Improving Web Application Security: Threats and - CGISecurity

2Threats and CountermeasuresIn This Chapter●●●●OverviewAn explanation of attacker methodologyDescriptions of common attacksHow to categorize threatsHow to identify and counter threats at the network, host, and application levelsWhen you incorporate security features into your application’s design,implementation, and deployment, it helps to have a good understanding of howattackers think. By thinking like attackers and being aware of their likely tactics, youcan be more effective when applying countermeasures. This chapter describes theclassic attacker methodology and profiles the anatomy of a typical attack.This chapter analyzes Web application security from the perspectives of threats,countermeasures, vulnerabilities, and attacks. The following set of core terms aredefined to avoid confusion and to ensure they are used in the correct context.● Asset. A resource of value such as the data in a database or on the file system, or asystem resource● Threat. A potential occurrence — malicious or otherwise — that may harm an asset●●●Vulnerability. A weakness that makes a threat possibleAttack (or exploit). An action taken to harm an assetCountermeasure. A safeguard that addresses a threat and mitigates risk