Improving Web Application Security: Threats and - CGISecurity

72 Part II: Designing Secure Web ApplicationsTable 4.1 Web Application Vulnerabilities and Potential Problem Due to Bad Design (continued)Vulnerability Category Potential Problem Due to Bad DesignSensitive DataConfidential information disclosure and data tampering.Session ManagementCryptographyParameter ManipulationException ManagementAuditing and LoggingCapture of session identifiers resulting in session hijacking andidentity spoofing.Access to confidential data or account credentials, or both.Path traversal attacks, command execution, and bypass of accesscontrol mechanisms among others, leading to informationdisclosure, elevation of privileges, and denial of service.Denial of service and disclosure of sensitive system level details.Failure to spot the signs of intrusion, inability to prove a user’sactions, and difficulties in problem diagnosis.Deployment ConsiderationsDuring the application design phase, you should review your corporate securitypolicies and procedures together with the infrastructure your application is to bedeployed on. Frequently, the target environment is rigid, and your application designmust reflect the restrictions. Sometimes design tradeoffs are required, for example,because of protocol or port restrictions, or specific deployment topologies. Identifyconstraints early in the design phase to avoid surprises later and involve members ofthe network and infrastructure teams to help with this process.Figure 4.2 shows the various deployment aspects that require design timeconsideration.Application SecurityLocalApplicationTierNetwork Infrastructure SecurityRouterHost SecurityDeployment TopologiesFirewallRemoteApplicationTierSwitchSecurity Policies and ProceduresFigure 4.2Deployment considerations