Improving Web Application Security: Threats and - CGISecurity

viiiImproving Web Application Security: Threats and CountermeasuresSensitive Data .......................................................................................................... 35Access to Sensitive Data in Storage....................................................................... 35Network Eavesdropping ......................................................................................... 35Data Tampering..................................................................................................... 35Session Management ............................................................................................... 36Session Hijacking ................................................................................................. 36Session Replay..................................................................................................... 36Man in the Middle Attacks ..................................................................................... 37Cryptography ............................................................................................................ 37Poor Key Generation or Key Management................................................................ 38Weak or Custom Encryption ................................................................................... 38Checksum Spoofing .............................................................................................. 38Parameter Manipulation ............................................................................................ 39Query String Manipulation ..................................................................................... 39Form Field Manipulation ........................................................................................ 40Cookie Manipulation ............................................................................................. 40HTTP Header Manipulation..................................................................................... 40Exception Management ............................................................................................. 40Attacker Reveals Implementation Details ................................................................ 41Denial of Service .................................................................................................. 41Auditing and Logging ................................................................................................. 41User Denies Performing an Operation ..................................................................... 42Attackers Exploit an Application Without Leaving a Trace .......................................... 42Attackers Cover Their Tracks .................................................................................. 42Summary ................................................................................................................. 42Additional Resources ................................................................................................ 43Chapter 3Threat Modeling 45In This Chapter ......................................................................................................... 45Overview .................................................................................................................. 45Before You Begin ...................................................................................................... 45How to Use This Chapter ........................................................................................... 46Threat Modeling Principles......................................................................................... 47The Process ......................................................................................................... 47The Output ........................................................................................................... 48Step 1. Identify Assets .............................................................................................. 49Step 2. Create an Architecture Overview ..................................................................... 49Identify What the Application Does ......................................................................... 50Create an Architecture Diagram.............................................................................. 50Identify the Technologies ....................................................................................... 51