Improving Web Application Security: Threats and - CGISecurity

254 Part III: Building Secure Web ApplicationsHow to Use This ChapterTo build secure Web pages and controls, you need to follow the correct programmingpractices that this chapter discusses. In addition to secure programming practices, usethe corresponding chapters in this guide to help you build secure ASP.NET pages andcontrols.● Implement the steps in Chapter 19, “Securing Your ASP.NET Application andWeb Services.” The chapter helps you configure ASP.NET appropriately withsecure settings in Machine.config and Web.config.● Use the accompanying checklist in the checklist section of this guide.“Checklist: Securing ASP.NET” ties the recommendations made in this chapterand in Chapter 19 together. Make sure you implement the guidance.● Understand the threats and attacks that are specific to ASP.NET pages andcontrols. Apply countermeasures according to guidelines in this chapter.●●●●●Read Chapter 4, “Design Guidelines for Secure Web Applications.” Many of therecommendations in this chapter (Chapter 10) are based on the design guidelinesdiscussed in Chapter 4.Architects should use the “Design Considerations” section of this chapter.Developers should apply the guidance in this chapter to their developmentprocess.Learn the controls from a programmatic standpoint to fine-tune ASP.NET pagesand controls security.Use the application vulnerability categories as a means to tackle commonproblems. Application vulnerability categories provide a useful way to approachand group problems.Threats and CountermeasuresMost Web application attacks require that malicious input is passed within HTTPrequests. The general goal is either to coerce the application into performingunauthorized operations or to disrupt its normal operation. This is why thoroughinput validation is an essential countermeasure to many attacks and should be madea top priority when you develop ASP.NET Web pages and controls. Top threatsinclude:● Code injection● Session hijacking● Identity spoofing● Parameter manipulation● Network eavesdropping●Information disclosure