Question 1

Display Generic Error Messages

Accepted Answer

Error messages should not reveal details about the internal state of the application. For example, file system path and stack information should not be exposed to the user through error messages. CWE-209

Question 2

No Unhandled Exceptions

Accepted Answer

Given the languages and frameworks in use for web application development, never allow an unhandled exception to occur. Error handlers should be configured to handle unexpected errors and gracefully return controlled output to the user. CWE-391

Question 3

Suppress Framework Generated Errors

Accepted Answer

Your development framework or platform may generate default error messages. These should be suppressed or replaced with customized error messages as framework generated messages may reveal sensitive information to the user. CWE-209

Question 4

Log All Authentication Activities

Accepted Answer

Log all login attempts, token issuance (OAuth, JWT, etc.), refreshes, and failed authentications. Include relevant metadata such as client ID, IP address, and device info. CWE-778

Question 5

Log All Privilege Changes

Accepted Answer

Any activities or occasions where the user's privilege level changes should be logged. CWE-778

Question 6

Log Administrative Activities

Accepted Answer

Any administrative activities on the application or any of its components should be logged. CWE-778

Question 7

Log Access to Sensitive Data

Accepted Answer

Any access to sensitive data should be logged. This is particularly important for corporations that have to meet regulatory requirements like HIPAA, PCI, or SOX. CWE-778

Question 8

Do Not Log Inappropriate Data

Accepted Answer

While logging errors and auditing access is important, sensitive data should never be logged in an unencrypted form. For example, under HIPAA and PCI, it would be a violation to log sensitive data into the log itself unless the log is encrypted on the disk. Additionally, it can create a serious exposure point should the web application itself become compromised. CWE-532

Question 9

Active Security Monitoring

Accepted Answer

Consolidate system logs into a protected central repository (SIEM) for holistic visibility. Safeguard log authenticity through cryptographic validation including secure transmission and digital signatures. Deploy algorithm-driven surveillance systems that automatically analyze patterns across your infrastructure.Configure notification thresholds to alert security personnel about potential threats based on predefined risk signatures. Implement response protocols tied to detection systems for consistent handling of security incidents. CWE-778

Question 10

Store Logs Securely

Accepted Answer

Logs should be stored and maintained appropriately to avoid information loss or tampering by intruder. Log retention should also follow the retention policy set forth by the organization to meet regulatory requirements and provide enough information for forensic and incident response activities. CWE-533

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Securing Web Application Technologies [SWAT] Checklist

Error Handling and Logging

Data Protection

Configuration and Operations

Authentication

Session Management

Input and Output Handling

Access Control

Nine Key Cloud Security Concentrations & SWAT Checklist

SWAT Checklist Contributors

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Securing Web Application Technologies [SWAT] Checklist

Error Handling and Logging

Display Generic Error Messages

No Unhandled Exceptions

Suppress Framework Generated Errors

Log All Authentication Activities

Log All Privilege Changes

Log Administrative Activities

Log Access to Sensitive Data

Do Not Log Inappropriate Data

Active Security Monitoring

Store Logs Securely

Data Protection

Use HTTPS Everywhere

Encrypt Sensitive Data at Rest

Secure Data in Transit

Implement Proper Key Management

Avoid Storing Sensitive Data Unless Necessary

Field-Level Access Controls

Configuration and Operations

Automate Secure Application Integration and Deployment

Establish a Rigorous Change Management Process

Define Security Requirements

Conduct a Design Review and Threat Modeling

Perform Code Reviews

Perform Security Testing

Secure the CI/CD pipeline

Harden the Infrastructure

Define an Incident Handling Plan

Educate the Team on Security

Applications and Middleware Should Run with Minimal Privileges

Rate limiting

Maintain API Inventory and Documentation

Authentication

Don't Hardcode Credentials

Develop a Strong Password Reset System

Implement a Strong Password Policy and Move Towards Passwordless Authentication

Support modern MFA authentications

Implement Account Lockout against Brute Force and Credential Stuffing Attacks

Don't Disclose Too Much Information in Error Messages

Store Database Credentials and API keys Securely

Session Management

Ensure That Session Identifiers Are Sufficiently Random

Regenerate Session Tokens

Implement an Idle Session Timeout

Implement an Absolute Session Timeout

Destroy Sessions at Any Sign of Tampering

Invalidate the Session after Logout

Place a Logout Button on Every Page

Use Secure Cookie Attributes (HttpOnly, Secure and SameSite Flags)

Set the Cookie Domain and Path Correctly

Set the Cookie Expiration Time

API token handling - Token Generation

API token handling - Token Validation

API token handling - Token storage and transmission

Cross-Origin Resource Sharing (CORS) Configuration

Input and Output Handling

Conduct Contextual Output Encoding

Prefer Allowlists over Blocklists

Use Parameterized SQL Queries

Use Tokens and cookie parameter to Prevent Forged Requests

Set the Encoding for Your Application Content

Validate Uploaded Files

Use the Nosniff Header for Uploaded Content

Validate the Source of Input

Use Secure HTTP Response Headers

Deserialize Untrusted Data with Proper Controls

Mass Assignment Protection

HTML Sanitization for Rich Content

Access Control

Apply Access Controls Checks Consistently

Apply the Principle of Least Privilege

Don't Use Direct Object References for Access Control Checks

Don't Use Unvalidated Forwards or Redirects

Use Secrets Management solutions to protect credentials and API keys

Apply Correct Authorization Checks

Nine Key Cloud Security Concentrations & SWAT Checklist

SWAT Checklist Contributors