Methodology

By securing the communication channels to the application server and preventing any hosts except authorized Web servers from accessing the application server, attackers are limited to application-layer attacks that exploit vulnerabilities in Web application design and development.

To mitigate this risk, developers must apply the secure design and development approaches described in PartsII and III of this guide.

The configuration solutions in this chapter are specific to the application server and they should not be applied in isolation. Apply them alongside the solutions presented in Chapter 15, "Securing Your Network," Chapter 16, "Securing Your Web Server," and Chapter 18, "Securing Your Database Server."