Improving Web Application Security: Threats and - CGISecurity

12 Part I: Introduction to Threats and CountermeasuresSummaryAn ever-increasing number of attacks target your application. They pass straightthrough your environment’s front door using HTTP. The conventional fortress modeland the reliance on firewall and host defenses are not sufficient when used inisolation. Securing your application involves applying security at three layers: thenetwork layer, host layer, and the application layer. A secure network and hostplatform infrastructure is a must. Additionally, your applications must be designedand built using secure design and development guidelines following timewornsecurity principles.Additional ResourcesFor more information, see the following resources:●●For more information on the Open Hack Web application, see the MSDN article,“Open Hack: Building and Configuring More Secure Web Sites,” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/openhack.asp.This is Volume II in a series dedicated to helping customers improve Webapplication security. For more information on designing and implementingauthentication, authorization, and secure communication across the tiers of adistributed Web application, see “Microsoft patterns & practices Volume I, BuildingSecure ASP.NET Applications: Authentication, Authorization, and SecureCommunication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.asp.