Improving Web Application Security: Threats and - CGISecurity

Solutions at a GlanceThis document roadmap summarizes the solutions presented in Improving WebApplication Security: Threats and Countermeasures. It provides links to the appropriatematerial in the guide so that you can easily locate the information you need and findsolutions to specific problems.Architecture and Design SolutionsFor architects, the guide provides the following solutions to help you design secureWeb applications:● How to identify and evaluate threatsUse threat modeling to systematically identify threats rather than applyingsecurity in a haphazard manner. Next, rate the threats based on the risk of anattack or occurrence of a security compromise and the potential damage that couldresult. This allows you to tackle threats in the appropriate order.For more information about creating a threat model and evaluating threat risks,see Chapter 3, “Threat Modeling.”● How to create secure designsUse tried and tested design principles. Focus on the critical areas where the correctapproach is essential and where mistakes are often made. This guide refers tothese as application vulnerability categories. They include input validation,authentication, authorization, configuration management, sensitive dataprotection, session management, cryptography, parameter manipulation,exception management, and auditing and logging considerations. Pay seriousattention to deployment issues including topologies, network infrastructure,security policies, and procedures.For more information, see Chapter 4, “Design Guidelines for Secure WebApplications.”● How to perform an architecture and design reviewReview your application’s design in relation to the target deploymentenvironment and associated security policies. Consider the restrictions imposedby the underlying infrastructure layer security, including perimeter networks,firewalls, remote application servers, and so on. Use application vulnerabilitycategories to help partition your application, and analyze the approach taken foreach area.For more information, see Chapter 5, “Architecture and Design Review forSecurity.”