Develop safer Asp.net Application 1

OWASP top 10

Open source Web Application Security projecct

The popularity of web applications and their security problems affect the development of the entire industry. This not only makes Web security the core focus, but also forms an Open Source methodology and white paper, and the entire ecosystem composed of attack and defense tools.

1 illegal Input

Web applications do not validate information before using information from Web requests. Attackers can exploit these disadvantages to attack background components through web applications.

2 invalid access control

There are no restrictions on authorized user behavior. Attackers can use these disadvantages to access other accounts and view sensitive files.

3. Invalid verification and session management

Account certificates and session tokens are not properly protected. Attackers can steal passwords, keys, session cookies, or other tokens to invalidate authentication restrictions and then allow other users' identities.

4. Cross-Site Scripting

Web applications can be used as platforms for transmitting attack information to end users' browsers.

5. cache Overflow

In some languages, web application components that do not thoroughly verify the input can destroy processes, and in some cases even implement process control.

6 injection attacks

When a web application accesses an external system or a local operating system, parameters are passed. If attackers can place malicious commands in these parameters, the external system may execute those commands for Web applications.

7. Exception Handling

An error occurs when the regular operation is not fully processed. If attackers can cause web applications to not handle errors, they will be able to obtain detailed system information, reject services, cause security mechanisms to fail, or destroy servers.

8 insecure storage

Web applications usually use encryption to protect information and certificates. Integrating these functions with code can protect the result of a lack of protection.

9. Application Denial of Service

Attackers can consume a large amount of Web application resources until other legal users cannot access or use the application. Attackers can also lock User Account logon and even destroy the entire application.

10 insecure Configuration Management

Effective server configuration standards are the guarantee for Secure Web applications.

 

General principles:

1. Security is a feature

2. Minimum Permissions

3. prediction, monitoring and response

4 layered defense

5. No trusted input exists.

6. Pay attention to the fault mode.

7. The application rejects the Server Load balancer instance.

8. Default Security Measures preferred

9 encryption cannot ensure security

10 firewall cannot ensure security