Security (Keep your site secure at extension level) Sergey Gorstka Fastw3b

What is security? Security is the degree of protection against danger, damage, loss, and crime. Security as a form of protection are structures and processes that provide or improve security as a condition. Computer security is a branch of computer technology known as Information Security as applied to computers and networks. The objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to remain accessible and productive to its intended users. Application security encompasses measures taken throughout the application's life-cycle to prevent exceptions in the security policy of an application or the underlying system (vulnerabilities) through flaws in the design, development, deployment, upgrade, or maintenance of the application.

Security Concepts Assurance Countermeasure Defense in depth Exploit Risk Threat Vulnerability

Methodology Knowing your threats. Securing the network, host and application. Incorporating security into your software development process.

Top 5 Extensions Vulnerabilities Cross-site scripting (XSS) attacks. SQL injection Cross-site Request Forgery (XSRF) File inclusion PHP file upload

How to keep your extension secure Process (secure) the input Cast the types Use tokens TEST! TEST! TEST!

General Security Notes Validate input boxes Check HTML editors Hide/remove release notes Use SEF links Set server settings Set file permissions

Choosing secure extension How complex is the extension? Does the extension read or write files to your server? Does the extension interact with other programs on your system? Does the extension validate all user input, such as in form fields and in the URL? When was the last version released? What kind of release is it? (Stable, Release Candidate (RC), Beta, Alpha) Does the extension have a history of good security practices? Is there a support community for this extension? Is the extension generally bug free?

Thank you for your attention! Special thanks to Fastw3b team You can always reach me at Please send your questions/comments/ideas!