This discussion is archived
6 Replies Latest reply: Feb 6, 2013 4:20 AM by Recx Ltd RSS

Application for both internal and external use

603257 Journeyer
Currently Being Moderated
Hi,
I am looking to develop an application for a small company that will be an order tracking system. The app would need to be accessible externally over the web for customers to log in and check their order status, but also internally by the company staff to update statuses, enter comments etc.
Does anyone have any suggestions or best practices regarding security when pushing an app to the external world?
One thing I considered was having two apps, one for the internal usage and one for the external usage, both with separate parsing schemas. Then create everything under the internal schema and grant select up to the external schema. That way it ensures at the DB level that the application can only read from certain tables. Then anything which the external site does need to update, either do it through a staging table, or grant up the appropriate tables to have insert allowed. Then put triggers on the tables which will raise an exception if columns are updated from a user who isn't authenticated etc.

Does this all sound ok? Is it overkill? Anyone any other suggestions? I want to avoid having multiple databases or instances, simply because for the size of the company it doesn't warrant such complexity (or cost/resources). We won't be storing any "sensitive" data so to speak, but obviously need to protect against malicious intruders.

Thanks
  • 1. Re: Application for both internal and external use
    TexasApexDeveloper Guru
    Currently Being Moderated
    You could setup a VPD so that certain user groups (eternal users) had less access to data that internal users... Thus the forms and such would be setup and menu items would be limited to certain access groups... Would that work?

    A blonde goes to the doctor and as she touches each part of her body with her finger she says: Doc it hurts everywhere. My leg hurts, my arm hurts, my neck hurts, and even my head hurts! Doc what's wrong? The doctor answers: Your finger is broken!

    Thank you,

    Tony Miller
    Ruckersville, VA
  • 2. Re: Application for both internal and external use
    603257 Journeyer
    Currently Being Moderated
    Hi,
    Yes I did consider using VPD controls on the table. I think my main concern was trying to ensure that the data was as safe as possible should the site be compromised by an attack. Obviously I will be coding to prevent SQL Injection attacks and the like, but with it being outward facing I'd like a fallback in case something does happen.

    Does anyone have any other best practices for outward facing apps? Things like always using session state protection, enforcing password lockout on failed attempts etc etc?
  • 3. Re: Application for both internal and external use
    scott.wesley Guru
    Currently Being Moderated
    As a gratuitous self plug, I did a presentation on security for 4.1 - while it's not public app specific, it might give you some features to consider
    http://www.grassroots-oracle.com/p/presentations.html#ApexSecurity

    I was at a site once where the main focus was ensuring the parsing schema was isolated from the rest of the database, in regards to privileges, views etc - similar to what you might do when defining a schema for a remote database link.

    Scott
  • 4. Re: Application for both internal and external use
    TexasApexDeveloper Guru
    Currently Being Moderated
    With a firewall in front and a public facing app server to filter out undesirable IP's .. Would that help the situation?

    Thank you,

    Tony Miller
    Ruckersville, VA
  • 5. Re: Application for both internal and external use
    VC Guru
    Currently Being Moderated
    /dev/null wrote:
    Hi,
    Yes I did consider using VPD controls on the table. I think my main concern was trying to ensure that the data was as safe as possible should the site be compromised by an attack. Obviously I will be coding to prevent SQL Injection attacks and the like, but with it being outward facing I'd like a fallback in case something does happen.

    Does anyone have any other best practices for outward facing apps? Things like always using session state protection, enforcing password lockout on failed attempts etc etc?
    Yes you must enable and configure the session state protection and also be careful when choosing ajax for data validations and stuff like that.
  • 6. Re: Application for both internal and external use
    Recx Ltd Explorer
    Currently Being Moderated
    When looking to design your application in this scenario it is best to assume the worst and see what impact it has on your environment. There are several attack scenarios that immediately spring to mind

    A problem in the Apex framework leads to running arbitrary SQL statements.
    A problem in the code leads to running arbitrary SQL statements.
    A problem in the code leads to cross-site scripting attacks.
    Configuration problems mean Apex components are available to the Internet.

    Obviously if cost is an issue there will always be a compromise in security so make sure you can do the the absolute best with the resources available to you. Separating the Internet side from the Internal side as much as you can is always a good idea.

    Sony was recently fined in the UK for not doing enough to protect personal data, so you should have evidence to ensure you have done the absolute best you can.

    Two things available over the internet currently to help you;

    https://secure.recx.co.uk/ApexSecUI/ - ApexSec Security Scanner
    http://www.enkitec.com/products/esert_cloud - eSert cloud

    Both provide free credits to scan your application for security problems for free.

    Edited by: Recx Ltd on Feb 6, 2013 12:12 PM

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points