A false sense of security

Are we in the grip of a false sense of security? I’ve asked myself that over the past few days.
Changing my personal firewall may have got me thinking more broadly about it. I don’t have a precise answer. Are we paying
enough attention to web application security? Are we investing enough money and effort in this
basic and unfortunately neglected quality?

We can’t lump every person and every case together, but the question keeps nagging at me. Are we doing everything we can to secure
our applications? One question leads to another. Let’s go back to the beginning
and define what application security means to us. Validated inputs, confidentiality for data in transit,
difficulty reconstructing a request, secrecy around individual elements…

We can define application security as a set of properties that work together to help
protect one or more entities. The individual security mechanisms can accomplish this difficult job by working
together. We should always remember that our protection is only as strong
as its weakest link. But the rules should form successive layers of mesh
so that slipping through one layer doesn’t break
the entire defense.

Securing applications, particularly web applications because of their transparency, is a long-haul job.
I’ve seen lots of guides to making applications safer, but most are only pieces of the mosaic.
It’s worth understanding why we need to prevent people from inserting parts of SQL queries through input parameters,
or SQL injection, and why parameter length, user authentication and authorization
for individual actions matter. Always allow for the possibility that a rule fails
or isn’t strong enough, and an attacker gets further.

Set aside the questions of how much it will cost or
how much time we’ll have to invest. Think seriously
about choosing the right security mechanisms.
Following a defined security policy closely lets us find weaknesses in our
system, write tests, analyze problems, look for risks and define further criteria, or filters if you like. Let’s set aside
the much-maligned security by obscurity and design our security
policies and rules transparently. That’s how we’ll get clients to understand and accept them.

If we convince ourselves we can build, or even already have, a secure system, that’s when we develop
a false sense of security. If you want to trust your feelings, take the long, thorny road. At the end you may
find no reward. The sweet fruit is the return on what you’ve invested in securing
your web applications along the way. Just take care that the fruit doesn’t turn bitter and leave
only the taste of something that was never ripe.