Spyros ArgaliasThe original and latest version of this post (how to learn web application security) can be found at Programming Duck.
Learning web application security doesn't have to be painful. In fact, I think it's the same as any other topic, and it doesn't even take that long. There are a few resources that are easy to follow and learn from, especially if you're only looking to learn web security basics.
Why should developers learn about web application security?
Every application needs to be secure, because every application can and will be attacked in absolutely any way imaginable, particularly as it becomes more popular. There are probably hundreds of ways to attack an application and absolutely anything can be attacked.
So at least knowing how to avoid the most severe security vulnerabilities is essential.
Now, if the company has dedicated security specialists, then perhaps the developers don't need to know as much. The specialists will be there as backup to say "hey, we need to validate form input here and escape it here".
However if the company doesn't have dedicated security specialists, then it's purely up to us, the developers, to make sure the application is secure. Regardless, even with security specialists, it's always better for the developers to know security as well. That way we can defend against the most important security vulnerabilities ourselves. Then, security specialists can act as reinforcement rather than our only layer of defence.
How much do we need to know about web application security?
It's important to know at least some of the basics.
More is better, and the more senior developers and / or architects in a company would probably be expected to know a lot about it.
However, it may not be necessary to know it all. Just like most other things in programming, if we know what we need to be aware of, then we can always look stuff up when we need to. We can also use security checklists, or even bring in third parties and experts to audit our application and give us more instructions.
Resources for learning web application security
Here are the resources I used, in order, to learn web application security as a developer. I found them all very good and I highly recommend them.
1. Frontend Masters - Web security with Mike North.
I love Frontend Masters. I find their courses to be the best introductions to topics. The web security course with Mike North is no different.
It's a really good introduction to web security for front end developers. It tackles very important issues. I would only suggest skipping this course if you don't do front end web development at all.
It's only a few hours long, so it won't take very long to complete.
2. The basics of web application security by Martin Fowler.
This article is awesome. It's fairly long and may take anywhere from under an hour to a couple of hours to read.
It teaches the most pressing security issues for web development in general, for both front end and back end. I highly recommend it for everyone.
Also, unless you want to learn web application security quite well, or there is something specific you still want to learn, I think stopping here is alright.
This next one is a lot of work, but if you really want to learn a ton about web application security, go to this page and read through the cheatsheets.
You can skip the ones that aren't relevant to you. You can also skim read what you want. And you can also just pick one or two and read through them. Anything you read will be useful knowledge. If you're not sure which ones to read, it might be best to prioritise the ones related to the OWASP top 10.
But overall, this series has probably everything that you would ever need to know about web application security. Anything else is probably best left to security specialists to audit and tell you about.
Also read this page on Security by design principles to understand some of the main principles behind security.
4. References for more details.
The previous resources are more than enough, but if you want any additional details on certain things you can check out:
For example if you wanted to know more about cookies, how they work, and their settings, you can check out the MDN cookies page.
Or if you wanted more details about CSP (content security policy), you could check out the CSP page on google developers or the CSP page on MDN.
What to do next
Well, I don't actually have personal experience on how to proceed any further. If anyone in the comments wants to chip in then please go ahead.
However I imagine some of the next steps might be:
- Reading more articles from OWASP.
- Learning about monitoring and alerting tools (such as Splunk), vulnerability scanners (such as Arachni), etc.
- Learning some DevOps. Particularly configuring servers and firewalls.
- Learning some basic penetration testing (search "pentesting challenges and labs") or even moving towards official cyber security (a wider field than just application security) and penetration testing certifications.
That's all I've got. Please comment if you have any comments or suggestions, particularly if you want to share any more resources that you think would be useful for beginners.
