ITICT302A Secure Programming

Having a secure code is one of the most important aspects 2 of software development. An insecure code is vulnerable to attacks by external attackers whose motive is to steal data by utilizing the insecure application source code.

In the login page code, there are a few insecure application code practices that have been identified and they pose threats to the application. These vulnerabilities include:

• SQL connection not initialized inside a constructor class – SQL connection in any given application is very crucial and must be protected at all costs. In the given login code, the SQL connection to the database has not been initialized in a constructor class as required. The function that handles this connection to the database must be made private to reduce the number of attack cases.

The SQL connection to the database in the application code should be made private - the connection will only be used when needed and that is only when the class object is being used. In cases where it is not being used, then no SQL connection to the database will be made (Kumar and Pateriya, 2012). In case an attacker wants to access the data using that function, he/she will not be able to since the connection string will not be initialized, and no data will be pulled from the database. This makes sure that the application code is secure enough.

• Authentication variables are not private – the variables used to authenticate (username and password) are not made private too. This poses a security challenge since an attacker can simply perform an SQL injection on the application code and get a list of all usernames and passwords from the database. The password can then be decrypted, and the attacker can then log in.

The authentication data should be made private so that an attacker has no idea which variable to use to perform an SQL injection attack on the code.

The application login code provided has an issue that poses a security threat to the application. One issue detected is the insecure code that retrieves user information from the database on authentication. Retrieving user information on login instead of performing an SQL request to the database is a security threat. This means that an attacker can simply get all the data of a particular user on login so long as the supplied username is true. This can lead to data loss and the attacker can use the retrieved data for his/her benefit. The attacker can also use the retrieved data to authenticate to the affected application and do what he/she needs. He/she is also able to see any personal information of the user such as banking details, credit card information, etc.

The remedy for this issue is to perform an SQL request to the database on login instead of retrieving the user data based on the username supplied on the login form. With this, the attacker will not be able to retrieve any user data on login since there is no code in the application to retrieve such data and it will not be possible to inject a code to help achieve the same. Instead, the application code will validate the user data based on the SQL request made on the database and the response will either be successful or unsuccessful authentication and no data of the user is returned or retrieved from the database. Even if the attacker knows the username to use, he/she will not get any data relating to the user back. The only thing that will happen is unsuccessful authentication on the user end. This makes the application more secure preventing data breaches/data losses because of insecure or poorly written code of the application.

Application developers are always on the receiving end when it comes to vulnerable applications that are insecure. When attackers find some loopholes in the application code that can be exploited, the application developers are in such a tricky situation that they must correct them. Some of the threats that can be faced by such applications and systems include, data loss and corruption, the systems can be crashed by the attackers, the systems can also be used to send spam messages and emails, etc. This brings the aspect of the Security Development Lifecycle. This is a software development process developed by Microsoft to help the developers create more secure software applications. This aims at minimizing the security issues that might be present in the applications (Schmittner, Ma, and Schoitsch, 2015). This approach then aims at resolving the existing security vulnerabilities in the application. This methodology is very important to the development team since they will know how to implement Microsoft SDL to make their applications more secure.

When this approach is implemented by the development team, the other methodologies might be dropped when necessary, since Microsoft SDL proves to be more efficient than the other development methodologies. To draw the attention of the application development to threat modeling, a clear and precise engagement with the development team should be made. The team needs to the benefits of threat modeling as a core element of the Microsoft Security Development Lifecycle. A clear explanation of such benefits should be highlighted to the development team so that they can know how it works. If these benefits are well explained to the development team, then the implementation of the Microsoft Security Development Lifecycle will be easy and simple to the team and they might want to start the process of implementation. This will make sure they develop more secure applications that are not vulnerable to security threats.

A penetration test also known as a pen test is a test that is conducted on a computer application, system, or network in form of a virtual cyber-attack to check and explore all the security vulnerabilities that might be exploited in the application by the attackers. The application in question has some security vulnerabilities since it is providing some information when some errors occur in the application. An external penetration testing can be conducted on the application to extract the data when an error is thrown then fixes applied immediately to make sure that when the application is fully in use, the attackers have nothing to exploit.

Some of the security issues this vulnerability might pose on the application include:

• The error messages might reveal the server details where the application is hosted, and this is a security issue since attackers can use these server details to exploit the hosted applications and the server itself. This poses a big threat to the company since the hosted applications can be brought down anytime and no online services are offered to the users and the internal employees.
• The information revealed during the errors might also contain some useful information such as database name, tables, etc. These can be used by the attackers to exploit the application in question. Such exploitations include SQL injection where the application code might be subjected to injection attacks.

Some of the ways to avoid these security vulnerabilities include:

• The use of exceptions in the application – the application should utilize exceptions such that when something exceptional happens, an exception is thrown, and the application can log the error that occurred so that the developer can fix them later other than the application entering an error state revealing the confidential information to the user. These errors can also be prevented so that they be minimized.

The company's website has a login page with both username and password fields. The first issue that there are hints on how the password should look like. This poses a security threat in that an attacker can just prepare a list of all possible passwords that meet the password criteria stated on the website. These passwords can then be used by the attacker to perform some attacks on the website. This can be done through brute force attacks. Due to security reasons of the website, this approach is not recommended since the attackers will always find a way to break into the system.

The best approach to take is to hide all the hints that tell how the accepted password might look like. The most important thing is for the user to remember his/her password used during registration or given by the administrator after the creation of the account. With this, the attackers will have to crack their heads to perform the brute force attacks on the website and this will surely take time since they have no hints what the combination of the password might be so that they can easily break into the website and perform their malicious activities.

The second issue is that there is an option to reset an email address if someone forgets it. This poses a security challenge to users' accounts since an attacker can just reset an email, saved it to the database, then resets the password and gains access to the system/account. To avoid this security vulnerability, there should not be an option to reset an account email on the website. If someone forgets the email he/she used during registration, he/she can contact the administrator so that the email can be changed on the administrator portal and verification be sent to the new email.

The confidential data in the table (credit card information) of a customer is not secured properly. This approach is not suitable since the attackers can have access to the original data from the decoding process. The approached used in this case is not even encryption which is recommended but an encoding using base64. The data can be decoded easily by the attackers whenever they have access to the database. This means that the attackers can have access to the original credit card information of all customers in the database by simply decoding the stored values in the database. Another security threat identified in the given data is the fact that all credit card CVCs are also being stored in the database. This is a huge risk and should be avoided at all costs.

Even though it is not recommended to store credit card information of a customer in the database due to the security reasons leading to financial loss to the customers and the legal action that might be taken against the company storing this information in the database, encrypting this confidential and private data using stronger encryption algorithms such as Format-Preserving Encryption (FPE) is recommended and should be implemented if need be. This algorithm works by securely encrypting the data while at the same time preserving the original formatting of the plaintext. What this means is that a 16-digit credit card number can be encrypted using FPS to another 16-digit number (Bellare and Hoang, 2017). In this encryption method, the format of the data to be encrypted remains the same. This hides the original credit card number from the hackers, and they will not be able to get the correct number. In long run, this improves the security of the application and database in general.

Reference list

Bellare, M. and Hoang, V.T. (2017). Identity-Based Format-Preserving Encryption. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security.

Kumar, P. and Pateriya, R.K. (2012). A survey on SQL injection attacks, detection, and prevention techniques. 2012 Third International Conference on Computing, Communication and Networking Technologies (ICCCNT’12). [online] Available at: https://ieeexplore.ieee.org/document/6396096/.

Schmittner, C., Ma, Z. and Schoitsch, E. (2015). Combined safety and security development lifecylce. [online] IEEE Xplore. Available at: https://ieeexplore.ieee.org/abstract/document/7281940 [Accessed 23 Apr. 2021].

search.proquest.com. (n.d.). ProQuest - ProQuest. [online] Available.

The best thing about getting paper help from us is that you will get proofreading services by default. You don’t have to pay extra charges for the proofreading services if you seek assignment writing services from us. The proofreaders ensure that your paper is devoid of any mistakes. From the sentence structures and punctuation to relevance and context, our team of ghostwriters take care of everything. Expect nothing but higher grades when you opt for our assignment writing service. Do not hesitate to avail yourself of our essay writing service if essay writing isn’t your cup of tea. We have the best team to assist you.