Public Key Pinning Boosts Website Security

In the effort to mitigate man-in-the-middle (MITM) attacks, which uses fraudulent SSL certificates, the Public Key Pinning Extension for HTTP (HPKP) has been designed, in order to create a more reliable method of approving a Web server's digital certificate. HPKP permits a site administrator to put up a certificate authority's (CA) public key or certificate to their server's certificate and send the data in an HTTP header. This enables browsers and other apps to see that a server's certificate is approved and signed by a specific whitelisted CS, rather than depending on a chain verification certificate to validate it. The certificate verification stage of the connection is used to carry out the check, prior to any data being sent by the browser.

Google Chrome has been supporting Public Key Pinning for some time now and it has helped in detecting fraudulent SSL certificate issued by DigiNotar, employed in a MITM attack against Google users in Iran and as intermediate CA certificates wrongly issued by TurkTrust. These lapses in the CA infrastructure are sabotaging the confidence in the CA hierarchy of trust. This is the main reason why important browsers are embracing certificate pinning. Besides, public key pinning is supported by Firefox and Google Chrome, Microsoft is also considering it for inclusion in Internet Explorer and a new Web browser, Spartan.

Firefox and Chrome involve a built-in pinset – a list of certificates that are acceptable for big, high security websites – but as of now, no browsers are supporting dynamic pinsets. This means that the list of agreeable certificate authorities for every pinned domain has to be re-loaded at the time of application build-in. This brings in scalability issues and removes all but the major websites. With the help of website application security services, Both vendors try and look at how well dynamic pinsets have to be supported. Web administrators who want to prepare their websites for dynamic pinning have to return the Public Key Pins HTTP header, if their site is accessed over HTTPS. For example, the following header can be send through a web server, which tells the browsers to join a specific SSL certificate with a website.

Header set Public-Key-Pins "pin-sha256=\"base64+info1==\"; pin-sha256=\"backup+pin+here==\"; max-age=15768000; includeSubDomains" (Note: This requires enabling of apache mod_headers)

Including a pin for a backup certificate, which is not being used in production, is also a good practice. This assures that the site is accessible, even after the main certificate gets removed.

Visit Here : http://www.avyaan.com/services/web-application-audit.php

Application Security Testing Helps in Safeguarding Your Apps from Threats

 

Like any other program, a mobile app is also vulnerable to security threats. With the growth of a large number of apps, which require storing and sharing of critical data like bank details or credit card information, personal ID's, data related to health, or making transactions. Because of this, security testing for mobile applications has become essential. It is important to analyze the threat and to plan out how to defend your mobile app against it. Conducting a test without security awareness is not a good idea.

Third-party libraries and codes are used in most of the mobile apps that are developed today. Third-party support is usually related to security threats, against which an app is vulnerable. Even if an app developer is aware of such threats, the performance can be ruined due to the open source components of the app. It also has the capability of sinking the app in the market, even before it emerges. 

Why Should Enterprises Be Concerned?

According to Gartner reports, in 2015, more than 75 percent of apps will not clear security tests – in iOS, android and windows platforms, as the fundamental business related security standards are lacking. The consequences are huge for enterprises as policies are at risk of being breached with critical business related data.

App Security Vulnerabilities

Usage of open source codes for non-core differentiating features is a customary practice and is openly accepted in the process of app development. Time and resources are saved over coding for elements that are non-essential in the app. Therefore, developers cannot ignore guiding third-party libraries and codes, as a part of app development. It is important to grasp the issues and license restrictions related with third-party codes, in order to understand the kind of security exposure faced by your app. A broad-based vulnerability database is created when you register to security updates, which directs towards the category of security threat that is applicable to your app, and checks for reported security concerns. Security threats that go unreported are related to proprietary code extensions or technological evolution, which can cause serious problems in application technology.

Third-Party Open Source Components Security Checklist

Automated testing tools like software security testing should be used to conduct the testing. The app developer should be fully aware of third-party open source components like security ramifications and issues on app users and apps. Capability with third-party party codes make sure that app developer takes complete responsibility of the security issues that are related to it and prohibits hacking by taking care of security flaws and app vulnerabilities.

Read more : https://storify.com/aahnajain1/software-security-for-expansion-of-your-business#publicize