assuringyourwebapplicationsecurity-全文預(yù)覽
【正文】 ed to and not what you don’t want it to do. ? Attack Vector Analysis – Analyze your applications and infrastructure for potential attacks ? Attack Detection and Prevention – Be aware of real time attacks and respond quickly Vulnerability Prevention ? User Input Validation – API – ESAPI, STRUTS ? Vetted API’s provide reasonable assurance of effectiveness. – Built In House ? Additional testing should be conducted with security. ? Use of Application Code Review software – Parameters for Input Validation ? Only allow what is necessary for input. Filter, Filter, Filter – Integer or text ? White list, don’t black list. ? Define the context and length – . 16 integers or valid first names ? Canonization – plain ASCII – no HTML input etc. Vulnerability Prevention ? Filter the data – Server side filtering not Host filtering – Check all your sources: GUI, Cookies, Files – Multiple validations are Okay! ? Encode your Output – Only return what is needed in the format needed. No HTML our to a Java output. No OS mands to HTML. Attack Vector Analysis ? Periodic
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號-1