Solutions at a Glance

This document roadmap summarizes the solutions presented in Improving Web Application Security: Threats and Countermeasures . It provides links to the appropriate material in the guide so that you can easily locate the information you need and find solutions to specific problems.

Architecture and Design Solutions

For architects , the guide provides the following solutions to help you design secure Web applications:

• How to identify and evaluate threats

  Use threat modeling to systematically identify threats rather than applying security in a haphazard manner. Next, rate the threats based on the risk of an attack or occurrence of a security compromise and the potential damage that could result. This allows you to tackle threats in the appropriate order.

  For more information about creating a threat model and evaluating threat risks, see Chapter 3, "Threat Modeling."

• How to create secure designs

  Use tried and tested design principles. Focus on the critical areas where the correct approach is essential and where mistakes are often made. This guide refers to these as application vulnerability categories . They include input validation, authentication, authorization, configuration management, sensitive data protection, session management, cryptography, parameter manipulation, exception management, and auditing and logging considerations. Pay serious attention to deployment issues including topologies, network infrastructure, security policies, and procedures.

  For more information, see Chapter 4, "Design Guidelines for Secure Web Applications."

• How to perform an architecture and design review

  Review your application's design in relation to the target deployment environment and associated security policies. Consider the restrictions imposed by the underlying infrastructure layer security, including perimeter networks, firewalls, remote application servers, and so on. Use application vulnerability categories to help partition your application, and analyze the approach taken for each area.

  For more information, see Chapter 5, "Architecture and Design Review for Security."