Don’t trust infrastructure - Revision history

Jmanico at 20:35, 8 August 2016

2016-08-08T20:35:54Z

2016-08-08T20:35:46Z

2015-02-10T06:23:06Z

2009-04-07T12:28:55Z

2008-09-05T18:42:00Z

2006-06-14T14:40:01Z

2006-05-23T22:54:16Z

2006-04-19T01:17:41Z

New page

TBD

==Categories==

[[Category:Principle]]

@@ Line 1: / Line 1: @@
 {{Template:Principle}}
 {{Template:Stub}}
 ==Categories==

← Older revision		Revision as of 06:23, 10 February 2015
Line 8:		Line 8:

	[[Category:Principle]]		[[Category:Principle]]
		+
		+	A common myth: “I am using a market standard Webserver, Application server and Database. Hence, I don’t need to think about separately securing my application. I rely on security mechanisms provided by those servers!”.
		+	While market standard servers are written with security in mind, the actual application’s security is the responsibility of the application team. In fact, sometimes due to lack of proper security in the application, the container (web or app server) is compromised! Thereby other applications deployed on this container are affected.
		+
		+	Not trusting the infrastructure could mean that every application needs to authenticate and authorize every action from surrounded systems.
		+
		+	Another myth: “I need not validate the requests coming from other corporate applications or services into my application, as those requests are from known sources!”
		+	In fact, other unsecured application can be the source to damage our application. This can be referred as defense in depth (multi-level security) by implementing application-level security and not trusting the default security mechanisms of the surrounded infrastructure.

@@ Line 4: / Line 4: @@
 <br>
 [[Category:OWASP ASDR Project]]
 ==Categories==
 [[Category:Principle]]