a free trial.

If your app is hosted at the university tell the admins about the testing before you do it. Otherwise they will panic when they see the testing and presume they are being attacked, not tested.

It's also a great message for your supervisors - "I have scanned it with X security scanners"

Improve this answer
1

OWASP has a ton of resources on how to properly implement good security practices as part of an application. The Top Ten is a good place to start. The pdf explains both what the most common security defects are and how to address them.

http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Improve this answer
1

With regard to site security. Tie it in to your general network authentication. There will almost certainly be tools for most web platforms that will facilitate integrating your user identification code with what the network offers. That way you don't have to reinvent too many wheels when authenticating users and you can be as confident as possible that they are who they say they are.

Also if they lose track of those credentials it's not your problem.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.