I’m starting a brand new project. The main access from the client side app will be via an API written in ASP.Net MVC3.
I’m looking for discussions on how best to handle logging information for security access as well has how to handle Phishing and Brute Force.
On the Information side of things, I’d also like some ideas on what to keep track of to help me both better improve the application in the future and to be able to market it better.
Anyone got any suggestions or links?
1
Behind good design and good defense lies
Deep Profound Knowledge
So, first of all, I suggest that you read these links as you’re not exposed to phishing or brute force attacks and other types of attacks like cookie poisoning, CSRF, form spoofing, HTTP injection, etc. are there waiting for you.
http://www.imperva.com/products/wsc_web-application_attacks.html
http://www.blackhat.com/presentations/bh-asia-02/bh-asia-02-shah.pdf
For logging, I recommend that you use cookie-based authentication, and consider these points for cookies:
- Make’em HttpOnly
- Make your session cookies session (well, then name says that)
- Try to make your cookies secure if possible (SSL, or TLS)
- Encrypt your cookie value
- Rename your cookie from time to time as the name of a cookie also matters
One of the common patterns to prevent brute force attack is to delay the process by forbidden login intervals, that is, if a user failed to login for say n times, prevent other login requests for say 15 minutes.
Another pattern is to lock user on n times of unsuccessful login retry, and create an unlock mechanism that involves human participation somehow.