Improving Web Application Security: Threats and - CGISecurity

lxxviiiImproving Web Application Security: Threats and CountermeasuresFigure 3 shows the configuration categories used throughout Part IV of this guide,“Securing Your Network, Host, and Application.”Operating SystemSharesServicesAccountsAuditing andLoggingFiles andDirectoriesRegistryPatches and UpdatesNetworkProtocolsPortsFigure 3Host security categoriesSecuring Your ApplicationThe guide defines a set of application vulnerability categories to help you designand build secure Web applications and evaluate the security of existing applications.These are common categories that span multiple technologies and components in alayered architecture. These categories are the focus for discussion through thedesigning, building, and security assessment chapters in this guide.Table 2 Application Vulnerability CategoriesCategoryDescriptionInput ValidationHow do you know that the input your application receives is valid andsafe? Input validation refers to how your application filters, scrubs, orrejects input before additional processing.AuthenticationAuthorizationConfigurationManagementWho are you? Authentication is the process that an entity uses toidentify another entity, typically through credentials such as a user nameand password.What can you do? Authorization is the process that an application usesto control access to resources and operations.Who does your application run as? Which databases does it connect to?How is your application administered? How are these settings secured?Configuration management refers to how your application handles theseoperational issues.