Question

As the corporate ISSO, determine how you would ensure that Web applications are compliant with the applicable security standards. Select one such standard and explain how you would keep it in compliance.

Answer 1

Answer: Within any organization it's not mandatory to have only one ISSO (Information System Security Officers, instead there may be one or more ISSO's who will be responsible for ensuring security standards, where he will be working on user providing operations and protecting technical data from organization point of view. One such standard related to security standard, we can think of is "Web Application Security Standard" 1. Server Configurations and access control. 2. Authentication 3. Data validation 4. Interfaces 5. Authenticated Session Management Server Configurations and access control One way to maintain control over accessing the server is, For the users minimum privileges should be given to access the server account so that unused files are not placed or stored in the server folder. Another way is to disable the server folder so that no one can access server folder Authentication Standards for authentication may be by use of encryptions to transmit the files where authentication or authentication cookies is not made persistent. Those who want to access server will be verified by backend servers Data Validation Accepting the data what we know is data validation and should be validated on the server side This requires constant maintenance with respect to data looking after data not corrupted no missing data etc Database Interface To secure database we use database engines that allow security permission to respective database objects by having dedicated accounts to access server database, these accounts must have Administrative privileges Authenticated Session Management Here in Authenticated Session Management always it's better to generate new session ID's for each new login, where these session ID's are random and not sequential. To generate the session ID's request has to be raised with database engine what we are using