Improving Web Application Security: Threats and - CGISecurity

Contents xxxviiChecklistSecuring Data Access 717How to Use This Checklist ....................................................................................... 717SQL Injection Checks .............................................................................................. 717Authentication ........................................................................................................ 717Authorization .......................................................................................................... 718Configuration Management...................................................................................... 718Sensitive Data ........................................................................................................ 718Exception Management ........................................................................................... 719Deployment Considerations ..................................................................................... 719ChecklistSecuring Your Network 721How to Use This Checklist ....................................................................................... 721Router Considerations............................................................................................. 721Firewall Considerations ........................................................................................... 722Switch Considerations............................................................................................. 722ChecklistSecuring Your Web Server 723How to Use This Checklist ....................................................................................... 723Patches and Updates .......................................................................................... 723IISLockdown ....................................................................................................... 723Services............................................................................................................. 723Protocols............................................................................................................ 724Accounts............................................................................................................ 724Files and Directories ........................................................................................... 725Shares............................................................................................................... 725Ports.................................................................................................................. 725Registry ............................................................................................................. 725Auditing and Logging ........................................................................................... 726Sites and Virtual Directories ................................................................................ 726Script Mappings.................................................................................................. 726ISAPI Filters........................................................................................................ 727IIS Metabase...................................................................................................... 727Server Certificates .............................................................................................. 727Machine.config ................................................................................................... 727Code Access Security.......................................................................................... 727Other Check Points ............................................................................................. 728Dos and Don’ts....................................................................................................... 728