Programming Measures to Take When Dealing With Sensitive DataNgenge SeniorBlockedUnblockFollowFollowingJun 17Photo by Scott Webb on UnsplashIn the internet age, access to data is power and thus as a programmer or software engineer or technocrat, the ways you handle data is very crucial.
A single mistake of mishandling data could bring down a big organization.
Thesensitive data we are talking about here include data like passwords, user names, pins, API keys, financial data, and many others.
In this post, we look at some measures that a developer should take when dealing with such data.
Enforce AuthenticationAuthentication is the process of determining whether a person or thing is who or what they claim to be.
When dealing with sensitive data, always ensure that authentication is a requirement.
For example, take the case of a banking application, it would be always necessary that a user is identified by a maybe a user name and a pin.
Other ways of enforcing stronger security are using methods like Two-factor authentication(2FA) and Multi-factor authentication(MFA).
Never Hard code credentials in CodeThis is one of the most common mistakes that one can find around.
The mistake of hard coding credentials like database passwords, API keys, private keys and pins in code.
Doing such saves a hacker the stress of doing brute-forcing or other methods as you are the one who has handed him credentials for free.
APIs usually have what is referred to as rate limiting.
If another person uses your API key, you might run out of the number of API calls that you can make.
The worst comes to the worst when you are paying for such APIs and another party is using.
There are ways of storing these credentials when developing for platforms like mobile and the web.
Links will be provided later.
Never save credentials without encryptionThe mistake that even big giants like Facebook made was saving user passwords as plain text.
It was reported that the social media giant stored millions of Facebook and Instagram passwords without encrypting the passwords.
It is definitely one of the silliest things to do when writing software involving sensitive data.
Even if a hacker(s) finally gets access to your data, make sure that the data is useless to the hacker(s).
This can only be made possible by enforcing strong encryption techniques to credentials before the credentials are saved.
Never commit a transaction when it not completeTo make this point clearer, let me take a classic example of making transaction in a banking application as follows;Person A wants to transfer $4000 funds to Person B.
Let us say the way you implemented such logic is that you simply deduct the amount from Person A's account and increment the account of Person B by $4000.
Some people might think that there is nothing wrong with this pattern as it seeming solves what it is supposed to do.
What the method fails to consider is a situation when there is a failure, such as a network error occurs and the transaction does not go through and you must have deducted the funds from A.
So you will be left with person A’s account deducted by $4000 but person B’s account was not credited.
This can cause great financial loss and issues leading to customers losing confidence in their service providers, in this case, banks.
One way of handling this is that there can be a sort of pool for transactions such that when A intends sending funds to B, the following logic is taken;1.
Get A's account information2.
Get the amount to be sent.
3.
Get B's account information.
4.
Deduct funds from A.
5.
Combine all the above information and send it to the pool of transactions.
6.
Use transaction information and attempt incrementing B's funds and validate the transaction as complete, else try later until transaction is successful.
This might look like a long pattern but just a few lines of properly written code should do this.
This might look like a focus on one domain, but the point is that you should save any type of transaction, only when all previous stages are marked as successful.
Enforce the CAPTCHA Stuffhttps://www.
dictionary.
com/e/captcha/A CAPTCHA (Completely Automated Public Turing Test To Tell Computers and Humans Apart) is a program that protects websites by telling whether or not a user is human or a bot.
The most common form of CAPTCHA is one that requires the user to type distorted text in a text field to identify as human.
Many users hate CAPTCHAs but the check is very necessary.
One way of attempting a login system is through a dictionary attack.
With CAPTCHA, you can prevent this by letting a user solve CAPTCHA after a number of unsuccessful authentication thus preventing them from going through the entire list of passwords.
CAPTCHAs also prevent situations like email scrapping, spamming and lots more.
Find more about CAPTCHAs at this link, http://www.
captcha.
net/ .
There is a lot of checks that should be done when dealing with sensitive data.
These are the few that one can consider for a start in order to prevent various misfortunes that come by poorly securing data.
I leave you two useful links of how to store secret keys for Android developers and iOS developers.
Useful linksStoring Secret Keys in Android | CodePath Android CliffnotesOften your app will have secret credentials or API keys that you need to have in your app to function but you’d rather…guides.
codepath.
comKeeping secrets out of Git in your iOS appSimple ways to protect your API keysmedium.
com.. More details