Improving Web Application Security: Threats and - CGISecurity

Chapter 1: Web Application Security Fundamentals 9Table 1.2: Rationale for Host Configuration Categories (continued)CategoryDescriptionFiles and Directories Files and directories should be secured with restricted NTFS permissionsthat allow access only to the necessary Microsoft Windows service anduser accounts.SharesPortsAuditing and LoggingRegistryAll unnecessary file shares, including the default administration shares ifthey are not required, should be removed. Secure the remaining shareswith restricted NTFS permissions.Services running on a server listen on specific ports to serve incomingrequests. Open ports on a server must be known and audited regularly tomake sure that an insecure service is not listening and available forcommunication. In the worst-case scenario, a listening port is detected thatwas not opened by an administrator.Auditing is a vital aid in identifying intruders or attacks in progress. Loggingproves particularly useful as forensic information when determining how anintrusion or attack was performed.Many security related settings are maintained in the registry. Secure theregistry itself by applying restricted Windows ACLs and blocking remoteregistry administration.Securing Your ApplicationIf you were to review and analyze the top security issues across many Webapplications, you would see a pattern of problems. By organizing these problems intocategories, you can systematically tackle them. These problem areas are yourapplication’s vulnerability categories.Application Vulnerability CategoriesWhat better way to measure the security of a system than to evaluate its potentialweak points? To measure the security resilience of your application, you can evaluatethe application vulnerability categories. When you do this, you can create applicationsecurity profiles, and then use these profiles to determine the security strength of anapplication.These categories are used as a framework throughout this guide. Because thecategories represent the areas where security mistakes are most frequently made,they are used to illustrate guidance for application developers and architects. Thecategories are also used as a framework when evaluating the security of a Webapplication. With these categories, you can focus consistently on the key design andimplementation choices that most affect your application’s security. Applicationvulnerability categories are described in Table 1.3.