Improving Web Application Security: Threats and - CGISecurity

408 Part IV: Securing Your Network, Host, and ApplicationAttacks●●●●Common denial of service attacks include:Brute force packet floods, such as cascading broadcast attacksSYN flood attacksService exploits, such as buffer overflowsCountermeasuresCountermeasures include:●●●Filtering broadcast requestsFiltering Internet Control Message Protocol (ICMP) requestsPatching and updating of service softwareMethodologySecurity begins with an understanding of how the system or network that needs to besecured works. This chapter breaks down network security by devices, which allowsyou to focus on single points of configuration.In keeping with this guide’s philosophy, this chapter uses the approach of analyzingpotential threats; without these analyses, it’s impossible to properly apply security.The network infrastructure can be broken into the following three layers: access,distribution, and core. These layers contain all of the hardware necessary to controlaccess to and from internal and external resources. The chapter focuses on thesoftware that drives the network hardware that is responsible for delivering ASP.NETapplications. The recommendations apply to an Internet or intranet-facing Web zoneand therefore might not apply to your internal or corporate network.The following are the core network components:● Router● Firewall● SwitchRouterThe router is the outermost security gate. It is responsible for forwarding IP packetsto the networks to which it is connected. These packets can be inbound requests fromInternet clients to your Web server, request responses, or outgoing requests frominternal clients. The router should be used to block unauthorized or undesired trafficbetween networks. The router itself must also be secured against reconfiguration byusing secure administration interfaces and ensuring that it has the latest softwarepatches and updates applied.