How To: Perform a Security Design Inspection for Web Applications

From Guidance Share
Jump to navigationJump to search

- J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan


Summary

The architecture and design review process analyzes the architecture and design from a security perspective. If you have just completed the design, the design documentation can help you with this process. Regardless of how comprehensive your design documentation is, you must be able to decompose your application and be able to identify key items, including trust boundaries, data flow, entry points, and privileged code. You must also know the physical deployment configuration of your application. Pay attention to the design approaches you have adopted for those areas that most commonly exhibit vulnerabilities. This guide refers to these as application vulnerability categories.


Steps


  • Step 1. Analzye the deployment and infrastructure.
  • Step 2. Analyze the application architecture and design.
  • Step 3. Analzye tier by tier and layer by layer.


Step 1. Analzye the deployment and infrastructure.

You review the design of your application in relation to the target deployment environment and the associated security policies. You also consider the restrictions imposed by the underlying infrastructure-layer security. See Web Application Security Design Inspection Questions.


Step 2. Analyze the application architecture and design.

You review the approach to critical areas in your application, including authentication, authorization, input validation, exception management, and other areas. You can use the application vulnerability categories as a roadmap and to ensure that you do not miss any key areas during the review. See Web Application Security Design Inspection Questions.


Step 3. Analzye tier by tier and layer by layer.

You walk through the physical tiers and logical layers of your application. This means analyzing your Web server, application server and database server, as well as your presentation, business and data access layers. See Web Application Security Design Inspection Questions.

Related Items