Blog | G5 Cyber Security

Web Security Basics

G5 Cyber Security

TL;DR

This guide gets you started with web security fundamentals. We’ll cover common threats and how to protect yourself, even if you’re not a coder.

1. Understanding Common Web Threats

  1. Cross-Site Scripting (XSS): Attackers inject malicious scripts into websites viewed by others. This can steal cookies or redirect users.
    • How it works: A website doesn’t properly check user input before displaying it.
    • Example: A comment section allows HTML tags, letting an attacker insert a script that steals login details.
  2. SQL Injection: Attackers manipulate database queries to access, modify or delete data.
    • How it works: A website doesn’t properly check user input before using it in a database query.
    • Example: An attacker enters malicious SQL code into a login form to bypass authentication.
  3. Cross-Site Request Forgery (CSRF): Attackers trick users into performing actions they didn’t intend.
    • How it works: A website doesn’t verify that requests are coming from legitimate users.
    • Example: An attacker sends a malicious link that, when clicked by a logged-in user, transfers money from their account.
  4. Authentication and Session Management Issues: Weak passwords, predictable session IDs, or lack of multi-factor authentication.
    • How it works: Poorly implemented login systems are easy to crack.
    • Example: Using simple password hashing algorithms or storing session IDs in cookies without proper security measures.

2. Protecting Yourself as a User

  1. Strong Passwords: Use long, unique passwords for each account.
    • Consider using a password manager to generate and store them securely.
  2. Multi-Factor Authentication (MFA): Enable MFA whenever possible. This adds an extra layer of security beyond just your password.
  3. Be Wary of Phishing: Don’t click on suspicious links or open attachments from unknown senders.
    • Always verify the sender’s email address and look for red flags like poor grammar or urgent requests.
  4. Keep Software Updated: Regularly update your browser, operating system, and other software to patch security vulnerabilities.
  5. Use HTTPS: Ensure websites you visit use HTTPS (look for the padlock icon in your browser’s address bar). This encrypts communication between your computer and the website.

3. Basic Security Practices for Website Owners/Developers

  1. Input Validation: Always validate user input on both the client-side (browser) *and* server-side.
    • Example (PHP):
  2. Output Encoding: Encode output to prevent XSS attacks.
    • Example (PHP):
  3. Prepared Statements: Use prepared statements with parameterized queries to prevent SQL injection.
    • Example (PHP – PDO): 
      prepare('SELECT * FROM users WHERE username = ?');
$stmt->execute([$username]);
?>
  4. CSRF Tokens: Implement CSRF tokens to protect against cross-site request forgery.
    • Generate a unique token for each user session and include it in forms. Verify the token on form submission.
  5. Secure Session Management: Use secure cookies (HttpOnly, Secure) and regenerate session IDs regularly.

4. Resources for Further Learning

Exit mobile version