Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 477Threats and CountermeasuresMany threats to an application server come from within an organization becauseapplication servers should be isolated from Internet access. The main threats to anapplication server are:● Network eavesdropping● Unauthorized access● Viruses, Trojan horses, and wormsFigure 17.2 shows the main threats to an application server.PerimeterFirewallViruses,Trojanhorses,and WormsWeb ServerNetworkEavesdroppingApplicationServerNetworkEavesdroppingSQLServerUnauthorizedAccessUnauthorizedAccessFigure 17.2Top application server related threats and vulnerabilitiesNetwork EavesdroppingAttackers with network monitoring software can intercept data flowing from the Webserver to the application server and from the application server to downstreamsystems and database servers. The attacker can view and potentially modify thisdata.VulnerabilitiesVulnerabilities that can make your application server vulnerable to networkeavesdropping include:● Sensitive data transmitted in clear text by the application● Use of Microsoft SQL Server authentication to the database, resulting in clear textcredentials