Improving Web Application Security: Threats and - CGISecurity

Fast Track — How To Implementthe GuidanceGoal and ScopeThis guide helps you to design, build, and configure hack-resilient Web applications.These applications reduce the likelihood of successful attacks and mitigate the extentof damage should an attack occur. Figure 1 shows the scope of the guide and itsthree-layered approach: securing the network, securing the host, and securing theapplication.WebServerSecuring the ApplicationInput validationAuthenticationAuthorizationConfiguration ManagementSensitive DataSession ManagementCryptographyParameter ManipulationException ManagementAuditing and LoggingApplicationServerDatabaseServerFirewallAppsHostFirewallAppsHostDatabaseHostSecuring theNetworkRouterFirewallSwitchPatches andUpdatesServicesProtocolsSecuring the HostAccountsFiles and DirectoriesSharesPortsRegistryAuditing and LoggingThreats and CountermeasuresFigure 1The scope of the guide