Improving Web Application Security: Threats and - CGISecurity

52 Part I: Introduction to Threats and CountermeasuresDocument the technologies using a table similar to Table 3.1, below.Table 3.1 Implementation TechnologiesTechnology/PlatformImplementation DetailsMicrosoft SQL Server on MicrosoftWindows Advanced Server 2000Includes logins, database users, user defined database roles,tables, stored procedures, views, constraints, and triggers.Microsoft .NET FrameworkSecure Sockets Layer (SSL)Used for Forms authentication.Used to encrypt HTTP traffic.Step 3. Decompose the ApplicationIn this step, you break down your application to create a security profile for theapplication based on traditional areas of vulnerability. You also identify trustboundaries, data flow, entry points, and privileged code. The more you know aboutthe mechanics of your application, the easier it is to uncover threats. Figure 3.4 showsthe various targets for the decomposition process.Application DecompositionSecurity ProfileTrust BoundariesInput ValidationAuthenticationAuthorizationConfigurationManagementSensitive DataSession ManagementCryptographyParameterManipulationExceptionManagementAuditing and LoggingData FlowEntry PointsPrivileged CodeFigure 3.4Targets for application decompositionDuring this step, you perform the following tasks:● Identify trust boundaries.●●●●Identify data flow.Identify entry points.Identify privileged code.Document the security profile.