Web Application Checklist Prepared by Krishni Naidu References

Java
Ensure that the Java application is sandboxed.
Ensure that the jave.security, java.security.acl and java.security.interfaces packages are run.
Run the application with the following:
java –Djava.security.debug=help
This will output the results of Checkpermission calls, loading and granting policies, dumps of relevant domains and other information. Review the output to ensure that it is appropriate in terms of security.
Ensure that the SecureRandom class is used to create random numbers.
Ascertain if form based authentication or basic authentication is being used. If it is form based authentication, ensure that sensitive forms are protected via userids and passwords.
Since userids and passwords are passed in the clear ensure that SSL is used.
Ensure that the code includes a line that does not permit access if the authentication fails and returns the user to the login form again e.g.:
// if the user is not authenticated
if ( !isAuthenticated .booleanValue() )
{
// process the unathenticated request
unauthenticatedUser (response, requested Page) ;
}
Ensure that code exists to store the user authentication information inside a session variable e.g.
// create a session
session + request.getSession ( True);
// convert the Boolean to a Boolean
Boolean booleanIsAuthenticated + new Boolean( isAuthenticated) ;
// store the Boolean value to the session
session.putValue(
Constants.AUTHENTICATION,
BooleanIsAuthenticated) ;
Ensure that the classes available to the virtual machine are limited. Review the classpath to ensure that unnecessary entries are removed.
Ensure that the code does not have access to third party tools or extraneous code.
Review the various sensitive beans to ensure that the EJB’s deployment descriptor has the following code:
(accessControlEntries
DEFAULT [administrators basicUsers
TheRestrictedMethod [administrators]
) ; end accessControlEntries
This ensures that only the administrators have access to the restricted method.
Review the weblogic.properties file to ensure that only authorised administrators are listed in the administrators group.
Ensure that the java.security.acl package is used to grant permissions and add new users.
Review all user permissions using the following:
Boolean isReadFileAuthorized = accessList.checkPermission (*User,
ReadFile) ;
Ensure that user permissions are appropriate e.g. only the designer has access to the owner object.
Ensure that the security manager has been enabled.
Ensure that non final public static variables are not used since there is no way to check whether the code that changes such variables has the appropriate permissions.
Ensure that the scope of methods and fields are reduced as much as possible.
Ensure that developers have refrained from using public methods/fields.
Ensure that any public method that has access to and/ modifies sensitive states includes a security check.
Ensure that adequate steps have been taken to prevent against package insertion e.g.:
add line to java.security properties file
package.defeinition=Package#1 [, Package#2,….., Package#n]
Place the package’s class in a sealed JAR file
Ensure that the following line has been added to the java.security properties file to protect package acesses:
Package.access=Package#1 [,Package#2,…….,Package#n]
Ensure that objects are made immutable.
Ensure that there is no return of a reference to an internal array that contains sensitive data.
Ensure that user given array of objects is not stored directly.
If serialisation is used ensure the following precautions are taken:
Ensure that the transient keyword is used for fields that contain direct handles to system resources and that contain information relative to an address space.
Ensure that a class defines its own deserialising method and that the ObjectInputValidation interface is used to validate invariants.
If a class defines its own serialising method, ensure that it does not pass an internal array to an DataInput/DataOutput method that takes an array.
Ensure that byte streams are encrypted.
If untrusted code has a restriction in creating an object, ensure that the untrusted code has the same restriction when it deserialises the object.
Ensure that native methods are examined for the following:
What they return
What they take as parameters
Whether they bypass security checks
Whether they are public or private
Whether they contain method calls which bypass package boundaries, thus bypassing package protection
Ensure that sensitive information such as credentials is kept in mutable data types.
Ensure message digests or digital signatures are used to protect the integrity of sensitive data.
|