Security Matters

Recently, somebody asked me to take a look at a product they had, and give them some information on what I could do to improve it. Their product was a simple survey tool, focused on gathering data from users they invited or that had paid to use the tool. It seemed straightforward enough. Sure, I had a few concerns: the site had been outsourced, and this person wasn't a technical individual, but I figured I could take a look.

What I found was pretty shocking.

Passwords stored in plain text. No SSL encryption for logins or credit card data. A complete and total lack of any kind of password policy. And this was before I even got into the code.

Too often, it's easy to forget about security considerations when we're working on building something for a client. Security is one of those things that it seems people learn once and then assume they know, like riding a bicycle. But it's not. Security is an ongoing learning process.

When was the last time you stepped out and took a look at the OWASP Top Ten? It changes every year and is worth a look. How about examined security policies in your own app? Checked to make sure your password storage algorithms are up to par? Verified that you're using the latest and greatest version of PHP with all the security fixes? Updated that legacy site to use PDO instead of MySQL_*?

You might think security doesn't impact you, or that once you're done working for a client that the security of a particular application doesn't matter. It does! Clients can and will come after you for security vulnerabilities if they get hacked. And security vulnerabilities can be expensive: just one set of stolen credit cards can ruin a company's reputation and financial bottom line.