Checklist for Secure Cod

Code Programming in Applications

S.No. Action Item(s) Is implemented?

1 Implement CAPTCHA on all entry entry-forms in PUBLIC pages. YES NO Not Applicable
Implement CAPTCHA or account
account-lockout feature on the login
form.
[Alpha-numeric CAPTCHA with minimum 6 characters]
2 Implement proper validations on all input parameters in client and YES NO Not Applicable
server side (both).
listing of characters is preferred over Black-listing]
[White-listing
3 Use parameterized queries or Stored
Stored-procedures to query output YES NO Not Applicable
from databases, instead of inline SQL queries
[Prevention of SQL Injection]
4 Implement proper Audit/Action Trails in applications YES NO Not Applicable
5 Use different Pre and Post authentication session
session- YES NO Not Applicable
values/Authentication-cookies
cookies
6 Implement proper Access matrix ((Access Control List-ACL) to YES NO Not Applicable
prevent un-authorized
authorized access to resources/pages/forms in
website
[Prevention of Privilege escalation and restrict in of access to
authorized/authenticated content ]
7 Do not reference components (such as javascript
javascripts,stylesheets etc.) YES NO Not Applicable
directly third-party sites.
[They may be downloaded and self self-referenced in website]
8 Use third-Party
Party components from trusted source only. YES NO Not Applicable
[Components
Components with known vulnerabilities are not recommended.]
9 Store critical data such as PAN number,Mobile Number,A
Number,Aadhar YES NO Not Applicable
Card number
umber etc. in encrypted form in the database.
[Hashing of sensitive information is preferred over encryption,
unless required to be decrypted]
10 Prevent critical information from public access by any mean YES NO Not Applicable
[Critical information
rmation like credit card number, account number,
aadhar number etc. should be restricted to authorized persons
only. If such information is stored in static files such as excel,pdf
etc., sufficient measures shoul
should be taken so that is it not
accessible to unauthorized persons or in public.]
11 Hash the password before it is relayed over network, or is stored YES NO Not Applicable
in database.
[During login, password should be salt salt-hashed using SHA-256/512.
However, it should be stored as plain hash (SHA-256/512) in
database. On every login attempt, new salt should be used, and it
should be generated from server
server-side only]
12 Implement Change Password and Forgot password module in YES NO Not Applicable
applications
[not required in applications, using LDAP for authentication]
13 Comply with Password Policy,, wherever passwords are being used. YES NO Not Applicable
14 Use Post methods to pass parameters as values from one one- YES NO Not Applicable
page/website to another.
[GET methods should be avoided]
15 Implement proper error-handling.
handling. YES NO Not Applicable
[System/application errors sho should not be displayed to viewer]

Application Security Division, Cyber Security Group

National Informatics Centre
A
A-Block, CGO Complex, Lodhi Road,
New Delhi - 110003
 16 Implement token-based based system that changes on every web- YES NO Not Applicable
request in application, to prevent CSRF.
[CSRF Guard or Anti-forgery
forgery tokens can be implemented in nonnon-
critical applications. Websites using payment
payment-gateways etc. are
categorized in critical websites.]
17 Do not implement File upload in public modules YES NO Not Applicable
18 Store uploaded
ploaded files in database, rather than storing them in file
file- YES NO Not Applicable
system
[Files,
iles, stored in database cannot be executed directly, hence this is
more secure than storing them in file system.]
19 Generate unique, un-predictable
predictable and non
non-sequential receipt YES NO Not Applicable
numbers/acknowledgement
/acknowledgement numbers/application numbers/roll
numbers/ File-names etc.. It is preferable that strong algorithm be
used to generate such numbers.
20 Implement properroper Session Timeout YES NO Not Applicable
[Logged-In In user should be logged
logged-out after a specific period(say 20
minutes) of inactivity]
21 Assure admin/Super-Admin Admin URL’s is/are accessible from restricted YES NO Not Applicable
IP’s only
[For this, segregate public URL from Admin/Super
Admin/Super-Admin module.
Public modules and Admin/Super
Admin/Super-Admin modules should be
deployed on separate URL’s.
Admin/Super-AdminAdmin URL’s should be accessible from restricted
IP’s only. It is preferable to allow access for Admin/Super
Admin/Super-Admin
modules through VPN]
Other Action Item(s)
1 Assure third-Party links/page(partial/full) open in different tab, YES NO Not Applicable
with a disclaimer.
2 Disable Trace/PUT/DELETE and other non non-required methods in YES NO Not Applicable
application/web-server.
3 Assure that Emaill addresses, where ever used, are in form of an YES NO Not Applicable
image.
[Alternatively, replace “@” with [at] and “.” with [dot] in email
addresses]
4 Disable directory listing YES NO Not Applicable
5 Set “Auto to Complete” off for textboxes in forms YES NO Not Applicable
6 Prevent pages from being stored in history/cache. YES NO Not Applicable
[Each time that the user tries to fetch a page, it should request
server to serve with a fresh copy of the page]
7 Implement Logout buttons in all authenticated pages YES NO Not Applicable
Implementation Guidelines
1 Restrict each application for minimum access (only required YES NO Not Applicable
access)
[Allow access of application for restricted network access
access.
Websites, those are to be used in local
local-network, should not be
accessible from any other network. For exceptional cases, VPN
may be used.
Websites, those are required to be accessed from within the
country,, should be restricted for access on Indian ISP’s ONLY.]
2 Use the latest and non-vulnerable
vulnerable versions of Application Server YES NO Not Applicable
(IIS/Apache etc.), Jqueryetc.
3 Enable audit-trails
trails and system logs on server
[e.g. :Web-Access logs, Application Logs, Security Logs etc.

Application Security Division, Cyber Security Group

National Informatics Centre
A
A-Block, CGO Complex, Lodhi Road,
New Delhi - 110003
 4 Take regular backups of data and application YES NO Not Applicable
[Sufficient arrangements should be made to take proper and
regular backups of database,application and other related
objects/components, for retrieval on undesirable circumstances.
It is preferable to maintain a set of last 5 backups.
It is advised to store backups on hard
hard-drive/tape-disks/SAN-
storage. Networked servers/mach
servers/machines should be avoided for this
activity]

For detailed checklist for develo

developers and secure codingguidelines,, visit:
https://security.nic.in/appsec_new.aspx?pid=114&
https://security.nic.in/appsec_new.aspx?pid=114&id=118&index=2
id=118&index=2

Application Security Division, Cyber Security Group

National Informatics Centre
A
A-Block, CGO Complex, Lodhi Road,
New Delhi - 110003