Building Security Into Your Web Design
Websites and web apps are increasingly targets of hackers; and generally, the larger their network of visitors and subscribers, the bigger a target they are. From cross-site scripting vulnerabilities to API security issues, it seems as though it’s only easier and easier for malicious individuals to gain access to websites and databases.
There are two important areas to consider when building security into web design: the front end, which is generally what visitors and subscribers see, and the back end, which is the administrative areas related to servers, hosting providers, and databases. Generally, front-end security issues are those which are client-facing.
Front-end security is one of the primary concerns which faces website developers and designers, and should be just as much a priority as having a beautiful-looking and great-functioning website. We’ll discuss a few of the most common and reliable ways to build security into your front-end web design.
Defending Against Cross-Site Scripting
Often denoted as ‘XSS’, cross-site scripting is generally an issue with web-based applications, and occurs when attackers inject malicious script into pages of a site which visitors are likely to view. Many hackers utilize cross-site scripting vulnerabilities to bypass access controls such as admin logins and restrictions. According to Symantec, cross-site scripting vulnerabilities account for more than 80% of all website vulnerabilities.
These vulnerabilities usually show up when websites and apps don’t exercise appropriate control over executable code. When users and visitors have access to executable code, malicious hackers can modify that code to inject alterations into the website script. A great example is if a website developer is creating a file or photo-sharing website, they must do their due diligence to ensure that the script removes wipes malicious code that individuals might try to upload embedded in an image or other document.
Protecting against cross-site scripting vulnerabilities generally requires starting with a strong security foundation. Many hosting providers and website frameworks provide built-in protections. If you’re building on WordPress, for example, updating your framework and plugins regularly to the most-recent releases will help secure your website. Only use plugins which have been tested with your version of WordPress, and regularly check patch and update logs to see that security is a top priority for the developers of your themes and plugins.
Iframe Vulnerabilities
Many websites use iframes to display complex content which isn’t native to the website. For example, oftentimes showing Youtube or Vimeo videos require the use of iframes. Unfortunately, this often means that any malicious content which already exists within an iframe can detrimentally affect your website and users. And if you think major websites like Youtube are safe from hackers, think again!
Defending against vulnerabilities in iframes is luckily relatively simple. First, ensure that no iframes are used on sensitive pages of a website, or those which can post user input. Another tip? Utilize the sandbox attribute for any iframe you place on your website.
HTML5 Elements
Any website developer which utilizes APIs and other HTML5 elements should be aware that these also have their own security vulnerabilities, and that some APIs and API plugins are more secure than others. Updated browser versions and security can protect end-users from most issues, but at the end of the day you cannot assume that your visitors practice best web safety practices. Where possible, engage HTTP headers for maximum allowable security to still accomplish the necessary functions of the page. Not only is this useful for x-frame options and XSS protection, but strict transport security options can prevent SSL attacks, and content security policies can also reduce XSS vulnerabilities and other application weaknesses.
Focus on 360 Degree Safety
With luck, this article on quick and easy tricks to build security into your web design have helped you reconsider your current safety techniques. Because ultimately, cyber security for a website will begin and end with its builder. To ensure that your own browser and computer don’t pick up malware and spread issues, always run up to date virus protection and malware protection. Engage in regular security checks for your machine and website, and review any additions to your website for security soundness
ABOUT THE AUTHOR
