Security Architecture Cheat Sheet - Revision history

Jmanico: Replaced content with "Moved to Application Security Architecture Cheat Sheet."

2011-10-14T23:43:31Z

Replaced content with "Moved to Application Security Architecture Cheat Sheet."

Jmanico: /* Data Processing */

2011-10-14T23:41:57Z

‎Data Processing

Jmanico: /* APPLICATION REQUIREMENTS = */

2011-10-14T23:41:33Z

‎APPLICATION REQUIREMENTS =

Jmanico at 23:41, 14 October 2011

2011-10-14T23:41:06Z

Jmanico at 23:38, 14 October 2011

2011-10-14T23:38:18Z

Jmanico at 23:35, 14 October 2011

2011-10-14T23:35:27Z

Show changes

Jmanico at 02:09, 18 August 2011

2011-08-18T02:09:29Z

Jmanico at 02:07, 18 August 2011

2011-08-18T02:07:41Z

Jmanico at 05:25, 21 June 2009

2009-06-21T05:25:30Z

Jmanico at 23:01, 20 June 2009

2009-06-20T23:01:17Z

← Older revision		Revision as of 23:43, 14 October 2011
Line 1:		Line 1:
−	~~= Introduction =~~	+	Moved to [[Application Security Architecture Cheat Sheet]].
−	~~This cheat sheet offers tips for the initial design and review of an application’s security architecture.~~
−
−	~~= BUSINESS REQUIREMENTS =~~
−	~~== Business Model ==~~
−	* What is the application’s primary business purpose?
−	* How will the application make money?
−	* What are the planned business milestones for developing or improving the application?
−	* How is the application marketed?
−	* What key benefits does application offer its users?
−	* What business continuity provisions have been defined for the application?
−	* What geographic areas does the application service?
−	~~== Data Essentials ==~~
−	* What data does the application receive, produce, and process?
−	* How can the data be classified into categories according to ~~its sensitivity?~~
−	* How might an attacker benefit from capturing or modifying the data?
−	* What data backup and retention requirements have been defined for the application?
−	~~== End‐Users ==~~
−	* Who are the application’s end‐users?
−	* How do the end‐users interact with the application?
−	* What security expectations do the end‐users have?
−	~~== Partners ==~~
−	* Which third‐parties supply data to the application?
−	* Which third‐parties receive data from the applications?
−	* Which third‐parties process the application’s data?
−	* What mechanisms are used to share data with third‐parties besides the application itself?
−	* What security requirements do the partners impose?
−	~~== Administrators ==~~
−	* Who has administrative capabilities in the application?
−	* What administrative capabilities does the application offer?
−	~~== Regulations ==~~
−	* In what industries does the application operate?
−	* What security‐related regulations apply?
−	* What auditing and compliance regulations apply?
−
−	~~= INFRASTRUCTURE REQUIREMENTS =~~
−	~~== Network ==~~
−	* What details regarding routing, switching, firewalling, and load‐balancing have been defined?
−	* What network design supports the application?
−	* What core network devices support the application?
−	* What network performance requirements exist?
−	* What private and public network links support the application?
−	~~== Systems ==~~
−	* What operating systems support the application?
−	* What hardware requirements have been defined?
−	* What details regarding required OS components and lock‐down needs have been defined?
−	~~== Infrastructure Monitoring ==~~
−	* What network and system performance monitoring requirements have been defined?
−	* What mechanisms exist to detect malicious code or compromised application components?
−	* What network and system security monitoring requirements have been defined?
−	~~== Virtualization and Externalization ==~~
−	* What aspects of the application lend themselves to virtualization?
−	* What virtualization requirements have been defined for the application?
−	* What aspects of the product may or may not be hosted via the cloud computing model?
−	~~= APPLICATION REQUIREMENTS =~~
−
−	~~== Environment ==~~
−	* What frameworks and programming languages have been used to create the application?
−	* What process, code, or infrastructure dependencies have been defined for the application?
−	* What databases and application servers support the application?
−
−	~~== Data Processing ==~~
−	* What data entry paths does the application support?
−	* What data output paths does the application support?
−	* How does data flow across the application’s internal components?
−	* What data input validation requirements have been defined?
−	* What data does the application store and how?
−	* What data is or may need to be encrypted and what key management requirements have been defined?
−	* What capabilities exist to detect the leakage of sensitive data?
−	* What encryption requirements have been defined for data in transit over WAN and LAN links?
−	~~== Access ==~~
−	* What user privilege levels does the application support?
−	* What user identification and authentication requirements have been defined?
−	* What user authorization requirements have been defined?
−	* What session management requirements have been defined?
−	* What access requirements have been defined for URI and Service calls?
−	* What user access restrictions have been defined?
−	* How are user identities maintained throughout transaction calls?
−	~~== Application Monitoring ==~~
−	* What application auditing requirements have been defined?
−	* What application performance monitoring requirements have been defined?
−	* What application security monitoring requirements have been defined?
−	* What application error handling and logging requirements have been defined?
−	* How are audit and debug logs accessed, stored, and secured?
−	== Application ~~Design ==~~
−	* What application design review practices have been defined and executed?
−	* How is intermediate or in-process data stored in the application components' memory and in cache?
−	* How many logical tiers group the application's components?
−	* What staging, testing, and Quality Assurance requirements have been defined?
−
−	~~= SECURITY PROGRAM REQUIREMENTS =~~
−	~~== Operations ==~~
−	* What is the process for identifying and addressing vulnerabilities in the application?
−	* What is the process for identifying and addressing vulnerabilities in network and system components?
−	* What access to system and network administrators have to the application's sensitive data?
−	* What security incident requirements have been defined?
−	* How do administrators access production infrastructure to manage it?
−	* What physical controls restrict access to the application's components and data?
−	* What is the process for granting access to the environment hosting the application?
−	~~== Change Management ==~~
−	* How are changes to the code controlled?
−	* How are changes to the infrastructure controlled?
−	* How is code deployed to production?
−	* What mechanisms exist to detect violations of change management practices?
−	~~== Software Development ==~~
−	* What data is available to developers for testing?
−	* How do developers assist with troubleshooting and debugging the application?
−	* What requirements have been defined for controlling access to the applications source code?
−	* What secure coding processes have been established?
−	~~== Corporate ==~~
−	* What corporate security program requirements have been defined?
−	* What security training do developers and administrators undergo?
−	* Which personnel oversees security processes and requirements related to the application?
−	* What employee initiation and termination procedures have been defined?
−	* What application requirements impose the need to enforce the principle of separation of duties?
−	* What controls exist to protect a compromised in the corporate environment from affecting production?
−	* What security governance requirements have been defined?
−
−	~~= Related~~ Cheat ~~Sheets =~~
−
−	~~{{Cheatsheet_Navigation}}~~
−
−	~~= Authors and Primary Editors =~~
−
−	~~[http://www.zeltser.com Lenny Zeltser]~~
−
−	~~[[Category:Cheatsheets~~]]

@@ Line 60: / Line 60: @@
 * What databases and application servers support the application?
-= Data Processing =
+== Data Processing ==
 * What data entry paths does the application support?
 * What data output paths does the application support?

@@ Line 53: / Line 53: @@
 * What virtualization requirements have been defined for the application?
 * What aspects of the product may or may not be hosted via the cloud computing model?
-= APPLICATION REQUIREMENTS ==
+= APPLICATION REQUIREMENTS =
 == Environment ==
 * What frameworks and programming languages have been used to create the application?
 * What process, code, or infrastructure dependencies have been defined for the application?
 * What databases and application servers support the application?
 = Data Processing =
 * What data entry paths does the application support?

@@ Line 1: / Line 1: @@
-<b>SECURITY ARCHITECTURE CHEAT SHEET FOR INTERNET APPLICATIONS</b><br/>
+= Introduction =
-This cheat sheet offers tips for the initial design and review of an application’s security architecture.<br/>
+This cheat sheet offers tips for the initial design and review of an application’s security architecture.
 = BUSINESS REQUIREMENTS =
@@ Line 35: / Line 35: @@
 = INFRASTRUCTURE REQUIREMENTS =
-= Network =
+== Network ==
 * What details regarding routing, switching, firewalling, and load‐balancing have been defined?
 * What network design supports the application?
@@ Line 41: / Line 41: @@
 * What network performance requirements exist?
 * What private and public network links support the application?
-= Systems =
+== Systems ==
 * What operating systems support the application?
 * What hardware requirements have been defined?
 * What details regarding required OS components and lock‐down needs have been defined?
-= Infrastructure Monitoring =
+== Infrastructure Monitoring ==
 * What network and system performance monitoring requirements have been defined?
 * What mechanisms exist to detect malicious code or compromised application components?
 * What network and system security monitoring requirements have been defined?
-= Virtualization and Externalization =
+== Virtualization and Externalization ==
 * What aspects of the application lend themselves to virtualization?
 * What virtualization requirements have been defined for the application?
 * What aspects of the product may or may not be hosted via the cloud computing model?
-=  APPLICATION REQUIREMENTS =
+= APPLICATION REQUIREMENTS ==
-= Environment =
+== Environment ==
 * What frameworks and programming languages have been used to create the application?
 * What process, code, or infrastructure dependencies have been defined for the application?
@@ Line 67: / Line 67: @@
 * What capabilities exist to detect the leakage of sensitive data?
 * What encryption requirements have been defined for data in transit over WAN and LAN links?
-= Access =
+== Access ==
 * What user privilege levels does the application support?
 * What user identification and authentication requirements have been defined?
@@ Line 75: / Line 75: @@
 * What user access restrictions have been defined?
 * How are user identities maintained throughout transaction calls?
-= Application Monitoring =
+== Application Monitoring ==
 * What application auditing requirements have been defined?
 * What application performance monitoring requirements have been defined?
@@ Line 81: / Line 81: @@
 * What application error handling and logging requirements have been defined?
 * How are audit and debug logs accessed, stored, and secured?
-= Application Design =
+== Application Design ==
 * What application design review practices have been defined and executed?
 * How is intermediate or in-process data stored in the application components' memory and in cache?
 * How many logical tiers group the application's components?
 * What staging, testing, and Quality Assurance requirements have been defined?
 = SECURITY PROGRAM REQUIREMENTS =
-= Operations =
+== Operations ==
 * What is the process for identifying and addressing vulnerabilities in the application?
 * What is the process for identifying and addressing vulnerabilities in network and system components?
@@ Line 95: / Line 96: @@
 * What physical controls restrict access to the application's components and data?
 * What is the process for granting access to the environment hosting the application?
-= Change Management =
+== Change Management ==
 * How are changes to the code controlled?
 * How are changes to the infrastructure controlled?
 * How is code deployed to production?
 * What mechanisms exist to detect violations of change management practices?
-= Software Development =
+== Software Development ==
 * What data is available to developers for testing?
 * How do developers assist with troubleshooting and debugging the application?
 * What requirements have been defined for controlling access to the applications source code?
 * What secure coding processes have been established?
-= Corporate =
+== Corporate ==
 * What corporate security program requirements have been defined?
 * What security training do developers and administrators undergo?
@@ Line 113: / Line 114: @@
 * What controls exist to protect a compromised in the corporate environment from affecting production?
 * What security governance requirements have been defined?
 = Related Cheat Sheets  =

@@ Line 2: / Line 2: @@
 This cheat sheet offers tips for the initial design and review of an application’s security architecture.<br/>
-== BUSINESS REQUIREMENTS ==
+= BUSINESS REQUIREMENTS =
-= Business Model =
+== Business Model ==
 * What is the application’s primary business purpose?
 * How will the application make money?
@@ Line 11: / Line 11: @@
 * What business continuity provisions have been defined for the application?
 * What geographic areas does the application service?
-= Data Essentials =
+== Data Essentials ==
 * What data does the application receive, produce, and process?
 * How can the data be classified into categories according to its sensitivity?
 * How might an attacker benefit from capturing or modifying the data?
 * What data backup and retention requirements have been defined for the application?
-= End‐Users =
+== End‐Users ==
 * Who are the application’s end‐users?
 * How do the end‐users interact with the application?
 * What security expectations do the end‐users have?
-= Partners =
+== Partners ==
 * Which third‐parties supply data to the application?
 * Which third‐parties receive data from the applications?
@@ Line 26: / Line 26: @@
 * What mechanisms are used to share data with third‐parties besides the application itself?
 * What security requirements do the partners impose?
-= Administrators =
+== Administrators ==
 * Who has administrative capabilities in the application?
 * What administrative capabilities does the application offer?
-= Regulations =
+== Regulations ==
 * In what industries does the application operate?
 * What security‐related regulations apply?
 * What auditing and compliance regulations apply?
-== INFRASTRUCTURE REQUIREMENTS ==
+= INFRASTRUCTURE REQUIREMENTS =
 = Network =
 * What details regarding routing, switching, firewalling, and load‐balancing have been defined?
@@ Line 53: / Line 53: @@
 * What virtualization requirements have been defined for the application?
 * What aspects of the product may or may not be hosted via the cloud computing model?
-==  APPLICATION REQUIREMENTS ==
+=  APPLICATION REQUIREMENTS =
 = Environment =
 * What frameworks and programming languages have been used to create the application?
@@ Line 86: / Line 86: @@
 * How many logical tiers group the application's components?
 * What staging, testing, and Quality Assurance requirements have been defined?
-== SECURITY PROGRAM REQUIREMENTS ==
+= SECURITY PROGRAM REQUIREMENTS =
 = Operations =
 * What is the process for identifying and addressing vulnerabilities in the application?

@@ Line 116: / Line 116: @@
 : What controls exist to protect a compromised in the corporate environment from affecting production?
 : What security governance requirements have been defined?
 [[Category:Cheatsheets]]

← Older revision		Revision as of 05:25, 21 June 2009
Line 116:		Line 116:
	: What controls exist to protect a compromised in the corporate environment from affecting production?		: What controls exist to protect a compromised in the corporate environment from affecting production?
	: What security governance requirements have been defined?		: What security governance requirements have been defined?
		+
		+	[[Category:Cheatsheets]]

@@ Line 37: / Line 37: @@
 : What auditing and compliance regulations apply?
-==  #2: INFRASTRUCTURE REQUIREMENTS ==
+== INFRASTRUCTURE REQUIREMENTS ==
 ; Network
 : What details regarding routing, switching, firewalling, and load‐balancing have been defined?
@@ Line 56: / Line 56: @@
 : What virtualization requirements have been defined for the application?
 : What aspects of the product may or may not be hosted via the cloud computing model?
-==  #3: APPLICATION REQUIREMENTS ==
+==  APPLICATION REQUIREMENTS ==
 ; Environment
 : What frameworks and programming languages have been used to create the application?
@@ Line 89: / Line 89: @@
 : How many logical tiers group the application's components?
 : What staging, testing, and Quality Assurance requirements have been defined?
-== #4: Security Program Requirements ==
+== SECURITY PROGRAM REQUIREMENTS ==
 ; Operations
 : What is the process for identifying and addressing vulnerabilities in the application?