Improving Web Application Security: Threats and - CGISecurity

xImproving Web Application Security: Threats and CountermeasuresAuthentication .......................................................................................................... 80Separate Public and Restricted Areas..................................................................... 81Use Account Lockout Policies for End-User Accounts ............................................... 81Support Password Expiration Periods...................................................................... 81Be Able to Disable Accounts .................................................................................. 82Do Not Store Passwords in User Stores.................................................................. 82Require Strong Passwords..................................................................................... 82Do Not Send Passwords Over the Wire in Plaintext .................................................. 82Protect Authentication Cookies .............................................................................. 82Authorization ............................................................................................................ 83Use Multiple Gatekeepers ..................................................................................... 83Restrict User Access to System Level Resources .................................................... 83Consider Authorization Granularity.......................................................................... 83Configuration Management........................................................................................ 86Secure Your Administration Interfaces .................................................................... 86Secure Your Configuration Stores ........................................................................... 86Separate Administration Privileges ......................................................................... 87Use Least Privileged Process and Service Accounts................................................. 87Sensitive Data .......................................................................................................... 87Secrets ................................................................................................................ 87Sensitive Per User Data......................................................................................... 89Session Management ............................................................................................... 90Use SSL to Protect Session Authentication Cookies ................................................ 90Encrypt the Contents of the Authentication Cookies................................................. 90Limit Session Lifetime........................................................................................... 91Protect Session State from Unauthorized Access .................................................... 91Cryptography ............................................................................................................ 91Do Not Develop Your Own Cryptography .................................................................. 92Keep Unencrypted Data Close to the Algorithm ....................................................... 92Use the Correct Algorithm and Correct Key Size....................................................... 92Secure Your Encryption Keys.................................................................................. 92Parameter Manipulation ............................................................................................ 93Encrypt Sensitive Cookie State .............................................................................. 93Make Sure that Users Do Not Bypass Your Checks.................................................. 93Validate All Values Sent from the Client .................................................................. 94Do Not Trust HTTP Header Information.................................................................... 94Exception Management ............................................................................................. 94Do Not Leak Information to the Client..................................................................... 94Log Detailed Error Messages ................................................................................. 95Catch Exceptions .................................................................................................. 95Auditing and Logging ................................................................................................. 95Audit and Log Access Across Application Tiers ........................................................ 95Consider Identity Flow ........................................................................................... 96Log Key Events ..................................................................................................... 96Secure Log Files ................................................................................................... 96Back Up and Analyze Log Files Regularly................................................................. 96