Computer Security U10 - Web Security

Web basics
1. HTTP
  1. HTML
    1. URL
  2. TCP/IP protocol
  3. stateless
  4. unprotected
2. security issues
  1. C I A
    1. availability
Web applications
1. functionality
  1. server-side
    1. SQL Injection attack
  2. client -side
2. active content
  1. mobile code
    1. attack = "jumping the firewall
  2. safeguards
    1. blocking/filtering before execution
      1. restricting functionality
        Sandboxing
        code signing
        digital signature
        assumes fully implemented PKI
        Java Virtual Machine (JVM)
3. trusted sources
4. attacks
  1. Parameter injection
    1. Cross-site scripting
      1. File traversals
Authentication
1. SSL
2. SSO
  1. local password storage
    1. proprietary, vendor-specific solutions
      1. centralised approach
        federated approach
  2. Library Alliance
3. MS Passport
  1. Pros
    1. no special s/ware needed
  2. Cons
    1. central server = single point of failure
      1. data mining
Privacy
1. Web session traces
  1. cookies
    1. session management
    2. personalised web offers
    3. authentication
  2. server logs
  3. cached web pages
Transmission security
1. Secure Socket Layer (SSL) & Transport Layer Security (TLS)
  1. security services
    1. strong authentication
    2. integrity
    3. confidentiality (encryption)
  2. stops: spoofing eavesdropping manipulation
  3. deployment
    1. not a single solution
    2. security ends outside tunnel
    3. dependent on PKI
Browser security
1. settings
  1. SSL
    1. cookies
      1. active content
        caching
        passwords
  2. complex/numerous
Web services
1. idea
  1. services in machine-readable form
2. technology
  1. HTTP
    1. XML
      1. SOAP
        WSDL
        UDDI
3. security
  1. initiatives
    1. add security mechanisms
      1. web services
  2. issues
    1. delegation
      1. over company borders
        transaction
        end-to-end
        message-level
        for open infrastructure
        between "strangers"

Next up

Computer Security U10 - Web Security

Description

Resource summary

0 comments

Similar

	Created by Nick.Bell2013 about 12 years ago