Improving Web Application Security: Threats and - CGISecurity

Forewords xlvForeword by Joel ScambrayI have been privileged to contribute to Improving Web Application Security: Threatsand Countermeasures, and its companion volume, Building Secure ASP.NET WebApplications. As someone who encounters many such threats and relies on manyof these countermeasures every day at Microsoft’s largest Internet-facing onlineproperties, I can say that this guide is a necessary component of any Web-facingbusiness strategy. I’m quite excited to see this knowledge shared widely withMicrosoft’s customers, and I look forward to applying it in my daily work.There is an increasing amount of information being published about Internet security,and keeping up with it is a challenge. One of the first questions I ask when a newwork like this gets published is: “Does the quality of the information justify mytime to read it?” In the case of Improving Web Application Security: Threats andCountermeasures, I can answer an unqualified yes. J.D. Meier and team haveassembled a comprehensive reference on Microsoft Web application security, andput it in a modular framework that makes it readily accessible to Web applicationarchitects, developers, testers, technical managers, operations engineers, and yes,even security professionals. The bulk of information contained in this work canbe intimidating, but it is well-organized around key milestones in the productlifecycle — design, development, testing, deployment, and maintenance. It alsoadheres to a security principles-based approach, so that each section is consistentwith common security themes.Perhaps my favorite aspect of this guide is the thorough testing that went into eachpage. During several discussions with the guide’s development team, I always cameaway impressed with their willingness to actually deploy the technologies discussedherein to ensure that the theory portrayed aligned with practical reality. They alsofreely sought out expertise internal and external to Microsoft to keep the contentsuseful and practical.Some other key features that I found very useful include the concise, well-organized,and comprehensive threat modeling chapter, the abundant tips and guidelines on.NET Framework security (especially code access security), and the hands-onchecklists for each topic discussed.Improving Web Application Security: Threats and Countermeasures will get anyorganization out ahead of the Internet security curve by showing them how tobake security into applications, rather than bolting it on as an afterthought. I highlyrecommend this guide to those organizations who have developed or deployedInternet-facing applications and to those organizations who are considering suchan endeavor.Joel ScambraySenior Director of Security, MSNCo-Author, Hacking Exposed Fourth Edition, Windows, and Web Applications