Overview

• Use strict data encryption with a proven encryption technique

• Use protocol algorithms that are currently considered to be strong by experts in the field, and select well-tested implementations.

• For countering spoofing and session hijacking:

  • Use Transport Layer Security (TLS), Secure Shell (SSH), HTTP Secure (HTTPS) and other secure communications protocols that encrypt data before it is sent and authenticate data as it is received.

  • Use additional multistep authentication methods.

• Weaknesses in password hashing algorithms can be used to steal sensitive information stored on a web or application server. Use cryptographic hash functions to implement password hashing.

• Use pentesting. Even the best senior programmers are susceptible to making mistakes. Review the application for potential vulnerabilities. For best results, do it regularly.