Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 259CountermeasuresYou can employ the following countermeasures to prevent parameter manipulation:●●●Do not rely on client-side state management options. Avoid using any of the clientsidestate management options such as view state, cookies, query strings orhidden form fields to store sensitive data.Store sensitive data on the server. Use a session token to associate the user’ssession with sensitive data items that are maintained on the server.Use a message authentication code (MAC) to protect the session token. Pair thiswith authentication, authorization, and business logic on the server to ensure thatthe token is not being replayed.Network EavesdroppingNetwork eavesdropping involves using network monitoring software to trace packets ofdata sent between browser and Web server. This can lead to the disclosure ofapplication-specific confidential data, the retrieval of logon credentials, or the captureof authentication cookies.VulnerabilitiesVulnerabilities that can lead to successful network eavesdropping include:● Lack of encryption when sending sensitive data● Sending authentication cookies over unencrypted channelsAttacksNetwork eavesdropping attacks are performed by using packet sniffing tools that areplaced on the network to capture traffic.CountermeasuresTo counter network eavesdropping, use Secure Sockets Layer (SSL) to provide anencrypted communication channel between browser and Web server. It is imperativethat SSL is used whenever credentials, authentication tickets, or sensitive applicationdata are sent over the network.Information DisclosureInformation disclosure occurs when an attacker probes your Web pages looking forways to cause exception conditions. This can be a fruitful exercise for the attackerbecause exception details, which often are returned as HTML and displayed in thebrowser, can divulge extremely useful information, such as stack traces that containdatabase connection strings, database names, database schema information, SQLstatements, and operating system and platform versions.