Transcript Security
Web Design &
Development: Security
By Trevor Adams
Topics Covered
About security
Why bother?
Security Policy
Attacks
Intrusion
Denial of Service
Attackers
Basics
Protecting your mark-up!
Hosting
Web Site
Security – Why Bother?
Why do we need to think about security?
Would it not limit your freedom of speech?
“They don’t wish to read my stuff, I am not
bothered about theirs!”
Security – Why Bother?
BUT!
Society has rules!
Without them, society breaks down
“They do want to read my stuff and I am, to
tell the truth, interested in theirs!”
Security – Why bother?
So we have an obvious conflict…
Freedom of speech or invasion of privacy?
Private information on a public network
Boring information or access to secrets?
This is all security!
Security Policy
Developed often without realising
“I do not bother, I have nothing I need to protect.
Anyone can use anything, I really do not care!”
This is a security policy: Do Nothing
Which can be completely valid if it fits
Security - Trust
Before considering the Internet or the web,
lets consider trust
Everyday life
Most of the world is built on trust
A thoroughly strange concept
Credit Cards
Chairs
Taxi Drivers
The humble fiver is actually just an IOU
Security - Attacks
There are many types of attacks
Three common types:
Intrusion
Denial of Service
Information Theft
We shall look briefly at these
Security - Intrusion
The most common form of attack (unofficial)
The attacker is able to use resources belonging to
you
Most attackers try to use the resources as though
they were legitimate
Known as masquerading
Security – Denial of Service
Aimed at preventing use of your own resources
Used a lot on the web
Overloading a web site
E-mail bombing
Easy to do
Very little real defence
Blackmail, server ransom etc.
Occasionally accidental
Holiday mail messages for example?
Security – Attackers
Deliberate forms of attacks might come from
these type of attackers
Joy riders – bored people amusing themselves
Vandals – out to damage the public net
Score Keepers – Geek bragging rights
Spies – industrial or otherwise
Stupidity or accident – usually naiveté
Security - Prevention
This is a tough topic to cover without going into
some scary science
Toughest attack to defend
Anti-virus software – anti information theft and intrusion
Network firewalls – anti-intrusion
Security policy – general assistance
Denial of service
Difficult to defend against an over use of a service on a
public network
In the end you have to cover every possibility
Attackers have to find one exploit!
Security and WDD
We have to cover all this?
WDD and Security
Topics introduced are complex
So what about us?
Most could encompass a degree in their own right
We do HTML right?
All of the aforementioned topics are worth
knowing about
Some of the topics are for network engineers
Some are for programmers
It is everyone's responsibility however!
Basics
To some, security is seen as an exotic topic
Fun, exciting and cutting edge!
This might be true…(anyone seen
Swordfish?)
In reality it starts in a more mundane manner
Personal procedures
Personal computer protection
Good personal security policy
Web sites as a public face
Your web site is a public face
Whether personal, commercial or otherwise
It is put up in the world for everyone to see
There are various reasons why people want
to mess it up
You cannot stop them trying
However, you should not make it easy for them
Protect your own mark-up
You create your web sites locally for upload later
Take care of your own files
Don’t be uploading modified versions
Viruses and Worms are notorious for modifying files
without user knowledge
Good common sense
Strong password policy
Up to date security software – firewalls, anti-virus
Limited access to shared files
Do not run your computer as Administrator just to type!
Hosting
Hosting your web site on a reliable provider is a must
You need that all important TRUST
They should provide a service level agreement upon request
Help you with Denial of Service attacks
Make back-ups on your behalf
This is why you pay for hosting
Relieves the technical issues of running your own web server
Change your FTP password regularly
FTP is a plain-text protocol
Where possible, use Secure Socket Layers (SSL)
Your web site
We have only touched the surface of serverside technology
However, it is worth understanding how your
own web site can be the problem
The best host in the world cannot protect
against poor web site development
Your web site
Any web site that ventures past plain HTML opens
itself to be prodded by ‘no-gooders’
Web applications lack the control of desktop
applications
You have no control on who posts to your form
Form submissions could come from pages that you have
not designed
Code your pages to be hardened against mal-formed posts
Do not process user input as though it is automatically
trusted
Many of these techniques will become more
apparent if you continue to study web development
and applications
Summary
Security is a vast, interesting topic
Think about how it impacts on so many areas of your life and
society at large!
Computing security is a small part of security as a topic
Understand how private data on a public network is an odd
contradiction
Security by obfuscation will not last forever
Just because its not obvious, does not mean nobody will find it!
Take good steps and procedures to do your part
Protect your own work as best you can
Do not leave the door wide open to information theft