Archive

Archive for September, 2012

PHP Application Security Checklist

September 10, 2012 Leave a comment

Similarly to the OWASP Cheat Sheet on PHP security, there is another great checklist to be shared – PHP Application Security Checklist.

Structured in a way for you to be able to revise all aspects of an existing PHP application. Print a couple of times and perform a security audit of your website until full completion of the list.

General topics covered:

  • Basic
  • Input
  • File Uploads
  • Database
  • Serving Files
  • Authentication
  • Sessions
  • 3rd Party
  • Misc
  • Shared Hosting
Advertisement
Categories: PHP Tags: ,

Basic mobile security practices

September 7, 2012 Leave a comment

Traveling with a smartphone, tablet and a netbook is a common thing for an IT or business expert. Unfortunately keeping your highly intelligent device connected online to a number of services that you’ve been using could lead to a serious breach in case a device is stolen or lost.

You can prevent or slow down the data leakage by following several simple steps:

  1. Protect your device with a security software such as Cerebro or Where’s My Droid.  A device could be tracked and found with a modern software, some of them have an extra feature to wipe your phone data or send SMS from/to it.
  2. Report your device to the nearest police department. You need some verification documents and the IMEI (or another unique device number) in order to make it work.
  3. Don’t auto-login to your services. Use a password verification every time you use a service (email, reader, blog, twitter etc)
  4. If your service requires a constant login, create a separate account if possible. For instance, create an author account for your blog, an email that pulls only the most important data while you’re out and so on.
  5. Some email vendors such as Gmail add an extra security layer. You could check the ‘Last account activity’ feature at the bottom right corner and see the last login and IP address, as well as to conduct a remote logout of your missing device for security reasons.
  6. If a second-level account has been active on the device, delete it at home. First-level devices require at least a password change and monitoring for some time (some applications don’t verify the password after the first login for some amount of time).
  7. Monitor the online markets for second-hand devices. You could report your IMEI to some of the forums/markets so that no device could be added for sale should it be stolen.

 

 

Categories: Security Tags: , ,