Improving Web Application Security: Threats and - CGISecurity

368 Part III: Building Secure Web ApplicationsHow to Use This ChapterTo get the most out of this chapter, read the following chapters before or inconjunction with this chapter:● Read Chapter 2, “Threats and Countermeasures.” This will give you a broaderand deeper understanding of potential threats and countermeasures faced by Webapplications.● Read Chapter 4, “Design Guidelines for Secure Web Applications.” In thischapter, you will learn the architecture and design challenges and guidelines forbuilding a secure solution.● Read Chapter 18, “Securing Your Database Server.” Read Chapter 18 tounderstand how the database servers are secured.● Read Chapter 7, “Building Secure Assemblies.” The guidelines andrecommendations in Chapter 7 for building secure assemblies and for developingsecure managed code should also be applied to data access code.● Use the Assessing Chapters. To review the security of your data access atdifferent stages of the product cycle, refer to the Web services sections in thefollowing chapters: Chapter 5, “Architecture and Design Review for Security,”Chapter 21, “Code Review,” and Chapter 22, “Deployment Review.”● Use the Checklist. “Checklist: Securing Data Access” in the Checklists section ofthis guide includes a checklist for easy reference. Use this task-based checklist as asummary of the recommendations in this chapter.Threats and CountermeasuresTo build secure data access code, know what the threats are, how commonvulnerabilities arise in data access code, and how to use appropriate countermeasuresto mitigate risk.The top threats to data access code are:● SQL injection● Disclosure of configuration data● Disclosure of sensitive application data● Disclosure of database schema and connection details● Unauthorized access● Network eavesdropping