Skip to main content
California Department of Education Logo

Web Application Security Standards

Visit the CDE Web Standards to determine if these standards apply to a specific Web product that is being developed and to determine which other standards might apply.

Application-level Security

  1. Web applications will be secured from "SQL Injection Attacks" where the attacker enters SQL commands into Web form input fields or URL querystrings to try to manipulate the SQL statement being sent to and from the database. The following methods to avoid SQL injection attacks should be used:
    • Use of parameterized queries or stored procedures to access a database as opposed to using string concatenation
    • Limit the amount of characters in Web form input fields and URL querystrings to a proper amount
    • Validate text input and URL querystrings for improper characters (e.g. apostrophe, dash)
    • Do not display errors to the user that contain information about the database or actual source code
  2. ASP.Net Web applications must be secured from "Cross Site Scripting" (XSS) attacks. To accomplish this, developers must ensure that the ASP.Net "validateRequest" Page directive is set to True (the default setting) so that users of the application are prevented from entering HTML or JavaScript code into Web forms. Request Validation - Preventing Script Attacks (Outside Source) is a white paper that provides excellent information on this issue.

Data Transmission Security

When confidential or sensitive data is passed between the end-user and the Web server, the HTTPS (SSL over HTTP) protocol will be used. SSL provides server authentication, data encryption ("over the wire"), and data transmission integrity. The SSL certificate used on the Web server will need to be "trusted" by the Web browsers listed on the CDE’s Minimum Web Browser Requirement Web page.

Database Security

  1. Web applications should use minimum privileges to access database objects (i.e. tables, views, stored procedures). For example, if the Web application needs read-only access to a specific database table, the database permissions should be set accordingly as opposed to giving the Web application "admin or owner" rights to the entire database.
  2. Individual database fields storing confidential or sensitive data (e.g. passwords, social security number) must be stored using encryption techniques.

Password Requirements

Passwords whether created by application developers, administrators, or users must meet or be required through validation to meet all of the following parameters. Passwords must:

  • Be at least eight characters in length.
  • Contain characters from three of the following four categories:
    • Uppercase letters (A though Z)
    • Lowercase letters (a through z)
    • Numbers (0 through 9)
    • Special characters (!, @, #, $, ^, &, *, -, =, _, +, ?)
  • Not be the same as the logon or user name.
Questions:   Web Services Office |
Last Reviewed: Thursday, May 28, 2015

Share this Page

Recently Posted in Department Information

  • Education Programs Consultant (DOC) (added 09-Oct-2015)
    Bulletin advertising Education Programs Consultant vacant position in the Improvement & Accountability Division.
  • Conditions of Employment PM-EX 631 (DOC) (added 07-Oct-2015)
    Form 631 that needs to be completed by candidate to indicate location of preference, tenure and time base.
  • Security Guard Examination (DOC) (updated 07-Oct-2015)
    Examination Bulletin for a Security Guard in the California Department of Education, Alameda and Riverside Counties.
  • Security Guard Qualifications Assessment (DOC) (added 07-Oct-2015)
    Qualifications Assessment Questionnaire for a Security Guard in the CA Department of Education.
  • Child Development Consultant Questionnaire (DOC) (added 02-Oct-2015)
    Questionnaire for candidates to fill out to apply for the Child Development Consultant examination in the California Department of Education.

  • Child Development Consultant (DOC) (added 02-Oct-2015)
    Departmental Open Exam Bulletin for a Child Development Consultant in the California Department of Education.
  • Director (DOC) (added 21-Sep-2015)
    Bulletin advertising for a Director vacant position in the Local Agency Support Division.
  • Standards Support Director (DOC) (added 17-Sep-2015)
    Bulletin advertising for a Standards Support Director vacant position in the Executive Office.
  • Overview (PDF) (added 02-Sep-2015)
    A one page view of the entire California Department of Education (CDE) with branches and divisions.
  • Division CEA Level B (DOC) (added 17-Aug-2015)
    Bulletin advertising for a CEA Level B vacant position in the School Facilities & Transportation Services Division.