Improving Web Application Security: Threats and - CGISecurity

32 Part I: Introduction to Threats and CountermeasuresElevation of PrivilegeWhen you design an authorization model, you must consider the threat of an attackertrying to elevate privileges to a powerful account such as a member of the localadministrators group or the local system account. By doing this, the attacker is able totake complete control over the application and local machine. For example, withclassic ASP programming, calling the RevertToSelf API from a component mightcause the executing thread to run as the local system account with the most powerand privileges on the local machine.The main countermeasure that you can use to prevent elevation of privilege is to useleast privileged process, service, and user accounts.Disclosure of Confidential DataThe disclosure of confidential data can occur if sensitive data can be viewed byunauthorized users. Confidential data includes application specific data such ascredit card numbers, employee details, financial records and so on together withapplication configuration data such as service account credentials and databaseconnection strings. To prevent the disclosure of confidential data you should secure itin persistent stores such as databases and configuration files, and during transit overthe network. Only authenticated and authorized users should be able to access thedata that is specific to them. Access to system level configuration data should berestricted to administrators.Countermeasures to prevent disclosure of confidential data include:● Perform role checks before allowing access to the operations that could potentiallyreveal sensitive data.● Use strong ACLs to secure Windows resources.● Use standard encryption to store sensitive data in configuration files anddatabases.Data TamperingData tampering refers to the unauthorized modification of data.Countermeasures to prevent data tampering include:● Use strong access controls to protect data in persistent stores to ensure that onlyauthorized users can access and modify the data.● Use role-based security to differentiate between users who can view data andusers who can modify data.