Improving Web Application Security: Threats and - CGISecurity

18 Part I: Introduction to Threats and CountermeasuresTable 2.1 STRIDE Threats and Countermeasures (continued)ThreatCountermeasuresRepudiationCreate secure audit trails.Use digital signatures.Information disclosureDenial of serviceElevation of privilegeUse strong authorization.Use strong encryption.Secure communication links with protocols that provide messageconfidentiality.Do not store secrets (for example, passwords) in plaintext.Use resource and bandwidth throttling techniques.Validate and filter input.Follow the principle of least privilege and use least privileged serviceaccounts to run processes and access resources.Network Threats and CountermeasuresThe primary components that make up your network infrastructure are routers,firewalls, and switches. They act as the gatekeepers guarding your servers andapplications from attacks and intrusions. An attacker may exploit poorly configurednetwork devices. Common vulnerabilities include weak default installation settings,wide open access controls, and devices lacking the latest security patches. Topnetwork level threats include:● Information gathering● Sniffing● Spoofing● Session hijacking● Denial of serviceInformation GatheringNetwork devices can be discovered and profiled in much the same way as othertypes of systems. Attackers usually start with port scanning. After they identify openports, they use banner grabbing and enumeration to detect device types and todetermine operating system and application versions. Armed with this information,an attacker can attack known vulnerabilities that may not be updated with securitypatches.