What security practices should you be aware of when writing software?

Question

What different types of security do there exist? Why and when should they be implemented?

Example: SQL Injection Prevention

Answer 1

Preventing Buffer overflow

I cannot count the exploit that are based on this.

Answer 2

I am no expert, but in my experience, there are several well-known attack vectors for systems:

Unvalidated user data

This is the classic buffer-overrun, SQL injection, drive-by-download mechanism and is caused by insufficient planning or education on secure coding practices. It is important to ensure developers understand how any insecure code can be leveraged to exploit a zero-day attack on a computer. Just because your website doesn't do anything particularly secret/important, doesn't mean that getting root access on your webserver can't harm the other parts of the organisation.

Weak security

This can be a blend of poor security infrastructure, policy or just bad passwords. The worlds most popular password is 'password1' since most email providers started insisting on alpha-numeric passwords - previously it was 'password'. If a dictionary-based attack can guess a users' password, the policy was insufficient.

Backdoors

Some enterprising programmers leave quick-access backdoors in code in case they need to jump in and 'fix' the system. If you have any of these, deliberate or otherwise, your system is a ticking time-bomb.

What to do about it

1. Here's a useful selection of podcast episodes that discuss the topic: http://www.se-radio.net/?s=security&submit=Find
2. Read up on some best-practices, for example http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=writing+secure+code&x=0&y=0
3. Get your code security/penetration tested.
4. Keep up-to-date with current threats and mitigation strategies through blogs and online articles: http://www.cert.org/sse/

Answer 3

It depends completely on the type of app, what a potential exploit might accomplish and the expected environment.

If you are running in an environment assumed to be safe then you could argue few to none.

If you are writing a web app that is publicly exposed, or an app that involves a publicly exposed API you would have to think through the likely scenarios like defacement, false submissions, authentication exploits, getting access to data not belonging to you, etc.

If you are building an app that stores data locally you might need to be concerned with the security of that data, keeping it separate between users on a multi-user system, etc.

IMHO there are not any security concerns that are ALWAYS applicable in every situation.

Answer 4

Web applications:

Based on the number of attacks - see stats by Verizon, OWASP, WHID and others - the single biggest thing you can do to improve the security of a web application is implement solid input validation. Do not trust anything the client/browser sends you. This will pretty much sort your SQL injection issue, and help out in a number of other areas including field/buffer overflow.