Improving Web Application Security: Threats and - CGISecurity

58 Part I: Introduction to Threats and CountermeasuresYou must also ensure that your network is not vulnerable to threats arising frominsecure device and server configuration. For example, are unnecessary ports andprotocols closed and disabled? Are routing tables and DNS server secured? Arethe TCP network stacks hardened on your servers? For more information aboutpreventing this type of vulnerability, see Chapter 15, “Securing Your Network.”Identify Host ThreatsThe approach used throughout this guide when configuring host security (that is,Microsoft Windows 2000 and .NET Framework configuration) is to divide theconfiguration into separate categories to allow you to apply security settings in astructured and logical manner. This approach is also ideally suited for reviewingsecurity, spotting vulnerabilities, and identifying threats. Common configurationcategories applicable to all server roles include patches and updates, services,protocols, accounts, files and directories, shares, ports, and auditing and logging.For each category, identify potentially vulnerable configuration settings. From these,identify threats.Top vulnerabilities to consider include:● Maintaining unpatched servers, which can be exploited by viruses, Trojan horses,worms, and well-known IIS attacks.● Using nonessential ports, protocols, and services, which increase the attack profileand enable attackers to gather information about and exploit your environment.●●Allowing unauthenticated anonymous access.Using weak passwords and account policies that lead to password cracking,identity spoofing, and denial of service attacks if accounts can be locked outdeliberately.Identify Application ThreatsIn the previous steps, you defined the architecture, data flow, and trust boundaries ofyour application. You also created a security profile that describes how theapplication handles core areas, such as authentication, authorization, configurationmanagement, and other areas.Now use the broad STRIDE threat categories and predefined threat lists to scrutinizeeach aspect of the security profile of your application. Focus on application threats,technology-specific threats, and code threats. Key vulnerabilities to consider include:● Using poor input validation that leads to cross-site scripting (XSS), SQL injection,and buffer overflow attacks.● Passing authentication credentials or authentication cookies over unencryptednetwork links, which can lead to credential capture or session hijacking.● Using weak password and account policies, which can lead to unauthorizedaccess.