Education in PHP Security - What's Needed?
As anyone that's been around the PHP community recently (within the last six to nine months) knows, Chris Hartjes has taken up the lead in an effort to increase awareness about unit testing - really testing in general - of PHP applications. He favors things like test-driven development and having good tests to back up and reinforce a good resulting product. I admire him for his efforts (including his book) and I wonder if this same movement could be used to help kickstart a security testing a€orevolutiona€ť in the PHP community too.
For a long time, PHP has had an unfortunate reputation as being an insecure language to develop web-based applications in. The language itself has very few built-in security features and favors offering the ability to plug in techniques and tools of their own to make things secure. Unfortunately, this leaves a lot of the beginner level applications wide open to potential attacks. Developers aren't immediately given options to do things like filter their data or secure the data they're storing in their sessions. Most developers that I know that are just starting out with PHP don't even know these sorts of things need to be done. They blindly accept user data and expect that nothing other than what they're wanting will come through. Sadly, this sort of thing has lead to this insecure reputation - bad code written by inexperienced users. One of PHP's best attributes is its low learning curvea€¦and also its worst.
Many developers don't even realize the need for security in the code they write until it's too late. One day they wake up and - either because something they've written has been hacked or they read an article that talks about it - realize that they've been blind about protecting themselves and their data from Those People out on the web. This usually seems to happen about the time that most of them discover frameworks and how useful they can be. They start poking around what the framework has to offer and come across things like access control, user authentication and yes, maybe even secure session handling. A switch is flipped and the developer reacts in one of two ways - they take it as a charge to get better about their secure coding practices or they freak out and start going crazy with filtering, encryption and escaping.
Back to my original point - I wonder if it's possible to take this momentum that Chris has gotten going and use it to encourage more testing for the security of applications up front. I've been doing what I can over on websec.io to try to help educate developers about things like secure coding practices, common infosec terms and information about securing their applications from would-be attackers, but it's not enough. It's not even a blip on the radar in what is a very serious matter that should be a consideration for all PHP developers.
Testing application security early, whether it be through the use of something like skipfish or a static code scanning tool, can save you time in the long run, just as unit testing your code helps track down and eliminate bugs faster. I want to promote early testing for security issues in applications and the mitigation of them, but I'm not sure how to reach developers in a way that they'll listen.
PAˇdraic Brady has started up an effort to create a guide to some of the most common issues PHP developers might face and it's off to a good start. I wonder if there's more that can be done to help improve the security awareness in the PHP ecosystem, though. It seems like there's a lot of content floating around out there that's from the a€ostone agea€ť of PHP security practices (filter input, escape output, blah blah blah) and not much about real-world, advanced threats that relate to PHP applications and current web technologies.
What would you like to see in a security resource that could help you, as a developer, make your code more secure? Do things like articles/tutorials encourage you to take a good long look at your code and try to a€othink like an attackera€ť or would more real-time interaction (screencasts or webinars) do more to help? I'm interested to see what the community thinks is a good approach to this.
Security is an important topic, no matter the language you're working with. PHP just has more of an uphill battle than some other languages - help me make it a little bit easier.