[MUSIC] Welcome back, in this module, we talked about three different
kinds of injection issues. SQL injection, cross-site scripting
injection and command injection. We also discussed, in the first module,
the OWASP proactive controls. Now we're going to talk about
the OWASP proactive controls as they are related to mitigating
these injection issues. After this lesson,
you will be able to review OWASP proactive controls related to
mitigating injection issues. The first proactive control that we want to make sure to keep in mind
is to define our security requirements. Now this is fundamental to addressing many
kinds of vulnerabilities, specifically for injection issues as an example. If we have a solid definition
of our security requirements, now we can hone in parts of the
application that require special attention such as where we should be encoding and
escaping untrusted user input. The next OWASP proactive control that
I want to highlight in light of these injection issues is a control of
leveraging security frameworks and libraries. Now we want to use security encoding
libraries in order to process our date input data so that we can prevent,
for example, cross site scripting. In addition, we want to make sure to remember to
use a loss positive prevention model. Next, we want to keep in mind
to make sure to have setup for ourselves, database access that is secure. So this means setting up your
database with secure configurations because they don't come secure
by default right out of the box. We want to also set up
secure authentication and secure communication between the database
and the server side application. But more specifically, we want to use
queries to that database securely. So this means not trusting queries
that have user input in it. For furthermore,
we want to use prepared statements with parameterization when
performing our queries. This is so that we can prevent
SQL injection vulnerabilities. The next control that I want to
mention is to encode and escape data. This is our defensive technique for
preventing injection attacks. The next proactive control that I want
to mention is to make sure to validate all of our user data inputs. We want to make sure that only properly
formatted data can be processed further. Keep in mind that validating input data
has to be used with additional defenses like query parameterization and escaping. The last OWASP proactive control that
I want to mention that is related to mitigating injection issues is to
implement security logging and monitoring. Security logging is especially
important when we want to collect information during intrusion detection,
specifically when we'd like to know if there has been unusual input
data entered by attackers, in order to try to take advantage
of an injection vulnerability, especially one that we may not have even
realized that we have in our application. This information can be used to get a
larger picture when dealing with intrusion detection incident analysis. So, to summarize the mitigations that
we have mention in Module 2, for SQL injection we want to use prepared
statements with parameterization. For cross-Site scripting injection
we want to make sure to keep in mind to use OWASP's positive prevention model,
were the prevention model is to only allow modifiable data in
specific document object model locations. We also want to use security and
encoding libraries. For command injection, we want to
avoid placing user controlled data into commands that will eventually
be processed by a shell. But if you cannot avoid that,
use white listing and validation of user input data to ensure
that there are no improper strings. For example, no shell control flow
characters like pipe and ampersand. And that's it for now. Thanks for listening.