Improving Web Application Security: Threats and - CGISecurity

ForewordsForeword by Mark CurpheyWhen the public talks about the Internet, in most cases they are actually talking aboutthe Web. The reality of the Web today never seizes to amaze me, and the tremendouspotential for what we can do on the Web is awe-inspiring. But, at the same time, oneof the greatest fears for many who want to embrace the Web — the one thing that isoften responsible for holding back the rate of change — is the security of Webtechnology. With the constant barrage of high profile news stories about hackersexposing credit card databases here and finding cunning ways into secret systemsthere, it’s hardly surprising that in a recent survey almost all users who chose not touse Internet banking cited security as the reason. Putting your business online is nolonger optional today, but is an essential part of every business strategy. For thisreason alone, it is crucial that users have the confidence to embrace the new era.As with any new technology, there is a delay from the time it is introduced to themarket to the time it is really understood by the industry. The breakneck speed atwhich Web technologies were adopted has widened that window. The securityindustry as a whole has not kept pace with these changes and has not developedthe necessary skills and thought processes to tackle the problem. To fully understandWeb security, you must be a developer, a security person, and a process manager.While many security professionals can examine and evaluate the security of aWindows configuration, far fewer have access to the workings of an Internet bankor an online book store, or can fully understand the level of security that an onlinebusiness requires.Until a few years ago, the platform choices for building secure Web applicationswere somewhat limited. Secure Web application development was the exclusiveplayground of the highly experienced and highly skilled developer (and they weremore than happy to let you know that). The .NET Framework and ASP.NET inparticular are an exciting and extremely important evolution in the Web technologyworld and are of particular interest to the security community. With this flexibleand extensible security model and a wealth of security features, almost anything ispossible in less time and with less effort than on many other platforms. The .NETFramework and ASP.NET are an excellent choice for building highly secure,feature-rich Web sites.