Improving Web Application Security: Threats and - CGISecurity

Checklist:Architecture and Design ReviewHow to Use This ChecklistThis checklist is a companion to Chapter 4, “Design Guidelines for Secure WebApplications,” and Chapter 5, “Architecture and Design Review for Security.” Use itto help you perform architecture and design reviews to evaluate the security of yourWeb applications and to implement the design guidelines in Chapter 4.This checklist should evolve based on the experience you gain from performingreviews. You might also want to perform custom checks that are based on a specificaspect of your architecture or design to ensure that your deployment environmentthe design.Deployment and Infrastructure ConsiderationsCheck DescriptionThe design identifies, understands, and accommodates the company security policy.Restrictions imposed by infrastructure security (including available services, protocols, andfirewall restrictions) are identified.The design recognizes and accomodates restrictions imposed by hosting environments(including application isolation requirements).The target environment code-access-security trust level is known.The design identifies the deployment infrastructure requirements and the deploymentconfiguration of the application.Domain structures, remote application servers, and database servers are identified.The design identifies clustering requirements.The design identifies the application configuration maintenance points (such as what needsto be configured and what tools are available for an IDC admin).Secure communication features provided by the platform and the application are known.The design addresses Web farm considerations (including session state management,machine specific encryption keys, Secure Sockets Layer (SSL), certificate deploymentissues, and roaming profiles).The design identifies the certificate authority (CA) to be used by the site to support SSL.The design addresses the required scalability and performance criteria.