Securing Web Application Technologies [SWAT] Checklist

The SWAT Checklist provides an easy to reference set of best practices that raise awareness and help development teams create more secure applications. It's a first step toward building a base of security knowledge around web application security. Use this checklist to identify the minimum standard that is required to neutralize vulnerabilities in your critical applications.

Jump to:

Error Handling and Logging
Data Protection
Configuration and Operations
Authentication
Session Management
Input and Output Handling
Access Control

Error Handling and Logging

Data Protection

Configuration and Operations

Authentication

Session Management

Input and Output Handling

Access Control

Nine Key Cloud Security Concentrations & SWAT Checklist

Download your free copy of this poster here.

Download Now

SWAT Checklist Contributors

David Deatherage, Silicon Valley Bank

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Securing Web Application Technologies [SWAT] Checklist

Error Handling and Logging

Display Generic Error Messages

No Unhandled Exceptions

Suppress Framework Generated Errors

Log All Authentication Activities

Log All Privilege Changes

Log Administrative Activities

Log Access to Sensitive Data

Do Not Log Inappropriate Data

Active Security Monitoring

Store Logs Securely

Data Protection

Use HTTPS Everywhere

Encrypt Sensitive Data at Rest

Secure Data in Transit

Implement Proper Key Management

Avoid Storing Sensitive Data Unless Necessary

Field-Level Access Controls

Configuration and Operations

Automate Secure Application Integration and Deployment

Establish a Rigorous Change Management Process

Define Security Requirements

Conduct a Design Review and Threat Modeling

Perform Code Reviews

Perform Security Testing

Secure the CI/CD pipeline

Harden the Infrastructure

Define an Incident Handling Plan

Educate the Team on Security

Applications and Middleware Should Run with Minimal Privileges

Rate limiting

Maintain API Inventory and Documentation

Authentication

Don't Hardcode Credentials

Develop a Strong Password Reset System

Implement a Strong Password Policy and Move Towards Passwordless Authentication

Support modern MFA authentications

Implement Account Lockout against Brute Force and Credential Stuffing Attacks

Don't Disclose Too Much Information in Error Messages

Store Database Credentials and API keys Securely

Session Management

Ensure That Session Identifiers Are Sufficiently Random

Regenerate Session Tokens

Implement an Idle Session Timeout

Implement an Absolute Session Timeout

Destroy Sessions at Any Sign of Tampering

Invalidate the Session after Logout

Place a Logout Button on Every Page

Use Secure Cookie Attributes (HttpOnly, Secure and SameSite Flags)

Set the Cookie Domain and Path Correctly

Set the Cookie Expiration Time

API token handling - Token Generation

API token handling - Token Validation

API token handling - Token storage and transmission

Cross-Origin Resource Sharing (CORS) Configuration

Input and Output Handling

Conduct Contextual Output Encoding

Prefer Allowlists over Blocklists

Use Parameterized SQL Queries

Use Tokens and cookie parameter to Prevent Forged Requests

Set the Encoding for Your Application Content

Validate Uploaded Files

Use the Nosniff Header for Uploaded Content

Validate the Source of Input

Use Secure HTTP Response Headers

Deserialize Untrusted Data with Proper Controls

Mass Assignment Protection

HTML Sanitization for Rich Content

Access Control

Apply Access Controls Checks Consistently

Apply the Principle of Least Privilege

Don't Use Direct Object References for Access Control Checks

Don't Use Unvalidated Forwards or Redirects

Use Secrets Management solutions to protect credentials and API keys

Apply Correct Authorization Checks

Nine Key Cloud Security Concentrations & SWAT Checklist

SWAT Checklist Contributors