Web Security

Web Security

1. Security Issues for Web Applications

   • Protecting the client
   • Protection the connection
   • Preventing Denial of Service
   • Protecting the server
   • Protecting the services hidden behind the server
   • Security Management

2. Web Application Architecture

   • Web Client
     • HTML GET() POST()
   • Web Server
     • CGI script engine
   • Application logic
     • Containers
     • Database

3. Web Application Security Options

   • Policy
   • Technology
   • Architecture
   • Configuration

4. Securing Web Clients

   • Execution of Content
     • Java Virtual Machine
       • Could execute dangerous attacks
     • ActiveX
     • Flash
   • Scripting Languagues
     • Javascript
       • Plagued by a host of security bugs

5. Connection Security

   • VPN Tunnels
     • Strong Authentication
   • Web Server Placement
     • DMZ

6. Securing Web Server Hosts

   • Common Web server vulnerabilities
     • Host server misconfiguration
     • No patching security holes
     • Secure Web Host
       • Remove unnecessary tools
       • Minimize services
       • Protect critical services such as: DNS and email
       • Apply security patches
       • Write audit logs
       • Least Privilege

7. Securing Web Server

   • Authentication Options
     • Basic Server Authentication
     • Form-based authentication
     • Client certificates
     • Third-party service providers

8. Web Server Architecture Extensions

   • PHP
   • Active Server Pages
   • Java Server Pages

9. Java 2 Enterprise Edition

   • Server-Side Java
   • Java Servlets
   • Servlets and Declarative Access Control
     • Application name
     • User group
     • Logical user group aliases
     • Object-access group
     • Partially defined access control rules
     • Context constrains