Improving Web Application Security: Threats and - CGISecurity

14 Part I: Introduction to Threats and CountermeasuresThis chapter also identifies a set of common network, host, and application levelthreats, and the recommended countermeasures to address each one. The chapterdoes not contain an exhaustive list of threats, but it does highlight many top threats.With this information and knowledge of how an attacker works, you will be able toidentify additional threats. You need to know the threats that are most likely toimpact your system to be able to build effective threat models. These threat modelsare the subject of Chapter 3, “Threat Modeling.”How to Use This ChapterThe following are recommendations on how to use this chapter:● Become familiar with specific threats that affect the network host andapplication. The threats are unique for the various parts of your system, althoughthe attacker’s goals may be the same.● Use the threats to identify risk. Then create a plan to counter those threats.●●Apply countermeasures to address vulnerabilities. Countermeasures aresummarized in this chapter. Use Part III, “Building Secure Web Applications,” andPart IV, “Securing Your Network, Host, and Application,” of this guide forcountermeasure implementation details.When you design, build, and secure new systems, keep the threats in thischapter in mind. The threats exist regardless of the platform or technologies thatyou use.Anatomy of an AttackBy understanding the basic approach used by attackers to target your Webapplication, you will be better equipped to take defensive measures because you willknow what you are up against. The basic steps in attacker methodology aresummarized below and illustrated in Figure 2.1:● Survey and assess● Exploit and penetrate● Escalate privileges● Maintain access● Deny service