Improving Web Application Security: Threats and - CGISecurity

xlivImproving Web Application Security: Threats and CountermeasuresWith that array of feature choices comes a corresponding array of decisions, andwith each and every decision in the process of designing, developing, deploying,and maintaining a site can have significant security impact and implications.Improving Web Applications Security: Threats and Countermeasures provides an excellentand comprehensive approach to building highly secure and feature-rich applicationsusing the .NET Framework. It accurately sets the context — that securityconsiderations and issues must be addressed with application design, development,deployment, and maintenance in view, not during any one of these phases inisolation. It cleverly walks you through a process, prescribing actions and makingsuggestions along the way. By following the guide from start to finish you will learnhow to design a secure application by understanding what’s important to you, whowill attack you, and what they will likely look for, and build countermeasures toprotect yourself. The guide provides frameworks, checklists, and expert tips forthreat modeling, design and architecture reviews, and implantation reviews to helpyou avoid common mistakes and be secure from the start. It then delves into the.NET security technology in painstaking detail, leading you through decisions youwill need to make, examining security components and things you should be awareof, and focusing on issues that you cannot ignore.This is the most comprehensive and well-written guide to building secure Webapplications that I have seen, and is a must read for anyone building a secure Website or considering using ASP.NET to provide security for their online businesspresence.Mark CurpheyMark Curphey has a Masters degree in Information Security and runs the Open WebApplication Security Project. He moderates the sister security mailing list to Bugtraqcalled webappsec that specializes in Web application security. He is a former Directorof Information Security for Charles Schwab, consulting manager for Internet SecuritySystems, and veteran of more banks and consulting clients than he cares toremember. He now works for a company called Watchfire. He is also a formerJava UNIX bigot now turned C#, ASP.NET fan.