Improving Web Application Security: Threats and - CGISecurity

16 Part I: Introduction to Threats and CountermeasuresUsing least privileged service accounts throughout your application is a primarydefense against privilege escalation attacks. Also, many network level privilegeescalation attacks require an interactive logon session.Maintain AccessHaving gained access to a system, an attacker takes steps to make future access easierand to cover his or her tracks. Common approaches for making future access easierinclude planting back-door programs or using an existing account that lacks strongprotection. Covering tracks typically involves clearing logs and hiding tools. As such,audit logs are a primary target for the attacker.Log files should be secured, and they should be analyzed on a regular basis. Log fileanalysis can often uncover the early signs of an attempted break-in before damage isdone.Deny ServiceAttackers who cannot gain access often mount a denial of service attack to preventothers from using the application. For other attackers, the denial of service option istheir goal from the outset. An example is the SYN flood attack, where the attackeruses a program to send a flood of TCP SYN requests to fill the pending connectionqueue on the server. This prevents other users from establishing networkconnections.Understanding Threat CategoriesWhile there are many variations of specific attacks and attack techniques, it is usefulto think about threats in terms of what the attacker is trying to achieve. This changesyour focus from the identification of every specific attack — which is really just ameans to an end — to focusing on the end results of possible attacks.STRIDEThreats faced by the application can be categorized based on the goals and purposesof the attacks. A working knowledge of these categories of threats can help youorganize a security strategy so that you have planned responses to threats. STRIDE isthe acronym used at Microsoft to categorize different threat types. STRIDE stands for:●●Spoofing. Spoofing is attempting to gain access to a system by using a falseidentity. This can be accomplished using stolen user credentials or a false IPaddress. After the attacker successfully gains access as a legitimate user or host,elevation of privileges or abuse using authorization can begin.Tampering. Tampering is the unauthorized modification of data, for example as itflows over a network between two computers.