Your organization’s web applications are under attack. How can you protect them?

The first step is to do a security audit. Call in auditors and work with your team to find security issues in your web application. Use threat modeling, red teaming, and chaos engineering as steps fo identify the vulnerable parts.

Security is a Day-1 investment in the development process. In the event of an attack, prioritize understanding the attack surface, securing critical assets to minimize further impact, and implementing firewall measures. This collaborative effort involves all hands on deck, your SRE and engineering teams treating it as a Sev-0 event. Simultaneously, communicate internally and collaborate with the CISO or security organization. Determine external communication cadence and address legal implications promptly. Lastly, a thorough investigation should entail addressing the 5 Whys and making sure short and long-term action items are prioritized.

Understanding the surface area of your web app is the key to setup good security model around it. Little things like logging and services you are logging to need to be vetted. If you are leaking tokens or secrets being leaked due to dev logs not being cleaned out properly. Understanding all the pieces that make your site works starts by taking each piece into account from the environment used to host to the stack used to build it.

Step 1: If the application is live, it's better to take it down to stop the data leak immediately (depending on the nature of the application). Step 2: Initiate penetration testing to identify the issue and get the problem fixed Step 3: Implement WAF and restrict unwanted traffic to the web application Step 4: Configure application logs and monitoring Note: Before we deploy the application in production, we should ensure proper coding standards and frameworks are in place, a pen test is done, the firewall is hardened, and application performance monitoring is in place to find an anomaly.

Understand the risks from the IT side, use the root cause analysis with five whys. The "Five Whys" is a problem-solving technique where you ask "why" five times to get to the root cause of an issue. It helps identify deeper issues rather than just addressing surface-level problems.

Security is a crucial part in web applications and one of the important thing in web applications is that the application must protect it's users data such as email addresses, phone number, password etc. The web applications must be capable of encrypting or hashing the users confidential details such as passwords.

Security standards like ISO 127001, NIST framework, and CIS control provide a framework to build and maintain the security infrastructure of your application. Commit to implementing these standards, and conduct internal and external audits regularly to monitor progress and bottlenecks.

To implement security best practices effectively, consider the following list: - Risk Assessment: Continually prioritize business risks. - Policies & Procedures: Enforce security guidelines. - Access Control: Apply strict access and least privilege. - Data Encryption: Encrypt data in transit and rest. Incident Response: Update the response plan regularly. - Regular Audits: Perform security and compliance audits. - Patch Management: Update patches promptly. - Vulnerability Management: Continuously remediate vulnerabilities. - Third-Party Management: Monitor vendor security. - Disaster Recovery: Test recovery plans frequently. - Continuous Monitoring: Monitor systems and networks. - Cyber Insurance: Consider it to mitigate risks.

??For secure development, follow coding rules, keep software updated, check for and fix vulnerabilities, use strong passwords, control who can access what, and learn about new security measures and threats regularly.

One of the greater tools in terms of security is OWASP Top Ten. It is a top 10 is a standard awareness document for developers and web application security. It is always a great start, run a smart diagnostic on your apps, and compare to the items listed in OWASP lists.

If you are already under attack use a firewall and a mix of other services like Cloudflare. Set rules properly and test them out so that legitimate traffic is not blocked. Also if you have a country specific website like an e-commerce website that only ships things to say Australia, it might be wise to block all traffic except that from Australia.

If you're already under attack, use a firewall and a combination of services like Cloudflare. Set up rules carefully and test them to avoid blocking legitimate traffic. For country-specific websites, such as an e-commerce site shipping only to Australia, consider blocking all traffic except from that specific country.

In cases where a WAF is not a fit, and there are cases to be made, you can take measures to ensure you are well hardened and redundant at your entry point(s) to secure your infrastructure at the edge. Coupled with good monitoring, alerts and response plan will make this path tenable.

??As someone deeply invested in ensuring robust application security, integrating Web Application Firewalls (WAFs) has been pivotal in my approach. These WAFs serve as a crucial defense mechanism, strategically positioned to filter out and intercept malicious traffic before it reaches the web applications. This proactive layer not only adds a strong protective shield but also acts independently, providing an extra level of security that contributes significantly to the overall resilience of the application architecture. It's a fundamental step in fortifying against potential threats and maintaining a secure digital environment."

L'utilisation de pare-feu d'applications web (WAF - Web Application Firewall) est une mesure importante pour renforcer la sécurité de vos applications web en protégeant contre une variété d'attaques (injection SQL , XSS et CSRF).

Training is essential in today's world where there are numerous frameworks to ensure best practices. The system user is often the weakest link, and social engineering attacks now make up 98% of all cyber-attacks. While technology is advancing, people's awareness may not be keeping pace. It's crucial to emphasize the importance of educating users.

Making the UI user friendly with proper alert is really necessary to make sure users are also educated with the security best practices. Password rotation, Secrets management need to be put in place

Informed employees are a company's first and most effective line of defense. Employee cybersecurity training is a critical component of an organization's overall security strategy. As human error is often the weakest link in security, educating staff can significantly reduce the risk of breaches. Regular, comprehensive training equips employees with the knowledge to recognize and avoid threats like phishing, malware, and social engineering. It fosters a culture of security awareness, ensuring that everyone understands their role in protecting sensitive information and systems. Additionally, it helps organizations comply with legal and regulatory requirements, minimizing the risk of costly penalties and damage to reputation.

Educating of your users is quite a complicated topic. You first need to understand the level of knowledge you have within the company to know which gaps to cover. You can have a basic threat knowledge course collection on your onboarding procedures to cover some basic gaps. Then you can run periodically some courses with tests after each other to keep the awareness on a decent level. Additionally, some random ad-hoc trainings may be used. I love how hoxhunt are doing those: nicely specifically tailored emails periodically being sent to the employees to try to convince them to click on the link in the email message.

Dependendo do tipo de aplica??o, é importante deixar claro para os seus clientes que certas a??es, por mais que dificultem a usabilidade, s?o essenciais para que eles tenham um ambiente seguro! Portanto, se você agora adiciona uma etapa de valida??o por e-mail ou SMS para o cliente finalizar o cadastro, ele precisa entender que isso é para a prote??o dele e de outros clientes! Assim, o atrito é menor e ele vai realizar essas a??es sabendo que devem existir. Seria estranho se n?o houvesse.

The applications should be well tested before rolling out it for the users. The web applications should not be having any debug logs such as console messages because they can expose internal functions or data on the client machine, and they can cost a lot to the organization. In order to prevent these heavy issues, the application should be well tested via performing both functional and non-functional testing.

This is where penetration testers and ethical hackers shine. Run vulnerability assessments, hire firms to do code scans and pentest your app and more importantly, your entire infrastructure. Imagine your web app is solid and has no vulnerability and is hosted on premise. If a threat-actor can walk to the server room without anyone noticing or being asked for proper credentials, your system is not secure. Never forget that the web app is part of a bigger system.

Avoid presuming your web applications' security solely based on prior steps. Continuous testing against new or emerging threats remains imperative. Employ tools like security audits, code reviews, and bug bounty programs to identify and resolve potential security loopholes. Regularly revisiting and enhancing security policies and procedures further fortifies your web applications against evolving risks, ensuring ongoing protection and resilience.

Error Handling: Implement proper error handling to avoid exposing sensitive information to attackers. Provide generic error messages to users and log detailed errors on the server side for debugging purposes. This approach prevents attackers from exploiting information leaks in error messages.

Never trust the user input, sanitize it before it reaches the server. Ensure proper validations are in place. Always log the user activity and responses whenever required, keep monitoring the logs regularly and identify any suspicious user activity. Follow proper encryption measures.

As mentioned, frequent backups are required even for highly secured applications (nothing is secure). Make sure you are doing this: Regular Backups: Schedule daily or weekly backups to ensure you always have a recent copy of your data. This minimizes loss in case of an attack. Secure Storage: Keep backups in a secure, off-site location or use encrypted cloud storage. This protects your data from physical and cyber threats. Test Recovery: Regularly test your recovery process to ensure you can quickly restore data and applications. This prepares you for a swift response during an actual crisis. Update Plan: Keep your backup and recovery plan updated with the latest best practices and technologies to combat evolving threats.

Additionally, At least once in a year, recovery practice should be done on the real environment to be ready for an emergency.

Spot on! Having been in the field, I've seen the aftermath when these steps aren't followed, so I couldn't agree more. Including these in a solid security framework is absolutely crucial - it's not just about checking boxes, it's about preventing headaches down the line. Great breakdown!

Perform regular Disaster Recovery (DR) site failovers in production. Implement short and long term data backup retention policies, then test them regularly.

établissez des politiques de sauvegarde régulières, en veillant à stocker les sauvegardes dans des emplacements sécurisés. Testez périodiquement la restauration des données pour garantir une récupération efficace en cas d'incident.

Security should be not only an operational concern: it should be part of business strategy. with the ever-growing threat of cyber attacks, evolution of threat actors, and the rapid rise of Artificial Intelligence, cybersecurity is business critical: it has the power to make or break a business.

A lot of the contributions so far have spoke to preventative measures. While I agree with many of them, I’d like to offer advice to teams responding to a threat while under an active attack. Establish a communication line with whomever is dealing with end users and/or stakeholders to set expectations on updates. When to expect them, and what you know so far. The last thing you want to do allow panic to perpetuate the team working on defense and remediation. Your team should know what’s at stake, reiterate the importance and rather than be let them be overwhelmed. All said, better to recap than make a mistake in the moment. As mentioned, preventative measures are essential, but keeping a level head during an active attack is crucial.

An important aspect of web application security is developer education. It’s not uncommon to have results reported by audits and scans either fixed with an incomplete solution or have the finding incorrectly considered a false positive. If the developers working on the application have a good understanding of how attacks and performed and prevented, it will go a long way towards security.

Even large corporations are not immune to hacking. To mitigate this risk, start by encrypting your users' sensitive data. This proactive measure can shield you from legal troubles arising from data breaches. Alternatively, consider not storing any sensitive information in the first place.

First we have to make a quick assessment if whether the attack is just a ddos attack to slow down the system or is it a proper cyber attack to get / manipulate the data . If it is of the first kind then we need to identify the attackers and IP and make arrangements yo block them. This won't be much difficult. And also we have to provision extra hardware to help users to still work on the app. But if it is a proper attack of 2nd kind. Then first and foremost we have have to take our system offline and take a back up.analyze the system for data breach. If there is any data breach we have to report it immediately to authorities within 72 hours. The. Do 8d analysis and apply action based on OWASP security principles