PC-based applications often store user information, customer records or critical data belonging to the business. In this case, not only the application working correctly but also the protection of the data it holds against unauthorized access and losses is at least as important. Data security is not a feature added to the application later, but an engineering topic that must be considered from the very beginning of the design. When it is not well designed, a security vulnerability is usually noticed only after a problem has occurred.
Storing Passwords and Sensitive Data
The first step of security is the way sensitive information is stored. User passwords should not be kept as readable text in the database; instead they should be stored with an irreversible hash method. This way the system can verify the password the user enters but never keeps the password itself in the open anywhere. Thus, even if the database is accessed, the real form of the passwords cannot be obtained.
For critical data other than passwords, using encryption during storage or transmission makes unauthorized reading of the information difficult. In cases where data is carried between computers, the connection being encrypted prevents it from being intercepted and read during transfer. The same principle applies to the connections the application establishes with the outside: database access credentials, API keys and similar sensitive settings should be managed in a controlled way instead of being embedded in the code.
Data coming into the application from outside must also always be checked. Verifying whether the information the user enters is in the expected form prevents both the creation of erroneous records and damage to the system through malicious input. An application in which input is not validated loses its reliability when it encounters unexpected data, even if it works correctly.
Authorization and the Principle of Least Privilege
Especially in applications where more than one user works, everyone being able to access the same data and operations is not a correct approach. A user who needs to view an accounting record also having the authority to delete all records is an unnecessary risk. Authorizing users according to their roles increases both security and control within the system.
Role-based authorization: Users are grouped not one by one but according to the role they take on (for example operator, administrator, viewer), and the operations each role can access are defined clearly. When a new user is added, assigning them the appropriate role is enough for arranging authorization.
The principle of least privilege: Each user is given only the authority needed to do their job, and no more. This reduces both the risk of unauthorized access and the impact of erroneous operations that might be performed by mistake. It also becomes impossible for a user to accidentally corrupt data they do not have access to.
Keeping critical operations (such as deletion, bulk update, export) additionally under control prevents a single erroneous step from turning into large data losses. Requiring an extra confirmation step for such operations ensures that the user performed the operation deliberately.
Backup and Restore
Unexpected computer or system failures, disk corruption or user errors are always within the realm of possibility. Regularly taking a backup of the data is the most fundamental way to prevent data loss in such cases. However, only taking a backup is not enough:
- Backups should be taken at regular intervals and, if possible, automatically; backups done by hand are prone to being forgotten.
- It should be tested at certain intervals that the backup can really be restored; an untested backup does not count as an assurance.
- Backups should be kept in a separate environment so that they do not share the same risk as the main system. A backup kept on the same disk is lost together with it when the disk fails.
A well-designed backup arrangement determines in advance how long and from what point the system will become operational again after a failure. This also makes the impact of unexpected situations on the business predictable. How often a backup is taken is determined according to how quickly the business’s data changes and how far back it is acceptable to go in the event of a possible loss.
Operation Records and Traceability
Recording by whom and when critical operations were performed (keeping a log) allows both a possible problem to be investigated afterward and the system to be audited transparently. When it can be queried when a record was changed or by which user an operation was performed, it becomes easier to identify the source of an error or an unauthorized operation. Operation records also help responsibility to be tracked clearly and keep the system in an auditable structure.
It is important not only that the records are kept but also that they can be examined easily when needed. Records organized in a meaningful way give the ability to trace back step by step what was changed and when, when a problem occurs. On the other hand, these records too need to be protected against unauthorized access; because operation records can also carry sensitive information in their own right.
Conclusion
Data security is a whole of complementary steps such as storing passwords correctly, authorizing users according to their roles, regular and tested backup, and recording critical operations. None of these steps is enough on its own; but when designed together, they form a reliable structure. A correct security and authorization structure allows PC applications to be used in a more reliable, controlled and professional way.
Related services: Software & PC Applications, Database & Data Management, System Integration
Leave a Reply