Revision as of 11:58, 18 May 2006

A Guide to Building Secure Web Applications and Web Services

2.1 (DRAFT 3) February 2006 OWASP Foundation

1 Frontispiece
2 Table of Contents

Frontispiece

Dedication

To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible. Andrew van der Stock

Copyright and license

© 2001 – 2006 OWASP Foundation. The Guide is licensed under the Free Documentation License, a copy of which is found in the Appendix. PERMISSION IS GRANTED TO COPY, DISTRIBUTE, AND/OR MODIFY THIS DOCUMENT PROVIDED THIS COPYRIGHT NOTICE AND ATTRIBUTION TO OWASP IS RETAINED.

Editors

The Guide has had several editors over various editions, all of whom have contributed immensely as authors, project managers, and editors over the lengthy period of the Guide’s gestation. Guide 2.x series editors:

Andrew van der Stock Adrian Wiesmann

Authors and Reviewers

The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x:

Abraham Kang Adrian Wiesmann Amit Klein Andrew van der Stock Brian Greidanus Christopher Todd Darrel Grundy Daniel Cornell David Endler Denis Pilipchuk Dennis Groves Derek Browne Eoin Keary Erik Lee Ernesto Arroyo Frank Lemmon Gene McKenna Hal Lockhart Izhar By-Gad Jeremy Poteet José Pedro Arroyo K.K. Mookhey Kevin McLaughlin Martin Eizner Michael Howard Michael Scovetta Mikael Simonsson Neal Krawetz Nigel Tranter Raoul Endres Ray Stirbei Richard Parke Robert Hansen Roy McNamara Steve Taylor Sverre Huseby Tim Smith William Hau

Revision History

Date Version Pages Notes July 26, 2005 2.0 Blackhat Edition 280 pages Andrew van der Stock, Guide Lead July 27, 2005 2.0.1 Blackhat Edition++ 293 pages Cryptography chapter review from Michael Howard incorporated September 12, 2005 2.1 DRAFT 1 X pages Changes from many sources New SQA chapter from Frank Lemmon January 2006 2.1 DRAFT 2 X pages Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell February 2006 2.1 DRAFT 3 X pages Ajax chapter Many chapters back from reviewers

Date	Version	Pages	Notes
July 26, 2005	2.0 Blackhat Edition	280 pages	Andrew van der Stock, Guide Lead
July 27, 2005	2.0.1 Blackhat Edition++	293 pages	Cryptography chapter review from Michael Howard incorporated
September 12, 2005	2.1 DRAFT 1	X pages	Changes from many sources New SQA chapter from Frank Lemmon
January 2006	2.1 DRAFT 2	X pages	Changes from Bill Pollock New chapters from Erick Lee New revisions from Dan Cornell
February 2006	2.1 DRAFT 3	X pages	Ajax chapter Many chapters back from reviewers

@@ Line 1: / Line 1: @@
-A Guide to Building Secure Web Applications and
+A Guide to Building Secure Web Applications and Web Services
-Web Services
-.1 	(DRAFT 3)
+.1 (DRAFT 3)
 February 2006
-A Guide to Building Secure Web Applications and
-Web Services
-.1 	(DRAFT 3)
-February 2006
 OWASP Foundation
@@ Line 110: / Line 98: @@
-===============Table of Contents ===============
+=Table of Contents =
 '''1'''	'''ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT	13'''
 ===1.1	Structure and Licensing	13 ===

Difference between revisions of "Guide:Frontispiece"

Revision as of 11:58, 18 May 2006

Frontispiece

Dedication

Copyright and license

Editors

Authors and Reviewers

Revision History

Table of Contents

1.1 Structure and Licensing 13

1.2 Participation and Membership 13

1.3 Projects 14

2.1 Developing Secure Applications 15

2.2 Improvements in this edition 15

2.3 How to use this Guide 16

2.4 Updates and errata 16

2.5 With thanks 16

3.1 Technologies 18

3.2 First generation – CGI 18

3.3 Filters 18

3.4 Scripting 19

3.5 Web application frameworks – J2EE and ASP.NET 20

3.6 Small to medium scale applications 21

3.7 Large scale applications 22

3.8 View 22

3.9 Controller 22

3.10 Model 23

3.11 Conclusion 24

4.1 Organizational commitment to security 25

4.2 OWASP’s Place at the Framework table 26

4.3 Development Methodology 28

4.4 Coding Standards 29

4.5 Source Code Control 29

4.6 Summary 30

5.1 Asset Classification 31

5.2 About attackers 31

5.3 Core pillars of information security 32

5.4 Security Architecture 32

5.5 Security Principles 33

6.1 Threat Risk Modeling 37

6.2 Performing threat risk modeling using the Microsoft Threat Modeling Process 37

6.3 Alternative Threat Modeling Systems 44

6.4 Trike 44

6.5 AS/NZS 4360:2004 Risk Management 44

6.6 CVSS 45

6.7 OCTAVE 46

6.8 Conclusion 47

6.9 Further Reading 47

7.1 Objectives 49

7.2 Compliance and Laws 49

7.3 PCI Compliance 49

7.4 Handling Credit Cards 50

7.5 Further Reading 53

8.1 What is phishing? 55

8.2 User Education 56

8.3 Make it easy for your users to report scams 57

8.4 Communicating with customers via e-mail 57

8.5 Never ask your customers for their secrets 58

8.6 Fix all your XSS issues 58

8.7 Do not use pop-ups 59

8.8 Don’t be framed 59

8.9 Move your application one link away from your front page 59

8.10 Enforce local referrers for images and other resources 59

8.11 Keep the address bar, use SSL, do not use IP addresses 60

8.12 Don’t be the source of identity theft 60

8.13 Implement safe-guards within your application 61

8.14 Monitor unusual account activity 61

8.15 Get the phishing target servers offline pronto 62

8.16 Take control of the fraudulent domain name 62

8.17 Work with law enforcement 63

8.18 When an attack happens 63

8.19 Further Reading 63

Securing Web Services 64

Communication security 65

Passing credentials 65

Ensuring message freshness 66

Protecting message integrity 66

Protecting message confidentiality 67

Access control 67

Audit 68