Improving Web Application Security: Threats and - CGISecurity

lxxxiiImproving Web Application Security: Threats and CountermeasuresImplementing the GuidanceThe guidance throughout the guide is task-based and modular, and each chapterrelates to the various stages of the product development life cycle and the variousroles involved. These roles include architects, developers, system administrators,and security professionals. You can pick specific chapters to perform a particulartask or use a series of chapters for a phase of the product development life cycle.The checklist shown in Table 3 highlights the areas covered by this guide that arerequired to secure your network, host, and application.Table 3 Security ChecklistCheck DescriptionEducate your teams about the threats that affect the network, host, and applicationlayers. Identify common vulnerabilities and attacks, and learn countermeasures. For moreinformation, see Chapter 2, “Threats and Countermeasures.”Create threat models for your Web applications. For more information, see Chapter 3,“Threat Modeling.”Review and implement your company’s security policies. If you do not have securitypolicies in place, create them. For more information about creating security policies, see“Security Policy Issues” at the SANS Info Sec Reading Room at http://www.sans.org/rr/catindex.php?cat_id=50.Review your network security. For more information, see Chapter 15, “Securing YourNetwork.”Patch and update your servers. Review your server security settings and compare themwith the snapshot of a secure server. For more information, see “Snapshot of a SecureWeb Server” in Chapter 16, “Securing Your Web Server.”Educate your architects and developers about Web application security design guidelinesand principles. For more information, see Chapter 4, “Design Guidelines for Secure WebApplications.”Educate your architects and developers about writing secure managed code. For moreinformation, see Chapter 7, “Building Secure Assemblies” and Chapter 8, “Code AccessSecurity in Practice.”Secure your developer workstations. For more information, see “How To: Secure YourDeveloper Workstation” in the “How To” section of this guide.Review the designs of new Web applications and of existing applications. For moreinformation, see Chapter 5, “Architecture and Design Review for Security.”Educate developers about how to perform code reviews. Perform code reviews forapplications in development. For more information, see Chapter 21, “Code Review.”Perform deployment reviews of your applications to identify potential securityvulnerabilities. For more information, see Chapter 22, “Deployment Review.”