Improving Web Application Security: Threats and - CGISecurity

lxImproving Web Application Security: Threats and CountermeasuresFollow a Principle-Based ApproachRecommendations used throughout this guide are based on security principles thathave proven themselves over time. The analysis and consideration of threats priorto product implementation or deployment lends itself to a principle-based approachwhere core principles can be applied, regardless of implementation technology orapplication scenario.Positioning of This GuideThis is Volume II in a series dedicated to helping customers plan, build, deploy, andoperate secure Web applications: Volume I, Building Secure ASP.NET Applications:Authentication, Authorization, and Secure Communication, and Volume II, Improving WebApplication Security: Threats and Countermeasures.Volume I, Building Secure ASP.NET ApplicationsBuilding Secure ASP.NET Applications helps you to build a robust authentication andauthorization mechanism for your application. It focuses on identity managementthrough the tiers of a distributed Web application. By developing a solidauthentication and authorization strategy early in the design, you can eliminate ahigh percentage of application security issues. The primary audience for Volume Iis architects and lead developers.Figure 5 shows the scope of Volume I. The guide addresses authentication,authorization, and secure communication across the tiers of a distributed Webapplication. The technologies that are covered are the same as the current guide andinclude Windows 2000 Server, IIS, ASP.NET Web applications and Web services,Enterprise Services, .NET Remoting, SQL Server, and ADO.NET.