Improving Web Application Security: Threats and - CGISecurity

Chapter 3: Threat Modeling 51Figure 3.3Sample application architecture diagramStart by drawing a rough diagram that conveys the composition and structure of theapplication and its subsystems together with its deployment characteristics. Then,evolve the diagram by adding details about the trust boundaries, authentication, andauthorization mechanisms as and when you discover them (usually during Step 3when you decompose the application).Identify the TechnologiesIdentify the distinct technologies that are used to implement your solution. This helpsyou focus on technology-specific threats later in the process. It also helps youdetermine the correct and most appropriate mitigation techniques. The technologiesyou are most likely to identify include ASP.NET, Web Services, Enterprise Services,Microsoft .NET Remoting, and ADO.NET. Also identify any unmanaged code thatyour application calls.