Developing secure web applications

BASIC CONCEPTS
1. Authentication: Authentication is the process of identifying a person or even a system, such as an application and validating their credentials.
2. Authorization: Authorization is the process of determining whether a user is permitted to access a particular resource that she has requested.
3. Data integrity: Data integrity is the process of ensuring that the data is not tampered with while in transit from the sender to the receiver.
4. Confidentiality or data privacy: Confidentiality is the process of ensuring that no one except the intended user is able to access sensitive information. The difference between authorization and confidentiality is in the way the information is protected. Authorization prevents the information from reaching unintended parties in the first place, while confidentiality ensures that even if the information falls into the wrong hands, it remains unusable

5. Auditing: Auditing is the process of recording security-related events taking place in the system in order to be able to hold users accountable for their actions.

6. Malicious code: A piece of code that is meant to cause harm to computer systems is called malicious code. This includes viruses, worms, and Trojan horses.

7. Web site attacks: A web site may be attacked by different people for different reasons. For example, a hacker may attack for pleasure, a terminated employee may attack for revenge, or a professional thief may attack for the purpose of stealing credit card numbers.
Broadly, there are three types of web site attacks:
• Secrecy attacks—Attempts to steal confidential information by sniffing the communications between two machines. Encrypting the data being transmitted can prevent such attacks.
• Integrity attacks—Attempts to alter information in transit with malicious intent. If these attempts succeed, it will compromise the data integrity. IP spoofing is one of the common techniques used in integrity attacks. In this technique, the intruder sends messages to a server with an IP address indicating that the message is coming from a trusted machine. The server is thus fooled into giving access to the intruder. Such attacks can be prevented by using strong authentication techniques, such as public-key cryptography.
• Denial-of-service attacks (or availability attacks)—Attempts to flood a system with fake requests so that the system remains unavailable for legitimate requests. Creating network congestion by sending spurious data packets also comes under this category. Such attacks can be prevented by using firewalls that block network traffic on unintended ports.