Web Security Common Sense

A qualified phper, must be to consider the security of the Web, and today simply summarize the common knowledge of the Web:

1. The nature of security issues is the question of trust

Three elements of security issues: confidentiality (confidentiality), completeness (Integrity), availability (availablity)

① confidentiality requires the protection of content can not be disclosed, encryption is a common means to achieve confidentiality requirements

② integrity requires that the data being protected is intact and not tampered with, and digital signatures are a common means of ensuring data integrity

③ availability requires the protection of resources is readily available, DoS (Denial of service attack) is destroyed by the availability of

2. Security assessment

Security assessment is divided into four phases, with causal relationships

① Asset class Division

② Threat Analysis

③ Risk Analysis

④ confirming the solution

3. The core of the Internet is driven by user data, the user generates business, the business generates data, and the core of the Internet security problem is the problem of data security.

4. Threat Analysis----STRIDE model (presented by Microsoft)

5. Risk Analysis----DREAD Model (presented by Microsoft)

6. Factors that affect the level of risk, in addition to the size of the loss, should also consider the possibility of occurrence

7. Safety Program Design Principles

①secure By default principle: This is the most basic and most important principle that can be understood as a black-and-white list of ideas, and if more of the use of white lists, will become more secure.

② least Privilege principle: this is another layer of security by default and is one of the basic principles of secure design. The principle of least privilege requires only the necessary permission of the principal, not over-authorization, which can effectively

Reduce the chance of system, network, application, database error.

③ Defense in Depth principle:

Defense in Depth (defense in depth) is also an important guideline for safety design

④ principle of non-predictability

Unpredictable performance effective against tampering-based, forged attacks

Web Security Common Sense