Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 95Log Detailed Error MessagesSend detailed error messages to the error log. Send minimal information to theconsumer of your service or application, such as a generic error message and customerror log ID that can subsequently be mapped to detailed message in the event logs.Make sure that you do not log passwords or other sensitive data.Catch ExceptionsUse structured exception handling and catch exception conditions. Doing so avoidsleaving your application in an inconsistent state that may lead to informationdisclosure. It also helps protect your application from denial of service attacks.Decide how to propagate exceptions internally in your application and give specialconsideration to what occurs at the application boundary.For more information about designing and implementing an exception managementframework for .NET applications, see the MSDN article “Exception Management in.NET,” at http://msdn.microsoft.com/library/en-us/dnbda/html/exceptdotnet.aspAuditing and LoggingYou should audit and log activity across the tiers of your application. Using logs, youcan detect suspicious-looking activity. This frequently provides early indications of afull-blown attack and the logs help address the repudiation threat where users denytheir actions. Log files may be required in legal proceedings to prove the wrongdoingof individuals. Generally, auditing is considered most authoritative if the audits aregenerated at the precise time of resource access and by the same routines that accessthe resource.The following practices improve your Web application’s security:● Audit and log access across application tiers.●●●●Consider identity flow.Log key events.Secure log files.Back up and analyze log files regularly.Audit and Log Access Across Application TiersAudit and log access across the tiers of your application for non-repudiation. Use acombination of application-level logging and platform auditing features, such asWindows, IIS, and SQL Server auditing.