• Example: Http Headers - Evil!
• Example: Javascript Validation - Evil! (javascript validation is easily circumvented. Treat it as a UI nicety, but do the final checks on the server side!)
• Example: Http Post form values - Evil!
• Example: Url query string parameters - Evil!
• Example: Cookies - Evil!
• Example: File upload - Evil!
• Example: Data in a database - Evil!

Prevent Code and Data Confusion Here the term “Code” is used loosely to include anything that gets executed or interpreted. (strategies in order of (my) preference)

1. Strategy: Separate Command and Data

   • Example: Parameterize Sql Queries
   • Example: Windows Data Execution Prevention

2. Strategy: Encode data

   • Example: Html encode all data displayed in a web page
   • Example: (for PHP) mysqli_real_escape_string

3. Strategy: Allowed “Safe” input list

   • Example: only allowing characters a-z and 1-9 in a user input field

4. Strategy: Disallowed “Dangerous” input list

   • Example: Disallowing the single quote in a name field (sorry Chief O’Brien).

5. Corollary: What is data in one context may be code in another

   • Strategy: Know your execution context

Defend the Premise

1. Strategy: Understand your assumptions

2. Corollary: Ensure secrets are not guessable

   1. Strategy: Use cryptographically strong randomness.
   2. Strategy: Always salt your hash Salted Password Hashing - Doing it Right

Abstractions are Leaky

1. Strategy: Understand the fundamental operating principles of your abstraction

Vulnerabilities can combine

Know the difference between Encryption and Encoding

Good algorithms can be subverted by bad implementations

1. Strategy: Use trusted cryptographic implementations

Consider authentication, authorization and auditing

1. Consider Action authorization
2. Consider Data authorization
3. Consider maintaining “who did what when with which information”

Consider Pyschology

1. Strategy: Help your users know when they are being spoofed.

   • Example: “SiteKey” functionality
   • Example: Tell your users what you will and won’t do (e.g. we will never ask for your password over the phone or in an email)
   • Example: Use SSL with a cert issued by a CA.
   • Example: Avoid blind redirects.

Know (and defend) your trust entry points

The Same Data Can Have Different Representations

1. Strategy: Canonicalize before making a security decision

Encrypted data can still be used to attack a system

1. Strategy: Use Nonces to prevent replay
2. Strategy: Use reconciliation to detect replay (e.g. in financial systems)
3. Strategy: Use digital signatures to verify identity
4. Strategy: Protect your private keys