IN
NL
Principles of Web Security
Following are few web security principles followed by prominent web software development companies in India:
Confidentiality
The CIA/ AIC triad i.e. Confidentiality, Integrity and Availability are a model specifically designed for guidance to an organization’s information security.
Confidentiality means unauthorized party/ individual cannot gain access to an organization’s sensitive data. If at all someone manages to gain access through unintentional behaviour then such a failure of confidentiality is called a breach.
For example, what if, your bank records are revealed on a public website that would be a breach.
In short, if anybody gains access to data/ information he/ she shouldn’t have an access to, then that is the confidentiality breach.
Integrity
Integrity is to ensure that information is not altered or to ensure that the authenticity of the data is maintained.
For example, if u own an e-commerce website and someone try to change the prices of the products and you are unable to alter the data then that is the failure of integrity of information.
Another example of failure would be if you try to connect to a website and the attacker redirects your traffic to a different website which is not genuine.
Availability
This means information is accessed by an authorized user when needed. The information is valuable if only it can be accessible at the right time. Denial of service is a very common attack these days. Main purpose of DOS is to deny users the access to the resources or information they are authorized to access. Such downtimes turn out to be very costly. You can ensure availability by keeping a backup which could save information in situations such as natural disasters or damage to system/ hardware.
Authentication
This is the first process which provides a way to identify the user by having the user enter its valid user name and password.
In other words it is a process which determines if someone is in fact, who he/she declares to be. If the credentials match the user is granted access and if credential varies then authentication fails and access is denied.
Here the credentials are compared to the files in the database of authorized users within the server. When the process is complete, the user is authorized to see or access and have rights to access the information.
Authorization
Authentication precedes authorization.
After getting access to a system, the user might try to issue commands. The authorization determines if a user has the authority to issue the commands.
It is a process of giving permission to do something or have some information access
Accountability
This ensures that the actions of an entity can be traced and all its operations can be identified.
On the other hand accountability is that the employee is responsible for completing the task and will have to explain why if at all they fail to do so.
The two pillars of good corporate governance are accountability and transparency.
Non repudiation
It is the ability to prove that a particular operation cannot be repudiated later. It is the assurance that anyone cannot deny something later
For example, with the help of emails one gets a guarantee of the sender and the recipient, digital signatures or email messages.
One cannot deny the signature of the document between two parties via digital signature or encryption.