Improving Web Application Security: Threats and - CGISecurity

IntroductionThis guide gives you a solid foundation for designing, building, and configuringsecure ASP.NET Web applications. Whether you have existing applications or arebuilding new ones, you can apply the guidance to help you make sure that yourWeb applications are hack-resilient.The information in this guide is based on proven practices for improving yourWeb application’s security. The guidance is task-based and presented in parts thatcorrespond to product life cycles, tasks, and roles.● Part I, “Introduction to Threats and Countermeasures,” identifies and illustratesthe various threats facing the network, host, and application layers. The process ofthreat modeling helps you to identify those threats that can harm your application.By understanding these threats, you can identify and prioritize effectivecountermeasures.● Part II, “Designing Secure Web Applications,” gives you the guidance yourequire to design secure Web applications. Even if you have deployed yourapplication, we recommend that you examine and evaluate the concepts,principles, and techniques outlined in this part.● Part III, “Building Secure Web Applications,” allows you to apply the securedesign practices introduced in Part II to create secure implementations. You willlearn defensive coding techniques that make your code and application resilientto attack.● Part IV, “Securing Your Network, Host, and Application,” describes how youwill apply security configuration settings to secure these three interrelated levels.Instead of applying security randomly, you will learn the rationale behind thesecurity recommendations.● Part V, “Assessing Your Security,” provides the tools you require to evaluate thesuccess of your security efforts. Starting with the application, you’ll take an insideoutapproach to evaluating your code and design. You’ll follow this with anoutside-in view of the security risks that challenge your network, host andapplication.Why We Wrote This GuideTraditionally, security has been considered a network issue, where the firewall is theprimary defense (the fortress model) or something that system administrators handleby locking down the host computers. Application architects and developers havetraditionally treated security as an afterthought or as a feature to be considered astime permits — usually after performance considerations are addressed.