We've looked at many topics over the past few weeks. It's easy to delay taking action by focusing on the concepts. And with so much information, it can be difficult to know where to start.
So today I am giving you a list of four things that you can - and must - tackle right now. I'll also give you the links to the articles again, in case you want a quick refresher.
#1 Check the protocol
Make sure right now that your application is using HTTPS.
I covered the importance of this in the blog post: "Is this site secure?"
If you are not using HTTPS, make this your top priority. Depending on your role, you might be able to fix this yourself. If not, put in the necessary change request.
It's common practice to set up websites so that any HTTP links still work. But don't get lazy. Make sure that all the links within your application also use HTTPS. It's easy to copy and paste older links to resources like images, and forget to change the link to use HTTPS. If some of these links are not your responsibility, take the necessary steps to make sure it gets done.
#2 Check the security headers
Are you using security headers in your response? I discussed this in "Your first line of defense".
If you didn't do it then, go to SecurityHeaders.com and type in the URL of your application. What rating did you get? Read any warnings, and take steps to get the right headers added.
#3 Read the error messages
Test the application and deliberately generate error messages. Check if the error message tells an attacker what technology you are using on the server.
Why is this important? Read the blog post: "Beware the error message" again as a reminder.
You might not be able to find or address all the error messages, but you can improve some of them.
#4 Research your plugins
Most of us use third-party plug-ins, especially JavaScript libraries like JQuery. It's easy to forget that these also have vulnerabilities.
Did you follow the instructions I gave you in my post "One broken egg"?
If you didn't, go and do it now:
- Make a list of all the components you are using in your applications. Note their version numbers and where they are being used.
- Check the National Vulnerability Database to see if there are any known vulnerabilities.
- Set up an action plan to install the latest version, and of course, test everything again.
If you can tick these four things off as done, then you are already on your way to a more secure application.
Please share your views and comments.