The Manager's Guide to Web Application Security : A Concise Guide to the Weaker Side of the Web / / by Ron Lepofsky

• Autore: Lepofsky Ron
• Pubblicazione: Berkeley, CA : , : Apress : , : Imprint : Apress, , 2014
• Edizione: 1st ed. 2014.
• Descrizione fisica: 1 online resource (221 p.)
• Disciplina: 005.8
• Soggetto topico: Computer programming; Data encryption (Computer science); Web Development; Cryptology
• Note generali: Includes index.; "Find, Fix, and Prevent Vulnerabilities in Web Applications"--Cover.
• Nota di contenuto: Contents at a Glance; Contents; About the Author; About the Technical Reviewer; Acknowledgments; Introduction; Chapter 1: Understanding IT Security Risks; Web Application Security Terminology; Risk Calculation Models; DREAD; How to Calculate Web Application Security Risk; Standard Calculations; A Customized Approach; Calculating a Security Risk; Calculating Risk from Multiple Vulnerabilities for Any Asset; Calculating the Monetary Value at Risk for Any Asset; Sources of Web Application Security Vulnerability Information; Summary; Chapter 2: Types of Web Application Security Testing ; Understanding the Testing ProcessWeb Application Audits; Vulnerability Assessment; Fully Automated Testing; Manual Testing; Combining Automated and Manual Testing; Penetration Testing; Postremediation Testing; Important Report Deliverables for All Testing Reports; Summary; Chapter 3: Web Application Vulnerabilities and the Damage They Can Cause; Lack of Sufficient Authentication; Weak Password Controls; Passwords Submitted Without Encryption; Username Harvesting; Weak Session Management; Weak SSL Ciphers Support; Information Submitted Using the GET Method ; Self-Signed Certificates, Insecure Keys, and PasswordsUsername Harvesting Applied to Forgotten Password Process; Autocomplete Enabled on Password Fields; Session IDs Nonrandom and Too Short; Weak Access Control; Frameable Response (Clickjacking); Cached HTTPS Response; Sensitive Information Disclosed in HTML Comments; HTTP Server Type and Version Number Disclosed; Insufficient Session Expiration; HTML Does Not Specify Charset; Session Fixation; Insecure Cookies; Cookies with No Secure Flag; Cookies Set to Expire in the Distant Future; Cookies with No HttpOnly Flag ; Cookies Created on the Client SideCookies Scoped to a Parent Domain; Weak Input Validation at the Application Level; Lack of Validated Input Allowing Automatic Script Execution; Unauthorized Access by Parameter Manipulation; Buffer Overflows; Forms Submitted Using the GET Method; Redirects and Forwards to Insecure Sites; Application Susceptible to Brute-Force Attacks; Client-Side Enforcement of Server-Side Security; Injection Flaws; SQL Injection; Blind SQL Injection; Link Injection; HTTP Header Injection Vulnerability; HTTP Response-Splitting Attack; Unauthorized View of Data ; Web Application Source Code DisclosureWeb Directories Enumerated; Active Directory Object Default Page on Server; Temporary Files Left in the Environment; Internal IP Address Revealed by Web Server; Server Path Disclosed; Hidden Directory Detected; Unencrypted VIEWSTATE; Obsolete Web Server; Query Parameter in SSL Request; Error Handling; Cross-Site Scripting Attacks; Reflected Cross-Site Scripting Attack; Stored Cross-Site Scripting Attack; Cross-Site Request Forgery Attack; Security Misconfigurations and Use of Known Vulnerable Components; Denial-of-Service Attack; Related Security Issues ; Storage of Data at Rest
• Sommario/riassunto: The Manager's Guide to Web Application Security is a concise, information-packed guide to application security risks every organization faces, written in plain language, with guidance on how to deal with those issues quickly and effectively. Often, security vulnerabilities are difficult to understand and quantify because they are the result of intricate programming deficiencies and highly technical issues. Author and noted industry expert Ron Lepofsky breaks down the technical barrier and identifies many real-world examples of security vulnerabilities commonly found by IT security auditors, translates them into business risks with identifiable consequences, and provides practical guidance about mitigating them. The Manager's Guide to Web Application Security describes how to fix and prevent these vulnerabilities in easy-to-understand discussions of vulnerability classes and their remediation. For easy reference, the information is also presented schematically in Excel spreadsheets available to readers for free download from the publisher’s digital annex. The book is current, concise, and to the point—which is to help managers cut through the technical jargon and make the business decisions required to find, fix, and prevent serious vulnerabilities.
• Titolo autorizzato: The Manager's Guide to Web Application Security
• ISBN: 1-4842-0148-5
• Formato: Materiale a stampa
• Livello bibliografico: Monografia
• Lingua di pubblicazione: Inglese
• Record Nr.: 9910300471003321
• Lo trovi qui: Univ. Federico II
• Serie: Expert's voice in security.