Security is an important concern for companies that are launching a new web or mobile application. You want to be certain that the integrity of your system and your data are protected against both intentional and casual misuse. Hackers shouldn’t be able to gain access to your database and help themselves to the contents therein, nor should they be able to take down your system and prevent you from conducting the business that you rely upon to support your company.
App security breaches are a frequent occurrence, and when they happen on a large scale, they can be extremely costly for a company. Retailers such as Zappos, Target, Home Depot, K-mart, and Dairy Queen are targets for hackers because of the large amounts of customer data, especially credit card information, they store in their databases.
Personally-identifiable information stolen from businesses can used to perpetrate credit card and insurance fraud. Personal data, such as photos, are intriguing to hackers who wish to embarrass or damage the reputation of politicians and celebrities (as happened recently to Apple’s iCould service).
All aspects of a software system must be built securely, including browser-based clients, mobile clients, local and cloud-based servers, and data transfer between all components. Atomic Object takes customers’ security concerns very seriously and employs a number of patterns and practices with all of our clients to ensure that the software we write for them is safe and secure.
1. Constant Vigilance
The most important piece in a security plan is ensuring that the team responsible for maintaining and managing a company’s apps and servers is cognizant of security concerns, is aware of likely attack vectors, and is actively guarding against hackers. Atomic Object has an excellent Dev Ops team (Justin Kulesza and Mike English) who help our customers set up and maintain their servers. They stay abreast of security issues by reading security-specific publications and news reports and meeting regularly with other dev ops professionals; and the react to issues as soon as possible to ensure that our customers are up-to-date and safe.
A recent example of this was a security hole found in the bash shell in September. Atomic’s dev ops team alerted the company to the issue the same day that the vulnerability was made public and patched all of our clients’ and our own servers as soon as a fix was available.
2. Smart App Design
The first line of defense against hackers is to design an inherently safe application architecture. At Atomic our typical web system consists of a web server that proxies to one or more application servers, which in turn query the database server. The web server has ports 80 (HTTP) and 443 (HTTPS) publicly open for serving the application. The web server only stores configuration information for hosting (e.g. hostnames, rewrites, etc.) and the SSL certificates. The application servers host the source code. The database server stores the actual data. In other words, hackers do not have direct access to the application code or the database.
3. Secure Sever Access
If hackers simply know the login and password to the servers from which an application is hosted they would have free access to the application and its database. Atomic Object helps our customers when setting up their servers by ensuring that account and server passwords are not easily guessable. We use recommended best-practices to create strong passwords that are not shared amongst other customer accounts.
Atomic is also happy to advise our customers on the use of other access security features such as 2-factor authentication, IP blocking, and VPN access where they make sense or are necessary (e.g. if a service must be HIPAA-compliant).
4. Strong Data Protection
If hackers were to gain access to a cloud-based database (for example, if they learned the credentials for the cloud service and were able to get by 2-factor authentication, spoof an IP address, or set up an appropriate VPN) there are protections that can be put into place to ensure that they cannot easily make use of the data stored within.
The most straightforward defense is to minimize the amount of data stored in the database that would be of interest to hackers. Hackers are typically interested in email addresses coupled with passwords, credit card information, photographs, and personally-identifiable information that can be used to perpetrate identity theft, credit card theft, or insurance fraud. Because people tend to use the same password for multiple accounts (despite warnings against this!), the fear is that a user’s password for one app would be the same as for her bank, credit card, health care provider account, etc., and now the hacker would be able to get into those accounts potentially unnoticed. This scenario occurred in 2012 at LinkedIn (http://www.nytimes.com/2012/06/11/technology/linkedin-breach-exposes-light-security-even-at-data-companies.html?pagewanted=all).
It is critical that an app properly salt and hash passwords that are stored in its database. Atomic uses industry-established best practices and proven libraries to do this for all of our customers.
5. Defensive Coding Practices
Finally, developers should be aware of common attack vectors and use defensive coding practices to guard against them. For instance, Atomic’s developers guard against SQL injection attacks and cross-site scripting (XSS) attacks by preprocessing all app input to sanitize what the user has entered and remove SQL and JavaScript statements. And apps that deal in particularly sensitive data, such as health and banking apps, may require session timeouts after a period of inactivity to keep data private and secure.
Any time data is transferred over the Internet there, is the risk that the data packets will be intercepted and read. We mitigate these risks by transferring data using an SSL connection. This ensures that the data is encrypted before transmission. If the data is intercepted, it will be nearly impossible for a 3rd party to read the data. This is the same type of precaution that is taken when carrying out medical, financial, and eCommerce transactions over the Internet. Atomic Object uses secure data transfer techniques as a matter of course with all apps because it is straightforward to do and does not incur undue costs on our customers.
Most importantly, we never send clear text passwords over the Internet. Never!