Security Best Practices for Applications with Confidential University Data ¹

1. Ensure that all applications are coded in a secure manner that at a minimum address the vulnerabilities defined in the OWASP Top 10 list ³ (or recognized equivalent secure development guidance).
• OWASP contains a number of best practices, including input validation, parameterized queries and ensuring the principle of least privilege is in place for access to databases.
2. Application testing and monitoring:
   • Regularly assess the security of applications using automated vulnerability scanning, penetration testing, and/or an IT security audit as needed (such as, prior to initial implementation, after a major code revision, upon publication of a new vulnerability, etc.).
   • Have a defined log monitoring practice to identify unusual or anomalous behavior associated with the application and follow it.

3. Platform Testing and Monitoring:
   • Register platforms that house highly sensitive data as a Critical Host ⁴. This will result in regular platform vulnerability scanning by ISC Information Security. When notified that an application registry is available, register applications that access or store Confidential University Data.
   • Have a defined log monitoring practice to identify unusual or anomalous behavior associated with the platform and follow it.
   • Consider using a host intrusion detection system (HIDS) to monitor platforms housing applications with Confidential University Data to observe unauthorized or unusual activity.

4. Establish a repeatable process for responding to external notifications of current/observed attacks. This should include identifying your organization's Security Liaison, and how they will communicate critical information.
5. Purge unnecessary sensitive data from the application regularly and move old data offline whenever possible.
6. Consider encryption for sensitive data at rest.

Please contact ISC Information Security (security@isc.upenn.edu or 215-898-2172) for assistance with the implementation of these recommendations.

[1] Confidential University Data is defined in the Computer Security Policy, and includes Sensitive Personally Identifiable Information, Proprietary Information, and Other data whose disclosure would cause significant harm to Penn or its constituents:
http://www.net.isc.upenn.edu/policy/approved/20100308-computersecurity.html

[3] The OWASP Top 10 list can be found here:
https://www.owasp.org/index.php/Top_10_2010

Also, for a more comprehensive list, please see the OWASP Development Guide:
https://www.owasp.org/index.php/Category:OWASP_Guide_Project

[4] Penn Critical Host Registration:
http://www.upenn.edu/computing/security/crithost/index.php

Download this page as a PDF document

Last updated: Tuesday, February 12, 2013