Improving Web Application Security: Threats and - CGISecurity

98 Part II: Designing Secure Web ApplicationsSummarySecurity should permeate every stage of the product development life cycle and itshould be a focal point of application design. Pay particular attention to the design ofa solid authentication and authorization strategy. Also remember that the majority ofapplication level attacks rely on maliciously formed input data and poor applicationinput validation. The guidance presented in this chapter should help you with theseand other challenging aspects of designing and building secure applications.Additional ResourcesFor more information, see the following resources:●●●●The current guide is Volume II in a series dedicated to helping customersimprove Web application security. For more information on architecting,designing, building and configuring authentication, authorization, and securecommunications across tiers of a distributed Web applications, see “Microsoftpatterns & practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.aspThe MSDN article “Security Models for ASP.NET Applications” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetch02.asp?frame=trueThe MSDN article “Designing Authentication and Authorization” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetch03.asp?frame=true“Checklist: Architecture and Design Review” in the “Checklists” section ofthis guide.