Improving Web Application Security: Threats and - CGISecurity

50 Part I: Introduction to Threats and CountermeasuresIdentify What the Application DoesIdentify what the application does and how it uses and accesses assets. Documentuse cases to help you and others understand how your application is supposed to beused. This also helps you work out how it can be misused. Use cases put applicationfunctionality in context.Here are some sample use cases for a self-service, employee human resourcesapplication:● Employee views financial data.● Employee updates personal data.● Manager views employee details.In the above cases you can look at the implications of the business rules beingmisused. For example, consider a user trying to modify personal details of anotheruser. He or she should not be authorized to access those details according to thedefined application requirements.Create an Architecture DiagramCreate a high-level architecture diagram that describes the composition and structureof your application and its subsystems as well as its physical deploymentcharacteristics, such as the diagram in Figure 3.3. Depending on the complexity ofyour system, you might need to create additional diagrams that focus on differentareas, for example, a diagram to model the architecture of a middle-tier applicationserver, or one to model the interaction with an external system.