Defense in Depth
Never rely on a single point of defense. Your application is often the last layer between an attacker
and back -end systems such as a database or a fi le server, which, in turn, may be connected to a
corporate network. If your application is hacked, then these systems may be exposed to the attacker.
By using several layers of defensive techniques in your application such as input validation, secure
SQL construction, and proper authentication and authorization, your application will be more
resilient against attack.
Never Trust Input
As you discovered in the example attack earlier in this chapter, a simple change to an input into the
application may result in a security breach. Input is everything that comes into your application
during run -time — user data entry, the click of a button, data loaded from a database or remote
system, XML fi les, anything you cannot know about at the time your application is compiled.
Every single piece of input should be validated and proved correct before you process it. If invalid
input is sent to your application, then your application must cope with it correctly, and not crash or
otherwise act upon it.
Subscribe to:
Post Comments (Atom)
Хайлт
Таалагдаж Магад
-
EUC (End User Computing) refers to the idea that the end user himself or herself performs processes such as design, development, operation, ...
-
With CorelDRAW’s new partnership with ConceptShare you can create an online workspace where you and those you invite can review, mark up, an...
-
A computer game is a piece of interactive software created with the primary purpose of entertaining the user. This definition is not clear-...
-
OK, let’s see a show of hands: How many of you are reading this article because you want a #1 rank in Google? Yeah, we thought so. As SEO co...
-
Шинэлэг содон бүхнийг санаачлагч Apple компани өчигдөр App Store сайтаас 200 сая гаруй iPhone, iPad болон iPod хэрэглэгчдийн татсан apps 15 ...
0 comments:
Post a Comment