Improving Web Application Security: Threats and - CGISecurity

Introduction liiiHow to Use This GuideEach chapter in the guide is modular. The guidance is task-based, and is presentedin parts which correspond to the various stages of the product development life cycleand to the people and roles involved during the life cycle including architects,developers, system administrators, and security analysts.Applying the Guidance to Your RoleEach person, regardless of role, who works on the design, development, deployment,or maintenance of Web applications and their underlying infrastructure should readPart I of this guide. Part I, “Introduction to Threats and Countermeasures,” highlightsand explains the primary threats to Web applications at the network, host, andapplication layers. It also shows you how to create threat models to help you identifyand prioritize those threats that are most relevant to your particular application.A solid understanding of threats and associated countermeasures is essential foranyone who is interested in securing Web applications.If you are responsible for or are involved in the design of a new or existing Webapplication, you should read Part II, “Designing Secure Web Applications.” Part IIhelps you identify potential vulnerabilities in your application design.If you are a developer, you should read Part III, “Building Secure Web Applications.”The information in this part helps you to develop secure code and components,including Web pages and controls, Web services, remoting components, and dataaccess code. As a developer, you should also read Part IV, “Securing Your Network,Host, and Application” to gain a better understanding of the type of secureenvironment that your code is likely to be deployed in. If you understand more aboutyour target environment, the risk of issues and security vulnerabilities appearing atdeployment time is reduced significantly.If you are a system administrator, you should read Part IV, “Securing Your Network,Host, and Application.” The information in this part helps you create a securenetwork and server infrastructure — one that is tuned to support .NET Webapplications and Web services.Anyone who is responsible for reviewing product security should read Part V,“Assessing Your Security”. This helps you identify vulnerabilities caused by insecurecoding techniques or deployment configurations.