| Description |
1 online resource (xx, 232 pages) : illustrations |
|
text file PDF rda |
| Series |
The expert's voice in security |
|
Expert's voice in security.
|
| Note |
Includes index. |
| Summary |
The Manager's Guide to Web Application Security is a concise, information-packed guide to application security risks every organization faces, written in plain language, with guidance on how to deal with those issues quickly and effectively. Often, security vulnerabilities are difficult to understand and quantify because they are the result of intricate programming deficiencies and highly technical issues. Author and noted industry expert Ron Lepofsky breaks down the technical barrier and identifies many real-world examples of security vulnerabilities commonly found by IT security auditors, translates them into business risks with identifiable consequences, and provides practical guidance about mitigating them. The Manager's Guide to Web Application Security describes how to fix and prevent these vulnerabilities in easy-to-understand discussions of vulnerability classes and their remediation. For easy reference, the information is also presented schematically in Excel spreadsheets available to readers for free download from the publisher?s digital annex. The book is current, concise, and to the point?which is to help managers cut through the technical jargon and make the business decisions required to find, fix, and prevent serious vulnerabilities. |
| Bibliography |
Includes bibliographical references and index. |
| Contents |
Machine generated contents note: ch. 1 Understanding IT Security Risks -- Web Application Security Terminology -- Risk Calculation Models -- DREAD -- How to Calculate Web Application Security Risk -- Standard Calculations -- Customized Approach -- Calculating a Security Risk -- Calculating Risk from Multiple Vulnerabilities for Any Asset -- Calculating the Monetary Value at Risk for Any Asset -- Sources of Web Application Security Vulnerability Information -- Summary -- ch. 2 Types of Web Application Security Testing -- Understanding the Testing Process -- Web Application Audits -- Vulnerability Assessment -- Postremediation Testing -- Important Report Deliverables for All Testing Reports -- Summary -- ch. 3 Web Application Vulnerabilities and the Damage They Can Cause -- Lack of Sufficient Authentication -- Weak Password Controls -- Passwords Submitted Without Encryption -- Username Harvesting -- Weak Session Management -- Weak SSL Ciphers Support -- Information Submitted Using the GET Method -- Self-Signed Certificates, Insecure Keys, and Passwords -- Username Harvesting Applied to Forgotten Password Process -- Autocomplete Enabled on Password Fields -- Session IDs Nonrandom and Too Short -- Weak Access Control -- Frameable Response (Clickjacking) -- Cached HTTPS Response -- Sensitive Information Disclosed in HTML Comments -- HTTP Server Type and Version Number Disclosed -- Insufficient Session Expiration -- HTML Does Not Specify Charset -- Session Fixation -- Insecure Cookies -- Weak Input Validation at the Application Level -- Lack of Validated Input Allowing Automatic Script Execution -- Unauthorized Access by Parameter Manipulation -- Buffer Overflows -- Forms Submitted Using the GET Method -- Redirects and Forwards to Insecure Sites -- Application Susceptible to Brute-Force Attacks -- Client-Side Enforcement of Server-Side Security -- Injection Flaws -- SQL Injection -- Blind SQL Injection -- Link Injection -- HTTP Header Injection Vulnerability -- HTTP Response-Splitting Attack -- Unauthorized View of Data -- Web Application Source Code Disclosure -- Web Directories Enumerated -- Active Directory Object Default Page on Server -- Temporary Files Left in the Environment -- Internal IP Address Revealed by Web Server -- Server Path Disclosed -- Hidden Directory Detected -- Unencrypted VIEWSTATE -- Obsolete Web Server -- Query Parameter in SSL Request -- Error Handling -- Cross-Site Scripting Attacks -- Reflected Cross-Site Scripting Attack -- Stored Cross-Site Scripting Attack -- Cross-Site Request Forgery Attack -- Security Misconfigurations and Use of Known Vulnerable Components -- Denial-of-Service Attack -- Related Security Issues -- Storage of Data at Rest -- Storage of Account Lists -- Password Storage -- Insufficient Patch Management -- Summary -- ch. 4 Web Application Vulnerabilities and Countermeasures -- Lack of Sufficient Authentication -- Weak Password Controls -- Passwords Submitted Without Encryption -- Username Harvesting -- Weak Session Management -- Weak SSL Ciphers Support -- Information Submitted Using the GET Method -- Self-Signed Certificates, Insecure Keys, and Passwords -- Username Harvesting Applied to Forgotten Password Process -- Autocomplete Enabled on Password Fields -- Session IDs Nonrandom and Too Short -- Weak Access Control -- Frameable Response (Clickjacking) -- Cached HTTP Response -- Sensitive Information Disclosed in HTML Comments -- HTTP Server Type and Version Number Disclosed -- Insufficient Session Expiration -- HTML Does Not Specify Charset -- Session Fixation -- Insecure Cookies -- Weak Input Validation at the Application Level -- Lack of Validated Input Allowing Automatic Script Execution -- Unauthorized Access by Parameter Manipulation -- Buffer Overflows -- Form Submitted Using the GET Method -- Redirects and Forwards to Insecure Sites -- Application Susceptible to Brute-Force Attacks -- Client-Side Enforcement of Server-Side Security -- Injection Flaws -- SQL Injection -- Blind SQL Injection -- Link Injection -- HTTP Header Injection Vulnerability -- HTTP Response-Splitting Attack -- Unauthorized View of Data -- Web Application Source Code Disclosed -- Web Directories Enumerated -- Active Directory Object Default Page on Server -- Temporary Files Left in the Environment -- Internal IP Address Revealed by Web Server -- Server Path Disclosed -- Hidden Directory Detected -- Unencrypted VIEWSTATE -- Obsolete Web Server -- Query Parameter in SSL Request -- Error Handling -- Cross-Site Scripting Attacks -- Reflected Cross-Site Scripting Attack -- Stored Cross-Site Scripting Attack -- Cross-Site Request Forgery Attack -- Security Misconfigurations and Using Known Vulnerable Components -- Denial-of-Service Attack -- Related Security Issues -- Storage of Data at Rest -- Storage of Account Lists -- Password Storage -- Insufficient Patch Management -- Summary -- ch. 5 How to Build Preventative Countermeasures for Web Application Vulnerabilities -- Security-in-Software-Development Life Cycle -- Framework for Secure Web Application Code -- Web Application Security Testing -- Manual vs. Automated Code Testing -- Multilayered Defense -- Security Technology for Protecting Web Applications and Their Environments -- Summary -- ch. 6 How to Manage Security on Applications Written by Third Parties -- Transparency of Problem Resolution -- Liability Insurance as Backup for Transparency of Problem Resolution -- Change Management -- Summary -- ch. 7 Integrating Compliance with Web Application Security -- Regulations, Standards, and Expert Organization Recommendations -- Government Regulations -- Industry Standards -- Recommendations from Expert Organizations -- Financial Auditors' Favorites -- Leading Standards and Regulations -- COBIT -- COBIT 5 for IT Security -- E13PA and PCI DSS -- ISO 27000 -- NIST -- NERC CIP -- Sarbanes-Oxley -- Integrating Compliance and Security Reporting -- Summary -- ch. 8 How to Create a Business Case for Web Application Security -- Assessing the Risk -- Identifying Risk and Its Business Impact -- Estimating the Chance of Occurrence of Each Event -- Qualitative and Quantitative Risk Analysis -- Calculating Annual Loss Expectancy -- Calculating the Cost of Prevention and Remediation -- Calculating the Return on Security Investment -- Creating the Business Case for Executives -- Measuring and Cost-Justifying Residual Risk -- Calculating Security Status and Residual Risk with a Monthly Security Health Score -- How to Cost-Justify and Triage Vulnerabilities for Remediation -- Noting the Difference Between Remediating and Fixing -- Calculating the Cost of Mitigation -- Measuring the Effectiveness of Mitigation -- Determining Whether Return on Security Investment Objectives Are Met -- Summary -- ch. |
|
9 Parting Thoughts -- Appendix A COBIT® 5 for Information Security -- F.3. Secure Development -- Description of the Service Capability -- Attributes -- Goals -- F.4. Security Assessments -- Description of the Service Capability -- Attributes -- Goals -- F.5. Adequately Secured and Configured Systems, Aligned With Security Requirements and Security Architecture -- Description of the Service Capability -- Attributes -- Goals -- F.6. User Access and Access Rights in Line With Business Requirements -- Description of the Service Capability -- Attributes -- Goals -- F.7. Adequate Protection Against Malware, External Attacks and Intrusion Attempts -- Description of the Service Capability -- Attributes -- Goals -- Appendix B Experian EI3PA Security Assessment -- Appendix C ISO/IEC 17799:2005 and the ISO/IEC 27000:2014 Series -- ISO/IEC 17799:2005 -- ISO/IEC 27000:2014 Series -- Appendix D North American Energy Council Security Standard for Critical Infrastructure Protection (NERC CIP) -- NERC CIP Standards Currently in Force -- Future NERC CIP Standards -- Future Standard CIP-007-5: Cyber Security -- System Security Management -- Requirement R1 -- Requirement R2 -- Requirement R3 -- Requirement R4 -- Requirement R5 -- Rationale for R5 -- Appendix E NIST 800 Guidelines -- Appendix F Payment Card Industry (PCI) Data Security Standard -- Maintain a Vulnerability Management Program -- Appendix G Sarbanes-Oxley Security Compliance Requirements -- Appendix H Sources of Information. |
| Language |
English. |
| Subject |
Web applications -- Security measures.
|
|
Internet -- Security measures.
|
|
Applications Web -- Sécurité -- Mesures. |
|
Internet -- Sécurité -- Mesures. |
|
Internet -- Security measures |
| Indexed Term |
computerwetenschappen |
|
computer sciences |
|
gegevensbeheer |
|
data management |
|
Information and Communication Technology (General) |
|
Informatie- en communicatietechnologie (algemeen) |
| In: |
Springer eBooks |
| Other Form: |
Printed edition: 9781484201497 |
| ISBN |
9781484201480 (electronic bk.) |
|
1484201485 (electronic bk.) |
|
1484201493 (print) |
|
9781484201497 (print) |
| Standard No. |
10.1007/978-1-4842-0148-0 doi |
|
More Resources