Battleships
Threats always arrive in input.Websites take streaming input from a variety of sources: web browsers, databases, services, processes, commands etc... Threats occur when someone tries to hide a battleship in one of those streams.
A battleship is input designed to compromise web security. Often a single input can bring a web site down, compromise data or deface the site.
The key to defending a site against battleships is detection — if the battleship can be detected the input can be thrown out.
Locusts
Sometimes threats contain no malicious data whatsoever. For example, consider a distributed denial of service attack (DDoS) — perfectly valid requests may be used.A locust is input that on its own would be harmless — but arrives in such quantity that it compromises web security. Often locusts are designed to interfere with availability — crashing sites or making them too slow to use.
It is more difficult to defend a site against locusts — if they arrive in sufficient numbers even secure websites are vulnerable.
Secure Website Development
Secure website development is a cyclical process of security design, coding, code reviews and testing.
Tweet |
|
