Improving Web Application Security: Threats and Countermeasures - page 1
- Table of Contents
- Table of Contents
- BackCover
- Improving Web Application Security - Threats and Countermeasures
- Forewords
- Foreword by Joel Scambray
- Foreword by Erik Olson
- Foreword by Michael Howard
- Introduction
- What Is a Hack-Resilient Application?
- Scope of This Guide
- Who Should Read This Guide
- How to Use This Guide
- Organization of This Guide
- Approach Used in This Guide
- Positioning of This Guide
- Feedback and Support
- The Team Who Brought You This Guide
- Tell Us About Your Success
- Summary
- Solutions at a Glance
- Development Solutions
- Administration Solutions
- Fast Track - How To Implement the Guidance
- The Holistic Approach
- Securing Your Network
- Securing Your Host
- Securing Your Application
- Identify Threats
- Applying the Guidance to Your Product Life Cycle
- Implementing the Guidance
- Who Does What?
- Summary
- Part I: Introduction to Threats and Countermeasures
- Chapter 1: Web Application Security Fundamentals
- We Are Secure - We Have a Firewall
- What Do We Mean By Security?
- Threats, Vulnerabilities, and Attacks Defined
- How Do You Build a Secure Web Application?
- Secure Your Network, Host, and Application
- Securing Your Network
- Securing Your Host
- Securing Your Application
- Security Principles
- Summary
- Additional Resources
- Chapter 2: Threats and Countermeasures
- Overview
- How to Use This Chapter
- Anatomy of an Attack
- Understanding Threat Categories
- Network Threats and Countermeasures
- Host Threats and Countermeasures
- Application Threats and Countermeasures
- Input Validation
- Authentication
- Authorization
- Configuration Management
- Sensitive Data
- Session Management
- Cryptography
- Parameter Manipulation
- Exception Management
- Auditing and Logging
- Summary
- Additional Resources
- Chapter 3: Threat Modeling
- Overview
- Before You Begin
- How to Use This Chapter
- Threat Modeling Principles
- Step 1. Identify Assets
- Step 2. Create an Architecture Overview
- Step 3. Decompose the Application
- Step 4. Identify the Threats
- Step 5. Document the Threats
- Step 6. Rate the Threats
- What Comes After Threat Modeling?
- Summary
- Additional Resources
