Secure Deployment Concepts

CompTIA Security+ Certification (SY0-501) Chapter 8 - Secure Protocols
12 minutes
Share the link to this page
Copied
  Completed
You need to have access to the item to view this lesson.
One-time Fee
$99.99
List Price:  $139.99
You save:  $40
€91.73
List Price:  €128.43
You save:  €36.69
£78.50
List Price:  £109.90
You save:  £31.40
CA$135.42
List Price:  CA$189.60
You save:  CA$54.17
A$152.22
List Price:  A$213.12
You save:  A$60.89
S$133.77
List Price:  S$187.28
You save:  S$53.51
HK$781.89
List Price:  HK$1,094.68
You save:  HK$312.79
CHF 88.30
List Price:  CHF 123.63
You save:  CHF 35.32
NOK kr1,058
List Price:  NOK kr1,481.24
You save:  NOK kr423.24
DKK kr684.10
List Price:  DKK kr957.77
You save:  DKK kr273.66
NZ$164.15
List Price:  NZ$229.81
You save:  NZ$65.66
د.إ367.20
List Price:  د.إ514.09
You save:  د.إ146.89
৳10,978.23
List Price:  ৳15,369.96
You save:  ৳4,391.73
₹8,290.53
List Price:  ₹11,607.08
You save:  ₹3,316.54
RM471.80
List Price:  RM660.54
You save:  RM188.74
₦156,534.34
List Price:  ₦219,154.34
You save:  ₦62,620
₨27,950.66
List Price:  ₨39,132.05
You save:  ₨11,181.38
฿3,595.26
List Price:  ฿5,033.51
You save:  ฿1,438.25
₺3,229.78
List Price:  ₺4,521.83
You save:  ₺1,292.04
B$499.40
List Price:  B$699.18
You save:  B$199.78
R1,883.20
List Price:  R2,636.56
You save:  R753.35
Лв179.42
List Price:  Лв251.19
You save:  Лв71.77
₩133,286.20
List Price:  ₩186,606.01
You save:  ₩53,319.81
₪365.03
List Price:  ₪511.06
You save:  ₪146.02
₱5,561.09
List Price:  ₱7,785.75
You save:  ₱2,224.66
¥14,911.76
List Price:  ¥20,877.07
You save:  ¥5,965.30
MX$1,670.32
List Price:  MX$2,338.52
You save:  MX$668.19
QR364.82
List Price:  QR510.77
You save:  QR145.94
P1,359.04
List Price:  P1,902.71
You save:  P543.67
KSh13,398.66
List Price:  KSh18,758.66
You save:  KSh5,360
E£4,718.65
List Price:  E£6,606.31
You save:  E£1,887.65
ብር5,656.15
List Price:  ብር7,918.84
You save:  ብር2,262.68
Kz83,512.74
List Price:  Kz116,921.18
You save:  Kz33,408.44
CLP$93,810.03
List Price:  CLP$131,337.80
You save:  CLP$37,527.76
CN¥710.61
List Price:  CN¥994.89
You save:  CN¥284.27
RD$5,917.87
List Price:  RD$8,285.25
You save:  RD$2,367.38
DA13,435.55
List Price:  DA18,810.31
You save:  DA5,374.76
FJ$226.69
List Price:  FJ$317.37
You save:  FJ$90.68
Q780.94
List Price:  Q1,093.35
You save:  Q312.40
GY$20,949.18
List Price:  GY$29,329.69
You save:  GY$8,380.51
ISK kr13,659.63
List Price:  ISK kr19,124.03
You save:  ISK kr5,464.40
DH1,002.67
List Price:  DH1,403.78
You save:  DH401.11
L1,768.33
List Price:  L2,475.73
You save:  L707.40
ден5,652.42
List Price:  ден7,913.61
You save:  ден2,261.19
MOP$805.88
List Price:  MOP$1,128.27
You save:  MOP$322.38
N$1,866.55
List Price:  N$2,613.25
You save:  N$746.69
C$3,681.10
List Price:  C$5,153.70
You save:  C$1,472.59
रु13,266.49
List Price:  रु18,573.62
You save:  रु5,307.13
S/368.83
List Price:  S/516.39
You save:  S/147.55
K382.06
List Price:  K534.91
You save:  K152.84
SAR375
List Price:  SAR525.02
You save:  SAR150.01
ZK2,508.19
List Price:  ZK3,511.57
You save:  ZK1,003.37
L456.04
List Price:  L638.48
You save:  L182.43
Kč2,310.02
List Price:  Kč3,234.13
You save:  Kč924.10
Ft36,211.46
List Price:  Ft50,697.50
You save:  Ft14,486.03
SEK kr1,038.11
List Price:  SEK kr1,453.39
You save:  SEK kr415.28
ARS$85,066.49
List Price:  ARS$119,096.49
You save:  ARS$34,030
Bs691.23
List Price:  Bs967.75
You save:  Bs276.52
COP$389,029.38
List Price:  COP$544,656.70
You save:  COP$155,627.31
₡50,979.09
List Price:  ₡71,372.77
You save:  ₡20,393.67
L2,470.17
List Price:  L3,458.33
You save:  L988.16
₲730,160.41
List Price:  ₲1,022,253.79
You save:  ₲292,093.37
$U3,841.23
List Price:  $U5,377.88
You save:  $U1,536.64
zł395.31
List Price:  zł553.46
You save:  zł158.14
Already have an account? Log In

Transcript

Now the security plus really likes talking about secure coding techniques. Basically, if we're writing applications, what are some of the security issues that we need to keep in mind as we're actually generating that code. So there's a number of these that are listed. And you know what, I'm just going to go right down the list has actually printed within the objectives for the security Plus, there's no particular order to them. So let's just get them all. However, before we start talking about these, I do want to make sure we're clear on one very important concept.

And that is the idea of compiled versus runtime code. For years, what we would do is you would write code, and you would write it in whatever programming language you chose, you would then run that code through some type of compiler, and then you would generate executable code. And anybody who's seen a piece of code with XC on the end or.com, if you go that far back, understands that these are programs that are run on your system that run through your RAM. Most applications that we run on the internet today are runtime applications. So what we'll have is like something built into our web browsers that can read, basically, highly refined code. In this case, it's not compiled, though it's not executable, it is interpreted by whatever client you have running.

So if you have, for example, a web browser, you can run JavaScript. That's because your web browser is able to read JavaScript scripts, and then actually run them. So there's a big difference between compiled where you have executable code versus runtime code. So if we're going to be in the web, we're probably talking about runtime code and things like JavaScript, for example would be a great example of that. So let's start off with proper error handling. Any application is going to generate errors from time to time.

So if we have a web app in particular You've got some choices here. First of all, you want the application to recognize errors, and put up a nice screen that you know, it says like oops, or sorry, or something like that, so that it doesn't do something evil. Now, here's an example of a bad error handling. Now, I bet a lot of you have seen errors, something like this, what you're looking at here is that the actual application doesn't know what to do with this error. And it has, if we're lucky, it's locked up. If we're unlucky, it could do evil things, like allow us to have root access or actually get into the system behind it itself.

So proper error handling is absolutely critical. Next is going to be proper input validation. Every application there is has some kind of input some kind of dialog box. So let's say for example, I've got an application that wants to actually have you enter a I don't know an email address like we see here. So as we're entering this email email address, we want the application to validate that it's a good email address. And you've probably seen this where if you don't type in something that looks like an email address with an add sign or something like that, the application kicks back and says, try again.

You could go even further than that, you could have somebody enter an email address, and then you can even have it then query that domain like total sem.com, and verify it's a legitimate domain. So that's really up to you in terms of what you want to do with input validation. Next is normalization. databases can be big onerous items. And one of the things we want to avoid is replication of data. When we normalize a database, we use tools like for example indexing, to take what could be just one database and turn it into two or more as needed to allow us to have zero or little replication of data and more efficiency within the database itself.

Next are stored procedures. Now, if you're going to query a database, you should be doing things like for example, proper input validation. Now, if we just leave it to the individual pieces to handle all this, we could run into trouble. So what we often do is we insert a stored procedure between those which are querying and the database itself. So what will happen is that the individual items will then query the stored procedure. And then the stored procedure will do input validation, whatever needs to be done, and then he'll send that to the database, stored procedures, protect databases.

Next is going to be encryption. Now, we got to be careful with encryption because we're going to talk about encryption again in a minute. But what I'm talking about right here is really what we're calling code signing. Your code itself is precious. We don't want people to be messing with the code. If we have updates, we want to be able to create Roll those updates.

So what we do is we actually digitally sign our code so that whoever's getting that code can know that it's in good order, and it's in good shape. Remember, we'll talk about more about encryption shortly. Next is obfuscation or camouflage the same thing. There are situations where you don't really want to go through a full blown encryption of code. But you don't want to make it that easy for people to for example, reverse engineer it and copy whatever you've come up with. So if you take a look here, here's an example of a minified tool used primarily with JavaScript.

If you look on the left hand side, you can see the actual JavaScript code itself. On the right hand side is the exact same code, this time using a minified. So the magnifier gets rid of excess English words it compresses spaces and carriage returns and leaves pretty much nothing more than the runtime code itself. Next is going to be code reuse. And well, we'll throw this in at the same time dead code. All this means is that in any application, if you can reuse known good code, do it.

So that basically means from a coding standpoint, you want to break down as many functions as possible into individual pieces. So the different parts of your code can continue to call it over and over again, as opposed to writing the same thing, two, or three, or four or 600 times with the risk of error. On the same token, dead code is simply code that we're no longer using. A lot of programmers are tempted to keep dead code in their applications, the motivation being they might need it or something like that. A good rule is get rid of dead code, cut it out. The danger to dead code is that sometimes bad guys can take advantage of little inconsistencies in your code to do naughty things.

So go ahead and just take that dead code out of your systems. The next issue is going to be server side versus client side execution and or validation. To make this more clear, let's set up a situation where we have a server and a client. Now in this particular situation, the server is serving up some web application. And the client has a web browser up actually accessing that web application. And let's say one of the things that this web application does is it has a dialog box where you type in your first name, last name, email, address, whatever.

And we then process that in some way. So if we do this on the client side, what we're doing is not only do we fill out the form on the client side, but we'd also perform for example, input validation, and then generate the query and just send the query over to the database on a server side. All we're doing in this situation is we fill out the form and then we send all the data good or bad over to the server, and then the server performs input validation and generates the query. There are good and bad aspects to both of these. And it really depends on what you're trying to do. Keep in mind that if you do stuff client side, you're putting a lot of onus and a lot of security on the individual clients, and you tend to be sending a lot of code to the clients.

On the server side, you tend to put a lot of work on the server. Things like encryption, for example, really come into play here. Depending on if you're just sending a little bit of data to the client, maybe encryption is not a big concern. Whereas if you're taking important chunks of a database, and sending it down to individual clients, then corruption can be a really, really big deal. Next is memory management. The bottom line is that all of these apps use memory.

Now I'm not so worried about on the server side, although that can be an issue. But this really does become an issue on the client side. It is trivially easy for us to make big, ugly applications that eat memory. So not only do we make programs that eat memory, but we can actually inadvertently put in memory leaks. Anybody who remembers Firefox five or six years ago, maybe a little more than that, it was a bit notorious for eating up all the ram in your system. Whenever you ran some types of web apps, Firefox is great.

Now, I love Firefox. The process of memory management usually can be a little bit involved, but it has to do with a lot of testing. Next is use of third party libraries and software development kits. All web apps use lots of third party libraries. Here's a little snippet from the total seminars total tester online, showing just a few of the different types of JavaScript apps that we actually bring in to make our total tester online work. For example, here's one little guy and this little guy called chart His job is to do one thing, help us make pretty charts like these.

The downside to third party libraries is that they can Be big security issues. A lot of times bad guys will not be able to attack your app itself. But they'll find a weakness because a lot of these apps are used by hundreds of thousands of people. So if a bad guy can find a weakness in one of these third party libraries, well, they can take advantage of lots of people not because you've written a bad app, but because a third party library that you lead on has a weakness. The bottom line here is a lot of staying on top of things and lots of patching, and making sure you're aware of weaknesses and vulnerabilities as they appear. The last one is data exposure.

And that's where I really want to talk about encryption. If you have data that is a part of your app, some of that data has risk of exposure. And our job as developers is to reduce if not eliminate any risk of that data exposure, especially if it's personally identifiable info or personal health information. We almost always today go through aggressive encryptions. Anytime, if for example, we bring some data down to a client, I promise you on a good app, all that information is always encrypted. It's really not even.

There's not even an excuse to not do that anymore. So make sure if you have data exposure, you're going to be using lots and lots of encryption. We covered a lot of different secure coding techniques in this episode. Now, look, security plus is not trying to turn you into a code head, but it is expecting you to understand some of the basic concepts of all of these very important secure coding techniques.

Sign Up

Share

Share with friends, get 20% off
Invite your friends to LearnDesk learning marketplace. For each purchase they make, you get 20% off (upto $10) on your next purchase.