Improving Web Application Security: Threats and - CGISecurity

lxivImproving Web Application Security: Threats and Countermeasures●●●●Microsoft Consulting Services and Product Support Services (PSS): Ilia Fortunov(Senior Architect) for providing continuous and diligent feedback; Aaron Margosis(extensive review, script injection, and SQL Injection); Jacquelyn Schmidt; KennyJones; Wade Mascia (Web Services and Enterprise services); Aaron Barth; JackieRichards; Aaron Turner; Andy Erlandson (Director of PSS Security); JayaprakasamSiddian Thirunavukkarasu (SQL Server security); Jeremy Bostron; Jerry Bryant;Mike Leuzinger; Robert Hensing (reviewing the Securing series); Gene Ferioli;David Lawler; Jon Wall (threat modeling); Martin Born; Michael Thomassy;Michael Royster; Phil McMillan; and Steven Ramirez.Thanks to Joel Scambray; Rich Benack; Alisson Sol; Tavi Siochi (IT Audit); DonWillits (raising the quality bar); Jay Nanduri (Microsoft.com) for reviewing andsharing real world experience; Devendra Tiwari and Peter Dampier, for extensivereview and sharing best IT practices; Denny Dayton; Carlos Lyons; Eric Rachner;Justin Clarke; Shawn Welch (IT Audit); Rick DeJarnette; Kent Sharkey (Hostingscenarios); Andy Oakley; Vijay Rajagopalan (Dev Lead MS Operations); GordonRitchie, Content Master Ltd; Chase Carpenter (Threat Modeling); Matt Powell(for Web Services security); Joel Yoker; Juhan Lee [MSN Operations]; Lori Woehler;Mike Sherrill; Mike Kass; Nilesh Bhide; Rebecca Hulse; Rob Oikawa (Architect);Scott Greene; Shawn Nandi; Steve Riley; Mark Mortimore; Matt Priestley; andDavid Ross.Thanks to our editors: Sharon Smith; Kathleen Hartman (S&T OnSite); TinaBurden (Entirenet); Cindy Riskin (S&T OnSite); and Pat Collins (Entirenet) forhelping to ensure a quality experience for the reader.Finally, thanks to Naveen Yajaman; Philip Teale; Scott Densmore; Ron Jacobs;Jason Hogg; Per Vonge Nielsen; Andrew Mason; Edward Jezierski; Michael Kropp;Sandy Khaund; Shaun Hayes; Mohammad Al-Sabt; Edward Lafferty; KenPerilman; and Sanjeev Garg (Satyam Computer Services).Tell Us About Your SuccessIf this guide helps you, we would like to know. Tell us by writing a short summaryof the problems you faced and how this guide helped you out. Submit yoursummary to:MyStory@Microsoft.com.SummaryIn this introduction, you were shown the structure of the guide and the basicapproach used by the guide to secure Web applications. You were also shown howto apply the guidance to your role or to specific phases of your product developmentlife cycle.