登录查看更多内容

How can you best secure password storage for web applications?

由人工智能和领英社区提供技术支持

Password storage is a crucial aspect of web application security, as passwords are often the primary means of authenticating users and protecting sensitive data. However, many web developers still make common mistakes that expose passwords to hackers and compromise user privacy. In this article, you will learn how to best secure password storage for web applications by following some basic principles and best practices.

此文章中的业界达人

由社区从 13 条内容中精选。了解更多

Beenish Javaid

IT Governance Professional | Technology Risk Consultant | ITIS Auditor | ISO 27001 ISMS LA | CA Finalist | ISO 20000 LA…
Anurag P.

Security Advisor| SECURE everything | Application Security | DevSecOps | Security Automation | Problem Solver

1 Why password security matters

Password security matters because passwords are often the target of cyberattacks, such as brute force, phishing, or credential stuffing. These attacks aim to either guess or steal passwords from users or databases, and use them to access other accounts or systems. If passwords are not stored securely, hackers can easily crack them and cause serious damage, such as data breaches, identity theft, or fraud. Therefore, password security is not only important for web applications, but also for the users and the data they entrust to them.

添加您的观点

Beenish Javaid

IT Governance Professional | Technology Risk Consultant | ITIS Auditor | ISO 27001 ISMS LA | CA Finalist | ISO 20000 LA | Masters in Philosophy
举报内容
Secure password storage may be done via using the following options: 1. Strong password policy implementation, with length, complexity, history etc. 2. Hashing Algorithms 3. Multi-factor Authentication protocol 4. Encryption enabled on password storage databases

已翻译

赞
Anurag P.

Security Advisor| SECURE everything | Application Security | DevSecOps | Security Automation | Problem Solver
举报内容
We should start moving towards true passwords less solutions which reduces risk and efforts of securing passwords. If not true passwords less we should prefer federated Identities, OTP based login over passwords

已翻译

赞
Nalinikanth M (nal) (He/Him)

I help teams build and deliver Secure Applications | Certified Ethical Hacker| Certified AWS Security Specialist | Threat Modelling | DevSecOps | Security
举报内容
Like mentioned, password security is crucial as weak passwords can lead to data breaches, identity theft, and financial fraud. Strong, unique passwords prevent un authorized access, protecting personal and corporate data from cyber threats. Regular updates and multi-factor authentication enhance this security further, making it harder for attackers to exploit accounts. I have seen these small things leading to large breach across organisations that brings the reputation down and also has monetary impact on organisations

已翻译

赞
Kam Karaji MSyI MCIIS

CSO | CISO | Global Cyber Security Leader | Voted Top 140 CISO |
举报内容
Password security is a critical aspect of cybersecurity due to the prevalent threats of cyberattacks such as brute force, phishing, and credential stuffing. Cybercriminals often target passwords to gain unauthorized access to user accounts or databases. If passwords are not adequately protected, hackers can exploit vulnerabilities, leading to severe consequences such as data breaches, identity theft, or fraud. Recognizing the significance of password security is crucial for safeguarding not only web applications but also the users and their entrusted data. Implementing best practices in password security is essential to mitigate these risks and ensure a robust defense against potential cyber threats.

已翻译

赞
Waleed Ahmed - Lead Auditor

GRC Expert | Certified ISO 27001 Lead Auditor | Certified ISO 27001 Lead Implementer | ISMS Consultant | ISO 27701 | ISO 19011 | ISO 22301 | ISO 27031
举报内容
To secure password storage for web applications: 1. Hashing: Use strong, one-way hashing algorithms (e.g., bcrypt, Argon2) to irreversibly convert passwords into hash values. 2. Salted Hashes: Employ unique salts for each user to prevent rainbow table attacks. 3. Key Derivation Functions (KDF): Implement KDFs to slow down brute-force attacks. 4. HTTPS: Ensure secure communication with the server using HTTPS. 5. Password Policies: Enforce strong password policies, including length and complexity requirements. 6. Multi-Factor Authentication (MFA): Encourage or require users to enable MFA for additional security layers.

已翻译

赞

加载更多内容

2 How to hash passwords

One of the most fundamental and effective ways to secure password storage is to hash passwords before storing them in a database. Hashing is a one-way process that transforms a password into a random and unique string of characters, called a hash. Hashing makes it impossible to reverse-engineer the original password from the hash, even if the database is compromised. However, not all hashing algorithms are equally secure. You should use a modern and robust hashing algorithm, such as bcrypt, scrypt, or argon2, that are designed to be slow and resistant to brute force attacks. You should also avoid using outdated or weak hashing algorithms, such as MD5 or SHA1, that are easily cracked by hackers.

添加您的观点

Nalinikanth M (nal) (He/Him)

I help teams build and deliver Secure Applications | Certified Ethical Hacker| Certified AWS Security Specialist | Threat Modelling | DevSecOps | Security
举报内容
I would strongly recommend using something like bcrypt for hashing a password it is a simple algorithm that can be implemented with ease. This article is absolutely on spot.

已翻译

赞
Sandhya Rout

Member of Technical Staff @ NetApp | Product Security
举报内容
It is essential to choose a strong hash function and regularly update your hashing algorithms as new secure options become available.

已翻译

赞

3 How to salt passwords

Another way to enhance password security is to salt passwords before hashing them. Salting is a technique that adds a random and unique value, called a salt, to each password before hashing it. Salting prevents hackers from using pre-computed tables of hashes, known as rainbow tables, to crack passwords. Salting also ensures that even if two users have the same password, they will have different hashes in the database. To salt passwords, you should generate a random and long salt for each user, and append or prepend it to the password before hashing it. You should also store the salt along with the hash in the database, so that you can verify the password when the user logs in.

添加您的观点

Kam Karaji MSyI MCIIS

CSO | CISO | Global Cyber Security Leader | Voted Top 140 CISO |
举报内容
1. Generate Unique and Random Salts: Create unique and random salts for each user to thwart pre-computed table attacks. 2. Use Long and Random Salts: Lengthen and randomize salts for increased complexity and unpredictability. 3. Combine Salt with Password: Append or prepend salts to user passwords before hashing to ensure unique hash values. 4. Store Salt with Hash: Store salts alongside hashed passwords in the database for effective password verification. 5. Dynamic Salt Updating: Periodically update salts to bolster defence against potential breaches or suspicious activity. 6. Implement Strong Hashing Algorithms: Utilize secure hashing algorithms like bcrypt, Argon2, or scrypt for robust protection.

已翻译

赞
Sandhya Rout

Member of Technical Staff @ NetApp | Product Security
举报内容
By salting passwords, even if two users have the same password, their stored hashes will be different due to the unique salts. This prevents attackers from using rainbow tables to quickly crack passwords.

已翻译

赞

4 How to pepper passwords

A third way to improve password security is to pepper passwords before hashing them. Peppering is a technique that adds a secret and fixed value, called a pepper, to each password before hashing it. Peppering differs from salting in that the pepper is not stored in the database, but rather in a separate and secure location, such as an environment variable or a configuration file. Peppering makes it harder for hackers to crack passwords, even if they have access to the database and the salts, because they would also need the pepper to generate the correct hashes. To pepper passwords, you should generate a random and long pepper, and append or prepend it to the password before hashing it. You should also keep the pepper secret and change it regularly.

添加您的观点

5 How to implement password policies

Strengthening password security can be achieved by implementing password policies that enforce specific rules and requirements for users when creating or changing passwords. These policies help to prevent users from choosing weak or common passwords. When setting a password policy, you should consider factors such as minimum and maximum length, complexity, uniqueness, expiration, and verification. For instance, passwords should be at least 8 characters long but no longer than 64 characters to avoid performance issues; they should contain a combination of uppercase and lowercase letters, numbers, and symbols; they should not be reused; they should be changed periodically; and users should be verified before creating or resetting them. All of these measures help to reduce the risk of credential stuffing or identity theft.

添加您的观点

Sandhya Rout

Member of Technical Staff @ NetApp | Product Security
举报内容
When implementing password policies, it's crucial to strike a balance between security and usability. Here are some points to remember for implementing password policies: 1. Password Complexity 2. Minimum Password Length 3. Password Expiration 4. Password History 5. Account Lockout 6. 2FA

已翻译

赞

6 How to use password managers

A fifth and final way to boost password security is to use password managers that help users generate, store, and manage passwords securely. Password managers are applications or browser extensions that create strong and random passwords for each account or website, and store them in an encrypted vault that can be unlocked with a master password or a biometric factor. Password managers can also autofill passwords when logging in, and sync passwords across devices. Password managers can help users avoid the pitfalls of using weak or reused passwords, or writing them down on paper or digital notes. Some of the popular and reputable password managers that you can use are LastPass, Dashlane, 1Password, or Bitwarden.

添加您的观点

加载更多内容

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Sandhya Rout

Member of Technical Staff @ NetApp | Product Security
举报内容
Overly complex or restrictive policies may lead to user frustration and increased support requests. It's important to find the right balance based on your organisation's security needs and the sensitivity of the data being protected.

已翻译

赞

Cybersecurity

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you best secure password storage for web applications?

1

2

3

4

5

6

7

1 Why password security matters

2 How to hash passwords

3 How to salt passwords

4 How to pepper passwords

5 How to implement password policies

6 How to use password managers

7 Here’s what else to consider

Cybersecurity

给文章评分

感谢您的反馈

更多Cybersecurity相关文章

更多相关阅读内容

How can you best secure password storage for web applications?

1

2

3

4

5

6

7

1 Why password security matters

2 How to hash passwords

3 How to salt passwords

4 How to pepper passwords

5 How to implement password policies

6 How to use password managers

7 Here’s what else to consider

Cybersecurity

给文章评分

感谢您的反馈

查看其他技能