Top Ten Web security risks and Countermeasures

A1-cross site scripting (XSS)

1. on the page, convert the text input box, the value of the drop-down list, and some sensitive characters (for example, <> ).

2. Convert and filter some sensitive characters in the application_beginrequest event of Global. asax.

A2-injection flaws

1. See A1.

2. Do not directly use concatenated SQL statements. Use parameter-style SQL statements or stored procedures and set values for parameters.

A3-malicious File Execution

1. Upload of executable files such as EXE, DLL, JS, and vbs is prohibited

2. Set firewall and anti-virus software.

3. IIS executes Asp.net users to lower their permission to execute files.

A4-insecure direct object reference

When accessing data, add the access manual number in the SQL parameter, and calculate the permission based on the employee ID to limit the data accessed by the user.

A5-Cross Site Request Forgery (csrf)

1. Generate the random name hidden and random value, and then perform symmetric encryption verification when the client returns the data. Or, the viewstate exclusive to. NET is used for symmetric encryption verification.

2. Use JavaScript to encrypt sensitive data (such as passwords) before post, and then submit the data.

3. Reduce get transmission information.

A6-information leakage and improper error handling

1. Only a brief error prompt is displayed on the user page to avoid specific error messages, which are only recorded in server logs.

A7-broken authentication and session management

1. Use SSL links

2. Add an IP address to seesion for verification each time.

A8-insecure Cryptographic storage

1. Use more secure encryption algorithms AES, RSA and SHA-256.

2. You do not need to write the key explicitly in the program.

A9-insecure communications

Enable SSL connections in IIS to improve security

A10-failure to restrict URL access

Some important files, such as *. CS and *. config, cannot be downloaded. Set important files (such as header files) in the directory in IIS to not be downloaded.

Reference http://www.owasp.org/index.php/Top_10_2007