Improving Web Application Security: Threats and - CGISecurity

320 Part III: Building Secure Web ApplicationsNote The specifications and standard supported by WSE are evolving and therefore the currentWSE does not guarantee it will be compatible with future versions of the product. At the time of thiswriting, interoperability testing is under way with non-Microsoft toolkits provided by vendors includingIBM and VeriSign.How to Use This ChapterThis chapter discusses various practices and techniques to design and build secureWeb services.To get the most from this chapter:● Read Chapter 19, “Securing Your ASP.NET Application and Web Services.” It isgeared toward an administrator so that an administrator can configure anASP.NET Web Application or Web service, bringing a semi-secure application toa secure state.● Read Chapter 17, “Securing Your Application Server.” Read Chapter 17 tofamiliarize yourself with remote application server considerations.● Use the “Checklist: Securing Web Services” in the “Checklists” section of thisguide. The checklist is a summary of the security measures required to build andconfigure secure Web services.● Use this chapter to understand message level threats and how to counter thosethreats.● Use the application categories as a means to tackle common problems.The sections give you relevant information using these categories.Threats and CountermeasuresTo build secure Web services, know the associated threats. The top threats directed atWeb services are:● Unauthorized access● Parameter manipulation● Network eavesdropping● Disclosure of configuration data● Message replay