Improving Web Application Security: Threats and - CGISecurity

Fast Track — How To Implement the Guidance lxxixTable 2 Application Vulnerability Categories (continued)CategoryDescriptionSensitive DataSensitive data is information that must be protected either in memory,over the wire, or in persistent stores. Your application must have aprocess for handling sensitive data.Session ManagementCryptographyParameter ManipulationException ManagementAuditing and LoggingA session refers to a series of related interactions between a user andyour Web application. Session management refers to how yourapplication handles and protects these interactions.How are you protecting secret information (confidentiality)? How are youtamperproofing your data or libraries (integrity)? How are you providingseeds for random values that must be cryptographically strong?Cryptography refers to how your application enforces confidentiality andintegrity.Form fields, query string arguments, and cookie values are frequentlyused as parameters for your application. Parameter manipulation refersto both how your application safeguards tampering of these values andhow your application processes input parameters.When a method call in your application fails, what does your applicationdo? How much does it reveal about the failure condition? Do you returnfriendly error information to end users? Do you pass valuable exceptioninformation back to the caller? Does your application fail gracefully?Who did what and when? Auditing and logging refer to how yourapplication records security-related events.Identify ThreatsYou need to know your threats before you can successfully apply security measures.Threats can be external, such as from an attacker on the Internet, or internal — forexample, from a disgruntled employee or administrator. This guide helps you toidentify threats in two ways:● It lists the top threats that affect Web applications at the network, host, andapplication layers.● It presents a threat modeling process to help you identify which threats arerelevant to your application.