Web Security

To guarantee the security of our web applications, from day one, SPG follow industry best practices throughout the design and development phases. This ensures that our applications will be kept safe from attacks whilst protecting your company’s valuable data.

Why Web Security Is Important

Securing web applications should be of paramount importance to any organisation, as failing to do so can result in data theft, damaged relationships with customers, revoked licences and legal proceedings. What’s more, with cybercrime continuously on the rise, web applications are particularly vulnerable targets. This is usually a result of:

Ease of Execution

Attacks may be easily automated and launched against thousands of concurrent targets.

High value rewards

Unauthorised source code manipulation can lead to highly sensitive corporate data.

Source code complexity

The likelihood of unintended vulnerabilities is unavoidably significantly greater.

Why Not Invest in Application Security?

The Fundamentals of Web Application Security

From start to finish, we handle every aspect of your web application’s security.

Client Security

Any device connected to your network will be susceptible to potential security threats. This is why we provide our customers with a tried-and-tested high-tech safety net. From spyware software and secure authentication to all the latest firewalls and safety protocols, we use the full gamut of client security tools to deliver on your company's priorities.

Data Security

SPG employ a wide range of techniques and technologies including encryption, data resilience, data masking and data erasure to protect the information that you store, collect, create, receive or transmit. We are also entirely compliant with both HIPAA and European GDPR regulations, so whether you work in healthcare, education or finance, your project is in the safest of hands.

Content Security

To significantly reduce the risk of cross-site scripting (XSS), data injection, clickjacking, and other forms of attack on browsers, Software Planet Group use content security standards that can protect your company’s online standing. These enable you to declare all the approved origins of content that the browser will then be allowed to display.

Staff Training & Drills

Your project’s confidentiality is our #1 priority. This is why we follow strict security measures that prevent data leaks and other incidents. In addition, we offer regular staff training on information security and awareness to all our junior and senior-level developers. This reinforces our culture of learning, which keeps your team members up to speed with the latest threats.

Customer's Audit

We have a policy of complete transparency. This means that before getting started on your projects, you can even request access to all our offshore development centres. Your company auditors may then assess our physical infrastructure and the security measures we have put in place, so you can choose to move forward with your projects with total confidence and peace of mind.

OWASP Recommendations

Our software developers are thoroughly trained in all the latest OWASP recommendations. This includes the Top 10 Web Application Security Risks and the SANS Institute’s Securing Web Application Technologies (SWAT) checklist. Moreover, we closely follow OWASP’s Web Security Testing Guide, a comprehensive and reliable framework used by penetration testers and organisations worldwide.

How We Handle Common Vulnerabilities in Web Applications

To guarantee the security of our web applications from day one, Software Planet Group follow industry best practices throughout the design and development phases. This ensures that our applications will be kept safe from attacks whilst also protecting your company’s valuable data.

1. Injection Flaws

Injection flaws like SQL, NoSQL, OS, and LDAP injection can happen whenever untrusted data is sent to an interpreter as part of a command or query. This not only results in data loss and data corruption, but may also lead to disclosure to unauthorised parties, loss of accountability, denial of access and complete host takeover. To prevent these vulnerabilities, Software Planet Group employ safe APIs, positive (or “whitelist”) server-side input validation, in addition to LIMIT and other SQL controls that avert disclosure of records in the event of SQL injection.

2. Broken Authentication

Broken authentication takes place when authentication and session management functions are implemented incorrectly. As a result, criminals can often get a hold of passwords, session tokens and keys for the purposes of money laundering, fraud and carrying out other illegal activities. In order to prevent this, we implement multi-factor authentication wherever possible, never use default credentials when shipping or deploying web apps, implement weak password checks, limit failed login attempts and generate random session IDs using secure server-side session managers.

3. Sensitive Data Exposure

Sensitive data exposure occurs when APIs and web applications do not adequately protect your data. This can often compromise financial, healthcare, and other sensitive personal information. We avoid such security risks by appropriately identifying sensitive information, discarding critical data at the earliest opportunity, maintaining up-to-date standard algorithms, encrypting all sensitive information at rest, and using protocols like TLS to encrypt sensitive data in transit.

4. External Entities Within XML Documents (XXE)

These may easily be exploited by criminals to scan internal systems, disclose internal files using the file URI handler, execute remote requests and perform denial-of-service attacks. We prevent XXE by utilising less complex data formats such as JSON, patching or upgrading XML processors and libraries, making use of SAST tools to detect XXE in the source code in addition to whitelisting server-side input validation.

5. Broken Access Control

When restrictions on authenticated users are not adequately enforced, broken access control ensues. Attackers may then exploit this lack of due diligence to act as users or administrators, gain access to unauthorised functionality and the ability to view sensitive files. We can stop this from taking place by implementing access control mechanisms throughout the application, logging access control failures (alerting admins whenever appropriate) and enforcing access control in server-side code or a serverless API.

6. Security Misconfiguration

This is likely the most common issue in web security, as it may in fact occur at any level of the application stack. While it is often a result of insecure default configurations, it can also be caused by incomplete configurations, misconfigured HTTP headers and more. These flaws provide attackers with unauthorised access to system data or functionality and can sometimes result in total system compromise. Our experts avoid this problem by implementing secure installation processes like segmented application architectures.

7. Cross-Site Scripting

Cross-site scripting occurs when applications include untrusted data in a new web page without suitable validation. XSS thus enables criminals to execute malicious scripts in their victim’s browser in order to steal credentials, deface web sites, deliver malware and redirect the user to harmful websites. To effectively do away with XSS flaws, we must separate untrusted data from any active browser content. This is primarily done by using frameworks such as Ruby on Rails and React (which eliminate XSS by design), applying context-sensitive encoding when modifying the browser document and conscientiously enabling a Content Security Policy (CSP).

8. Insecure Deserialisation

Insecure deserialisation is a major security vulnerability which may potentially result in problems such as remote code execution, replay attacks, privilege escalation and injection. The best way to mitigate it is to implement a zero-tolerance policy towards serialised objects from untrusted sources. Should this not be possible, however, we may also implement integrity checks like digital signatures on serialised objects, enforce strict type constraints prior to object creation, and isolate and run code in low-privilege environments.

9. Using Components with Known Vulnerabilities

Using components with known vulnerabilities may completely undermine application defences. This includes frameworks, libraries and other software modules, as they facilitate serious data loss or even server takeover. Consequently, it is vital to always remove unused dependencies and features, obtain components from official sources and actively maintain a strategy for finding outdated and unsupported components.

10. Insufficient Logging and Monitoring

Insufficient logging and monitoring empowers criminals to further attack systems. Our experts can also prevent this by making sure that logs are generated in formats suitable for log management solutions, identifying malicious activity through logs with adequate user context, preventing tampering and deletion by ensuring that high-value transactions possess an audit trail with integrity controls and adopting a response and recovery plan (like NIST 800-61 rev 2 or similar).

Our Additional Web Security Measures

NDAs for all project participants

Internal Information Security Policy

Repository on the customer’s premises

Restricted access to the production environment

IP-restricted access to intranet

Encrypted emails

Trusted VPNs

Cybercriminals Wait for No One

Take Control of Your Security Today

Web Security

Why Web Security Is Important

Why Not Invest in Application Security?