5) Secure Sockets Layer -SSL will be compulsory through the entire portal experience. Authentication Requirements Ensure the identity credentials for the authentication process are not stored by the browser (e.g., client cache); Never confirm valid usernames, responding to incorrect username and/or password input with the same error message; Create a session key to authenticate subsequent data transmissions in the session; Reject credentials that have expired or have been revoked by the issuing organization; and Support a secure method to recover identity credentials. The authentication mechanism should also: Include protection against automated brute force attacks. Authentication mechanisms must be of a strength and assurance level commensurate …show more content…
When these applications encounter processing errors, they must respond to the user/client with a generic, sanitized message with no information that might be useful to an attacker. 17 Developers must test the production error handling prior to deploying the application. 8) Secure Coding Standard- Validate all input parameters Programmers should develop a centralised module to perform input parameter validation, and check each input parameter against a strict format that specifies exactly which types of input will be allowed. Special characters such as “~!#$%^&*[]<>‟\r\n” coming from the input form should be filtered, or replaced with an escape sequence. Client-side scripts should not be relied on to perform the necessary validation checks. The application should only accept data containing a strictly limited and expected set of