You may not be authorized to see this content. Please contact Data Access Europe for more information.

Cancel Data Access Europe

You are not authorized to see this content.

Cancel Data Access Europe

Security the Basics

1h 50m

Intermediate

These days it's important to secure your applications and your data for, for example, hijacking. This course shows some security measures you can take with your applications. From verifying hashes, store passcodes securely, add 2-factor authentication to your web applications and use encryption. A part of the course is based on the Security Library, which you can freely download.

Start course

Introduction to the Course.

Install the workspace

The DataFlex Studio operates within a workspace. A workspace defines the areas where your source files reside. The workspace is the area where you build your projects. Before moving further into the lessons a workspace needs to be installed (download available on main page of this Course).

Data Protection

Cyber security is essentially data protection. A 100% secure but usable system does not exist. Even a genuine user, at some point in time, can become a threat. These threats cannot always be completely blocked from doing harm, but the damage can be reduced. This lesson shows in which way data can be protected.

Restrict database access to your applications

The previous lesson introduced two conditions that are of vital importance to restrict database access. This lesson will focus on restricting access to the database since this is the first thing to deal with during development and deployment.

Data in transit https Web

HTTPS is very important, because it encrypts data. This lesson will focus on making sure that data being transferred across the internet is only available to your application using HTTPS.

SQL injection is a code injection technique, where malicious SQL statements are inserted into an entry field for execution. This can happen if SQL filters or a completely embedded SQL query are being used. This lesson shows an example of SQL injection.

DataFlex Security Library overview

The DataFlex Security Library is a collection of three libraries. There is a base library that contains the abstract classes that are implemented by the others. There is library for the Cryptoapi Next Generation (CNG) encryption engine, which is a library of encryption routines that are available within Windows. Lastly, there is a library for libsodium, which is an external DLL containing more recent and advanced algorithms. This course gives more details of the Security Library.

Generic hashes are one-way values that can be generated from a very short or very long amount of data. They are hard to manipulate and are mostly used to for things such as checking file integrity or indexing. This lesson shows how to code a simple hash in DataFlex.

A keyed hash is a specific type of message involving cryptographic hash function in combination wiht a secret cryptographic key. This lesson shows how to create keyed hashes.

Data at rest is data that is not being actively used. It can be data on a hard drive, in log files, copies on a database or in backups. This lesson shows how to secure this data.

Encryption Symmetric key encryption seclib

Symmetric key encryption is when the same key is used to encrypt and decrypt data. A view, SymKeyEncrypt.vw, has been created in the SecurityBasics workspace to how symmetric key encryption works. This lesson shows how to work with seclib.

Encryption Authenticated Encryption (seclib)

When something is encrypted it is secret, but it is not really protected from being manipulated. Authenticated encryption not only provides sypher text, it also provides an authentication tag, which can be used to verify that the data is not being manipulated or damaged. This lesson shows how to work with Authenticated encryption.

Encryption Key Storage

There are several options for storing encryption keys: in your database, hardcode in your programs, in a seperate file on the file system. In this lesson we shortly discuss the several options.

Access control is giving users appropriate rights so that they can do what they need to but are blocked from doing anything else. This lesson shows several examples where Access Control might be useful.

Authentication Overview

Identities, such as just an email address, are not secret, so it is easy to impersonate someone to commit fraud. Authentication is when a user proves their identity. This lesson gives an overview of Authentication.

Authentication Passcode Storage

If passwords are stored as plain text, they can be abused. Therefore, they must be stored securely, which in this context means expensive to break. Dedicated password hashing algorithms use specific amounts of processing power to generate a passcode hash. Others also make sure that a certain amount of memory is needed. This lesson demonstrates this by using the view 'Play with Passcodes'.

Authentication Passcode Storage (Web App)

The first thing to do when storing a passcode is to make sure that a new passcode is immediately encoded when it is first entered. To help with this, a mixin has been created that can be used in the Data Dictionary. This lesson demonstrates the use of the mixin.

Occasionally generating random keys using a cryptographically secure random number generator is not feasible, such as when a key is actually a passcode. Key derivation comes into play when a passcode needs to be turned into a proper key. This lesson shows how to work with Key Derivation.

Authentication Stronger Passcodes

Users often choose bad passcodes. There are certain things that can be done to force them to create stronger passcodes. This lesson shows the basics of stronger passcodes and how to use file with five million most breached codes, to check the passcodes.

Authentication 2FA (Web, seclib)

Second factor authentication (2FA) adds another layer of security, supplementing the username and password model with something the user has. The most common method across the internet is a one time-based, one-time password. This demonstration shows how to implement the QR code component thats included in the DataFlex Security Library.

Authentication Loose ends

The security of any system is determined by its weakest parts. Hackers are creative and will try unexpected things. It is impossible to create a single library that can do everything. Therefore, it is recommended that developers do what they can outside the scope of the existing library to secure their applications. This lessons shows some subjects not discussed in this course, but are important to take in consideration when creating a web application.

Course instructor

Jeroen Steehouder

Software Engineer, Data Access Europe B.V.

Download workspace (DataFlex 19.0)