Improving Web Application Security: Threats and Countermeasures

Related Links

Errata Page

patterns and practices Index

Buy "Improving Web Application Security: Threats and Countermeasures" from Shop

Building Secure ASP .NET Applications (MSDN Online and Download PDF)

Buy "Building Secure ASP .NET Applications" from Shop

Improving Web Application Security: Threats and Countermeasures Roadmap

J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan
Microsoft Corporation

June 2003

Summary: This guide gives you a solid foundation for designing, building, and configuring secure ASP.NET Web applications. Whether you have existing applications or are building new ones, you can apply the guidance to help you make sure that your Web applications are hack-resilient.

Download

Download Improving Web Application Security from the MS.com Download Center in .pdf format.

Abstract

This guide helps you build hack-resilient applications. A hack-resilient application is one that reduces the likelihood of a successful attack and mitigates the extent of damage if an attack occurs. A hack-resilient application resides on a secure host (server) in a secure network and is developed using secure design and development guidelines.

Web application security must be addressed across the tiers and at multiple layers. A weakness in any tier or layer makes your application vulnerable to attack. Figure 1 shows the scope of the guide and the three-layered approach that it uses: securing the network, securing the host, and securing the application. It also shows the process called threat modeling, which provides a structure and rationale for the security process and allows you to evaluate security threats and identify appropriate countermeasures. If you do not know your threats, how can you secure your system?

Figure 1. Scope of Improving Web Application Security: Threats and Countermeasures

The guide addresses security across the three physical tiers shown in Figure 1. It covers the Web server, remote application server and database server. At each tier, security is addressed at the network layer, host layer, and application layer. Figure 1 also shows the configuration categories that the guide uses to organize the various security configuration settings that apply to the host and network, and the application vulnerability categories, used to structure application security considerations.

Table of Contents

The guide is divided into five parts. The aim is to provide a logical partitioning, which will help you to more easily digest the content.

Part I, Introduction to Threats and Countermeasures

This part identifies and illustrates the various threats facing the network, host, and application layers. By using the threat modeling process, you can identify the threats that are relevant to your application. This sets the stage for identifying effective countermeasures. This part includes:

• Foreword by Mark Curphey
• Foreword by Joel Scambray
• Foreword by Erik Olson
• Foreword by Michael Howard
• Introduction
• Solutions at a Glance
• Fast track
• Chapter 1, Web Application Security Fundamentals
• Chapter 2, Threats and Countermeasures
• Chapter 3, Threat Modeling

Part II, Designing Secure Web Applications

This part provides the guidance you need to design your Web applications securely. Even if you have an existing application, you should review this section and then revisit the concepts, principles, and techniques that you used during your application design. This part includes:

• Chapter 4, Design Guidelines for Secure Web Applications
• Chapter 5, Architecture and Design Review

Part III, Building Secure Web Applications

This part helps you to apply the secure design practices and principles covered in the previous part to create a solid and secure implementation. You'll learn defensive coding techniques that make your code and application resilient to attack. Chapter 6 presents an overview of the .NET Framework security landscape so that you are aware of the numerous defensive options and tools that are at your disposal. Part III includes:

• Chapter 6, .NET Security Fundamentals
• Chapter 7, Building Secure Assemblies
• Chapter 8, Code Access Security in Practice
• Chapter 9, Using Code Access Security with ASP.NET
• Chapter 10, Building Secure ASP.NET Pages and Controls
• Chapter 11, Building Secure Serviced Components
• Chapter 12, Building Secure Web Services
• Chapter 13, Building Secure Remoted Components
• Chapter 14, Building Secure Data Access

Part IV, Securing Your Network, Host and Application

This part shows you how to apply security configuration settings to secure the interrelated network, host, and application levels. Rather than applying security randomly, you'll learn the reasons for the security recommendations. Part IV includes:

• Chapter 15, Securing Your Network
• Chapter 16, Securing Your Web Server
• Chapter 17, Securing Your Application Server
• Chapter 18, Securing Your Database Server
• Chapter 19, Securing Your ASP.NET Application and Web Services
• Chapter 20, Hosting Multiple ASP.NET Applications

Part V: Assessing Your Security

This part provides you with the tools you need to evaluate the success of your security efforts. It shows you how to evaluate your code and design and also how to review your deployed application, to identify potential vulnerabilities:

• Chapter 21, Code Review
• Chapter 22, Deployment Review

Checklists

This section contains printable, task-based checklists, which are printable quick-reference sheets to help you turn information into action. This section includes the following checklists:

• Checklist: Architecture and Design Review
• Checklist: Security Review for Managed Code
• Checklist: Securing ASP.NET
• Checklist: Securing Enterprise Services
• Checklist: Securing Web Services
• Checklist: Securing Remoting
• Checklist: Securing Data Access
• Checklist: Securing Your Network
• Checklist: Securing Your Web Server
• Checklist: Securing Your Database Server

How To Articles

This section contains How To articles, which provide step-by-step procedures for key tasks. This section includes the following articles:

• How To: Implement Patch Management
• How To: Harden the TCP/IP Stack
• How To: Secure Your Developer Workstation
• How To: Use IPSec for Filtering Ports and Authentication
• How To: Use IISLockdown.exe
• How To: Use the Microsoft Baseline Security Analyzer
• How To: Use URLScan
• How To: Create a Custom Encryption Permission
• How To: Use Code Access Security Policy to Constrain an Assembly

Feedback and Support

We have made every effort to ensure the accuracy of this guide and its companion content.

Feedback on the Guide

If you have comments on this guide, send e-mail to secguide@microsoft.com. We are particularly interested in feedback regarding the following:

• Technical issues specific to recommendations
• Usefulness and usability issues
• Writing and editing issues

Technical Support

Technical support for the Microsoft products and technologies referenced in this guide is provided by Microsoft Product Support Services (PSS). For product support information, please visit the Microsoft Product Support Web site at https://support.microsoft.com.

Community and Newsgroup Support

MSDN Newsgroups: https://www.microsoft.com/communities/newsgroups/default.mspx

Table 2 Newsgroups

The Team Who Brought You This Guide

This guide was produced by the following .NET development specialists:

• J.D. Meier, Microsoft, Program Manager, Platform Architecture Guidance (PAG)
• Alex Mackman, Content Master Ltd, Founding member and Principal Technologist
• Srinath Vasireddy, Microsoft, Developer Support Engineer, PSS
• Michael Dunner, Microsoft, Developer Support Engineer, PSS
• Ray Escamilla, Microsoft, Developer Support Engineer, PSS
• Anandha Murukan, Satyam Computer Services

Contributors and Reviewers

• Many thanks to the following contributors and reviewers:
• Thanks to external reviewers–Mark Curphey, Open Web Application Security Project and Watchfire; Andy Eunson (extensive review); Anil John (code access security and hosting scenarios); Paul Hudson and Stuart Bonell, Attenda Ltd. (extensive review of the Securing series); Scott Stanfield and James Walters, Vertigo Software; Lloyd Andrew Hubbard; Matthew Levine; Lakshmi Narasimhan Vyasarajan, Satyam Computer Services; Nick Smith, Senior Security Architect, American Airlines (extensive review of the Securing series); Ron Nelson; Senthil Rajan Alaguvel, Infosys Technologies Limited; Roger Abell, Engineering Technical Services, Arizona State University; and Doug Thews.
• Microsoft Product Group–Michael Howard (Threat Modeling, Code Review, and Deployment Review); Matt Lyons (demystifying code access security); Caesar Samsi; Erik Olson (extensive validation and recommendations on ASP.NET); Andres De Vivanco (securing SQL Server); Riyaz Pishori (Enterprise Services); Alan Shi; Carlos Garcia Jurado Suarez; Raja Krishnaswamy, CLR Development Lead; Christopher Brown; Dennis Angeline; Ivan Medvedev (code access security); Jeffrey Cooperstein (Threat Modeling); Frank Swiderski; Manish Prabhu (.NET Remoting); Michael Edwards, MSDE; Pranish Kumar, (VC++ PM); Richard Waymire (SQL Security); Sebastian Lange; Greg Singleton; Thomas Deml (IIS Lead PM); Wade Hilmo (IIS); Steven Pratschner; Willis Johnson (SQL Server); and Girish Chander (SQL Server).
• Microsoft Consulting Services and Product Support Services (PSS): Ilia Fortunov (Senior Architect) for providing continuous and diligent feedback; Aaron Margosis (extensive review, script injection, and SQL Injection); Jacquelyn Schmidt; Kenny Jones; Wade Mascia (Web Services and Enterprise services); Aaron Barth; Jackie Richards; Aaron Turner; Andy Erlandson (Director of PSS Security); Jayaprakasam Siddian Thirunavukkarasu (SQL Server security); Jeremy Bostron; Jerry Bryant; Mike Leuzinger; Robert Hensing (reviewing the Securing series); Gene Ferioli; David Lawler; Jon Wall (threat modeling); Martin Born; Michael Thomassy; Michael Royster; Phil McMillan; and Steven Ramirez.
• Thanks to Joel Scambray; Rich Benack; Alisson Sol; Tavi Siochi (IT Audit); Don Willits (raising the quality bar); Jay Nanduri (Microsoft.com) for reviewing and sharing real world experience; Devendra Tiwari and Peter Dampier, for extensive review and sharing best IT practices; Denny Dayton; Carlos Lyons; Eric Rachner; Justin Clarke; Shawn Welch (IT Audit); Rick DeJarnette; Kent Sharkey (Hosting scenarios); Andy Oakley; Lucas Lavarello; Vijay Rajagopalan (Dev Lead MS Operations); Gordon Ritchie, Content Master Ltd; Chase Carpenter (Threat Modeling); Matt Powell (for Web Services security); Joel Yoker; Juhan Lee [MSN Operations]; Lori Woehler; Mike Sherrill; Mike Kass; Nilesh Bhide; Rebecca Hulse; Rob Oikawa (Architect); Scott Greene; Shawn Nandi; Steve Riley; Mark Mortimore; Matt Priestley; and David Ross.
• Thanks to our editors: Sharon Smith; Kathleen Hartman (S&T OnSite); Tina Burden (Entirenet); Cindy Riskin (S&T OnSite); and Pat Collins (Entirenet) for helping to ensure a quality experience for the reader.
• Finally, thanks to Naveen Yajaman; Philip Teale; Scott Densmore; Ron Jacobs; Jason Hogg; Per Vonge Nielsen; Andrew Mason; Edward Jezierski; Michael Kropp; Sandy Khaund; Shaun Hayes; Mohammad Al–Sabt; Edward Lafferty; Ken Perilman; and Sanjeev Garg (Satyam Computer Services).

Tell Us About Your Success

If this guide helps you, we would like to know. Tell us by writing a short summary of the problems you faced and how this guide helped you out. Submit your summary to:

MyStory@Microsoft.com.

© Microsoft Corporation. All rights reserved.