Improving Web Application Security: Threats and - CGISecurity

Fast Track — How To Implement the Guidance lxxxi6. Rate the threats.Rate the threats to prioritize and address the most significant threats first. Thesethreats are the ones that present the biggest risk. The rating process weighs theprobability of the threat against the damage that could result should an attackoccur. It might turn out that certain threats do not warrant any action when youcompare the risk posed by the threat with the resulting mitigation costs.Applying the Guidance to Your Product Life CycleDifferent parts of the guide apply to the different phases of the product developmentlife cycle. The sequence of chapters in the guide mirrors the typical phases of the lifecycle. The chapter-to-role relationship is shown in Figure 5.RequirementsGatheringArchitecture andDesign ReviewDesignThreat Modeling andPart II, Designing SecureWeb ApplicationsCode ReviewDevelopmentPart III, Building SecureWeb ApplicationsPart V, AssessingYo ur SecurityTestingDeploymentReviewDeploymentMaintenancePart IV, SecuringYour Network, Hostand ApplicationFigure 5Relationship of chapter to product life cycleNote Threat modeling and security assessment (specifically the code review and deployment reviewchapters) apply when you build new Web applications or when you review existing applications.