Improving Web Application Security: Threats and - CGISecurity

Introduction lixSecure the NetworkSecure the HostSecure the ApplicationPresentationLogicBusinessLogicData AccessLogicRuntime Services and ComponentsPlatform Services and ComponentsOperating SystemFigure 4A holistic approach to securityFigure 4 shows the multiple layers covered by the guide, including the network,host, and application. The host layer covers the operating system, platform servicesand components, and run-time services and components. Platform services andcomponents include SQL Server and Enterprise Services. Run-time services andcomponents include ASP.NET and .NET code access security among others.Focus on ThreatsYour application’s security measures can become useless, or even counter productive,if those measures are applied without knowing the threats that the security measuresare designed to mitigate.Threats can be external, such as attacker on the Internet, or internal, for example, adisgruntled employee or administrator. This guide helps you identify threats in twoways:● It enumerates the top threats that affect Web applications at the network, host, andapplication levels.● It helps you to identify which threats are relevant to your application througha process called threat modeling.