Share what you know with millions of people
Focus is the best place to turn what you know into remarkable content
0
In today’s Web 2.0 world, how do I ensure prevention of new user-hijacking methods such as clickjacking, cross site scripting and cross site request forgery that could attack critical applications within my infrastructure?
Events
- Dos and Don'ts of Small Business Marketing May 29 @ 11 am PT
- Lead Nurturing 202: The Next Generation May 31 @ 11 am PT
- The Tricks to Paid Media June 6 @ 11 am PT
- Display Advertising for Brand Awareness June 20 @ 11 am PT
Related Activity
2 Answers
Common sense is the first starting point, making sure that you check what is being sent, and validate what is sent to any scripts you run.
The specific methods for prevention are rather dependent on the technology you are implementing (Java, php, other) on the server side.
Testing is also very important -- feed your scripts incorrect data to determine if you are capturing all exceptions etc.
If you are working in the ecommerce domain, frankly, hire in a security expert - if you can't afford one, you should be off-loading your ecommerce to a company that can do it properly -- Digital River, for instance.
A lot of self-help info is available if you google the terms you outline. That should probably be your starting point.
Best,
Justin.
Like Justin said the attacks are different depending on the technology used. Test it by sending malformed data to make sure you are "blocking" incorrect data. Personally I suggest if you are interesting in preventing any attack, you should learn how the attack is executed so that you can prevent it.
Someone needs to plant the attacks you are inquiring about by gaining access to the server they're hosted on first. So, the real concern for those attacks are the server's security, so that a person can't get in to plant the attacks that would affect the end users.
When it comes to user hijacking here is some incite:
"Many security pros, such as ESET Director of Technical Education Randy Abrams, think the problem is at the server level because a Web server or page must be compromised to allow for clickjacking. "The solution is to either ban Iframes on the Internet or attempt to deal with the problem at the browser level," Abrams said.
Answer This Question