Improving Web Application Security: Threats and - CGISecurity

10 Part I: Introduction to Threats and CountermeasuresTable 1.3: Application Vulnerability CategoriesCategoryInput ValidationDescriptionHow do you know that the input that your application receives is valid andsafe? Input validation refers to how your application filters, scrubs, orrejects input before additional processing.AuthenticationAuthorizationConfigurationManagementSensitive DataSession ManagementCryptographyParameter ManipulationException ManagementAuditing and Logging“Who are you?” Authentication is the process where an entity proves theidentity of another entity, typically through credentials, such as a username and password.“What can you do?” Authorization is how your application provides accesscontrols for resources and operations.Who does your application run as? Which databases does it connect to?How is your application administered? How are these settings secured?Configuration management refers to how your application handles theseoperational issues.Sensitive data refers to how your application handles any data that mustbe protected either in memory, over the wire, or in persistent stores.A session refers to a series of related interactions between a user andyour Web application. Session management refers to how your applicationhandles and protects these interactions.How are you keeping secrets, secret (confidentiality)? How are youtamperproofing your data or libraries (integrity)? How are you providingseeds for random values that must be cryptographically strong?Cryptography refers to how your application enforces confidentiality andintegrity.Form fields, query string arguments, and cookie values are frequentlyused as parameters for your application. Parameter manipulation refersto both how your application safeguards tampering of these values andhow your application processes input parameters.When a method call in your application fails, what does your applicationdo? How much do you reveal? Do you return friendly error information toend users? Do you pass valuable exception information back to thecaller? Does your application fail gracefully?Who did what and when? Auditing and logging refer to how yourapplication records security-related events.