Top 10 Cloud Security Best Practices for Applications

Cloud Security Best Practices to Protect your Application Data

85% of cyber-attacks target application vulnerabilities! With an application landscape ripe with an extensive variety, today’s developers leverage a potent mix of commercial, custom, and open source code in order to create quick and robust applications. With the rising complexity of these applications, application security and IT security and compliance services has become profoundly important. This is the first post in a series of 2, where we’re going to holistically address the concept, importance and application security best practices in today’s world.

What are the best practices of application security, and why do we need it?

Hackers use unlawful code to manipulate your applications and access, steal, modify, or delete sensitive data. App security best practices minimize the risk of security breaches using a structured methodology that involves an array of hardware, software, and operational policies. You need appropriate security measures built into your applications in order to shield your applications from crumbling due to misuse.

Application security vs software security

Have you wondered whether the terms “application security” and “software security” imply the same thing? Are these two one and the same?

According to Gary McGraw (a computer scientist, researcher, and author of 12 books), software security is much bigger in comparison to application security. He elucidates that software security is a proactive approach while application security is a reactive approach. Gary maintains that application security takes place once software has been deployed (which makes it reactive), while software security takes place within the per-deployment phase (which makes it proactive).

What are your thoughts on these? Do you think application security is merely reactive? Let us know in the comments. In the modern world of applications that range from simple productivity tools to intense gaming and enterprise-level apps, does application security still function only as a reactive approach?

What are Counter Measures in Security?

Countermeasures, quite like the name suggests, are measures or actions taken to minimize the risk of a security breach. A basic countermeasure that most of you must be aware of is a firewall!

Some common countermeasures are

• Routers
• Encryption & decryption programs
• Anti-virus programs
• Spyware detection & removal programs
• Bio-metric authentication systems.

What is threat modeling in security?

Before getting into Threat Modeling, we want you to ponder over what a “Threat” is in the realm of application security. A threat is a malicious or unplanned event, which has the potential to compromise an enterprise’s assets. A DoS (denial-of-service) attack can be classified as a malicious event, while the failure of a storage device is an unplanned event. Either way, both of these are potential threats to your application.

If you’ve ever prepared for ISO 27001 certification in your enterprise, you’d find it easier to understand Threat Modeling. Allow us to try to break it down to you.

Step-by-Step Application Security Planning to Prevent DDoS Attacks

• Carefully defining all enterprise assets’
• Identifying what each application does (or will do) with respect to these assets
• Creating a security profile for each application
• Identifying and prioritizing potential threats that could affect these applications and in turn the enterprise assets.
• Documenting what countermeasures or actions can be taken when faced with a threat.
• Documenting adverse events that have occurred and the actions taken in each case.
• If you remember the DDoS attack from back in Oct 16, we’re about to tell you that they have only grown over the past year! Here’s how DDoS attacks are projected up to 2020.

What can you do to stay safe and steer clear of these malicious events that haven’t even spared big hosting providers like Dyn? We’re going to follow up on this post with 10 best practices for Application Security. While you watch out for our next blog post, where we’ll discuss the 10 best practices to consider in Application Security, we want you to reach out to us for any security concerns you may have with your existing applications!

Staying on top of application security isn’t easy as pie and is, in most cases, often done wrong without professional guidance. To have a plan in place is the very beginning of establishing a tough front against attacks like the massive DDoS attacks from Oct ’16. We’ve outlined 10 best practices to consider when taking an organized approach to web application security. When you sit down with your remote IT support team and create a strong plan, do keep these in mind.

10 Best Practices for Web Application Security

Enough about us; without much ado, we’re going to dive into outlining the 10 Best Practices for Web Application Security.

Below are the key web application security best practices

• Establish basic security
• Start with a blueprint
• Create application inventory
• Prioritize applications
• Identify and prioritize susceptibilities
• Adjust the privileges that your application use
• Use cookies securely
• Implement HTTP with SSL/TLS
• Other little tips
• Awareness trainings

Establish Basic Web Application Security Controls

When it comes to implementing Application Security, it’s safe to assume that it will take anywhere from a few weeks to a few months even for a fairly small organization. There’s much to do, and you must already realize that with the above-stated list. To successfully prepare a list of web applications and outline all the associated nitty-gritty, you will take a substantial amount of time. In the interim, it isn’t wise to leave your business exposed and vulnerable. We recommend that you put in place a few basic security measures even before you kick-start the actual process.

• Remove unnecessary functionalities from applications. Uncalled and unused functionalities are best turned off. They pose a risk of being identified and not modernized to handle potential threats. So turn them off for good.
• A web application firewall (WAF) is the simplest and the most basic countermeasure, which helps protect against most exposures. A WAF can not only block unwanted traffic, but also helps steer clear from the likes of XSS, SQL injection, etc.

Create a Web Application Security Blueprint and Strategy

There are three ways to deal with application security:

• You choose to do so manually
• Through a cloud solution
• Through software that you have on-site
• Choose a local managed service provider
• Choose to employ a remote team of specialists
  Start with understanding who you’re going to engage with and then move on to charting out the steps. Create a simple blueprint of your organization and define where you’d start. Outline your organization’s goals, and if your organization is large enough, identify and include names of people responsible in the blueprint.

Create a Complete Inventory of Web Applications

Create a detailed inventory of all the applications your organization relies on. This could be a daunting task even for a small organization. While you may think you already have a list, there are many applications running right now that you don’t ever remember installing. We call these rogue applications that go unnoticed unless a critical issue arises.

While creating the inventory, ensure that you also note down what the purpose of each application is. Chances are that when you’re done with this inventory, you’ll be able to point out many redundant and pointless apps. “Do not miss even a single application” goes without saying!

Prioritize Web Applications Based on Risk and Data Sensitivity

Regardless of what you perceive, we’re going to tell you that the inventory is going to be pretty long. So the next step would be to break it down using proper prioritization.

Use these 3 categories to sort your apps:

High

What goes into high, medium and low? “High” should ideally comprise of applications that deal with sensitive data (such as customer data) or are liaising with external entities. These apps are the most likely and vulnerable targets for hackers.

Medium

“Medium” should contain apps that are used for internal purposes and occasionally interact with sensitive information.

Low

“Low” as you might’ve already guessed, is a list of apps that have far less exposure and while they aren’t pressing, they must be included down the road.

Identify and Prioritize Web Application Vulnerabilities

With your application inventory ready, the logical next step would be to identify the susceptibilities of these applications. As you put together your list of web applications, you need to prioritize the identified vulnerabilities. This basically means which of the risks need mitigation and which of these you’d accept.

Simply put, you’ll create action plans for the vulnerabilities that are marked high priority and risk acceptance for the other. When Sucuri analyzed 9000 infected websites in Q2 ‘16 and categorized them by platform, here’s the result:

Keep in mind that when actual testing happens, you may realize that you overlooked some of the issues. It happens and shouldn’t stop you from hitting the brakes temporarily in order to recheck your list and plan again. Since you’re starting from scratch now, it will be a lot easier down the road. So move on to testing now and give it your best shot!

Apply the Principle of Least Privilege to Web Applications

Every web application runs using specific privileges. These privileges provide it access to both, local and remote computers. It is imperative that we adjust these privileges to a bare minimum in order to avoid threats or attacks via the applications.

Adjust user privileges as well for every application. For most application only the admin or the super admin would need complete access. You need to button it down for all other users. If a user’s need for permission arises at a later point, it can be addressed via a proper workflow/process. Most users can accomplish their regular tasks with minimal permissions, except for some high-level business users. Perform a little routine of user-profiling to address this.

Secure Cookies to Prevent Web Application Attacks

Cookies are incredibly convenient for businesses and users alike – there are an overwhelming set of advantages when your application uses cookies. For instance, cookies help greatly in re-targeted advertisements and for providing a personalized experience to returning patrons. But cookies are also a major weak-link that hackers are great at exploiting.

Stop using Cookies? Hell no! Just be clever with adjusting the settings.

3 ways

• Cookies shouldn’t be used to store sensitive information. E.g., user passwords.
• Don’t keep everlasting cookies, no matter how appealing that sounds! Set expiration dates to avoid misuse by hackers.
• Use adequate encryption to ensure your cookies aren’t easily readable by external sources.

Implement HTTPS with SSL/TLS for Secure Data Transmission

This might seem a bland statement, but trust us, this implementation is supremely helpful. The history of cyber-attacks statistically states that HTTPS implementation has innocuously helped in guarding against 30% of attacks!

So here’s what you should do – implement HTTPS! But that alone isn’t enough – that’s about half the job done. You need to work on the DNS side of things and redirect all your traffic to HTTPS! A pro tip would be to use an updated version of TLS instead of relying on SSL. There are numerous reasons why, but that beats the purpose of this post. Remind us to blog on that another day

Additional Web Application Security Best Practices

Here are a few“immediate” web application security suggestions that you can implement as a business or website owner. Follow these quick tips:

• Implement x-xss-protection security header.
• Implement a content security policy.
• A string password policy is a must.
• Apply subresource integrity (SRI) to resources

Why Should You Prefer Velan’s Remote IT Support Service?

We’re the infrastructure mavens who can help you with all things infrastructure, including expert cloud security consulting services. From modernizing legacy systems to building scalable and robust cloud infrastructures, we do it all. Whether it’s secure server setup and management, web hosting support, help desk services, or end-to-end infrastructure management, call us at +1-516-717-2049 and rest assured—your infrastructure and cloud security will be as strong as our expertise.