Improving Web Application Security: Threats and - CGISecurity

Chapter 5: Architecture and Design Review for Security 101Figure 5.1 shows this three-pronged approach to the review process.Application13Deployment andInfrastructureHostNetworkApplication Architecture and DesignInput Validation Session ManagementAuthenticationCryptographyAuthorization Parameter ManipulationConfiguration Mgmt Exception ManagementSensitive Data Auditing and Logging2ComponentAnalysisASP.NET PagesWeb ServicesEnterprise ServicesRemotingData AccessFigure 5.1Application reviewThe remainder of this chapter presents the key considerations and questions to askduring the review process for each of these distinct areas.Deployment and Infrastructure ConsiderationsExamine the security settings that the underlying network and host infrastructureoffer to the application, and examine any restrictions that the target environmentmight impose. Also consider your deployment topology and the impact of middletierapplication servers, perimeter zones, and internal firewalls on your design.Review the following questions to identify potential deployment and infrastructureissues:● Does the network provide secure communication?● Does your deployment topology include an internal firewall?●●●●Does your deployment topology include a remote application server?What restrictions does infrastructure security impose?Have you considered Web farm issues?What trust levels does the target environment support?