Improving Web Application Security: Threats and - CGISecurity

lviiiImproving Web Application Security: Threats and Countermeasures“How To” ArticlesThis section contains “How To” articles, which provide step-by-step procedures forkey tasks. This section includes the following articles:● How To: Implement Patch Management● How To: Harden the TCP/IP Stack● How To: Secure Your Developer Workstation● How To: Use IPSec for Filtering Ports and Authentication● How To: Use the Microsoft Baseline Security Analyzer● How To: Use IISLockdown.exe● How To: Use URLScan● How To: Create a Custom Encryption Permission● How To: Use Code Access Security Policy to Constrain an AssemblyApproach Used in This GuideIf your goal is a hack-resilient application, how do you get there? The approach usedin this guide is as follows:● Secure your network, host, and application● Focus on threats● Follow a principle-based approachSecure Your Network, Host, and ApplicationSecurity must be addressed at three levels: network, host, and application. Aweakness at any layer can be exploited by an attacker. This guide takes a holisticapproach to application security and applies it at all three levels. The holisticapproach to security is shown in Figure 4.