[ad_1]
Application security involves measures within a software program to determine user access. It includes input validation, authentication, authorization, configuration and session management, exception handling, and audit and logging. User rights and restrictions are identified during development. Authentication and authorization control user access and privileges. Configuration, session, and exception management support specific processes. Auditing and logging document user activity for reporting purposes.
Application security includes the measures located within a computer software program designed to determine which specific resources within the application an individual user can access. These measures are determined by the security and data policies implemented in the specific application. Specific types of application security include input validation, authentication, authorization, configuration management, session management, exception handling, and audit and logging.
During the development of a software program or computer application, the rights granted to individual users and pieces of data are identified. These rights and restrictions are then implemented within the application as application security. Depending on the number of business processes supported by the specific application, the security could be minor or extensive.
Application security is concerned with valid input of information into a program. This prevents a user from entering information known to be harmful into the system. These types of validations might include checking a specific number against a set of valid numbers. It could include allowing a user to select from a specific list of data points rather than giving the user the opportunity to enter anything.
Authentication is the process of validating a user and how a user can access the application. Some applications may allow a user to access the program from anywhere in the world, provided that user enters the correct security login information. Other applications may have time and location authentication controls set in them. These restrictions determine when and where an individual user can access the system. If a user is attempting to access the system outside these parameters, they will not be granted access to the system.
Authorization is how the program works with different levels of user privileges within an application. There may be different levels of permissions for users of a program. A data entry person might have authority to enter data into the system but not authority to make changes. The next level of permission grants that user the ability to make changes. The number of permission levels depends on the corporate policies implemented within the program.
Configuration management, session management, and exception management are more detailed management processes that incorporate the other aspects of application security to support specific processes within the application. Configuration management is primarily about accessing the application administration. Session management concerns each single session of use of the application. Exception handling provides information to key system administrators when unauthorized access to the system is attempted.
The auditing and logging aspects of application security are set up within the system to document who did what and when. This allows system administrators to know when a specific user was on the system and what that user did while on the system. This information is essential for reporting purposes.
