Core Defense Mechanisms - Security for a Site

[nvnhan282]

Handling User Access

• Authentication
  Session management
  Access control

Handling User Input

• Varieties of Input

Approaches to Input Handling

• “Reject Known Bad”
  “Accept Known Good”
  Sanitization
  Safe Data Handling
  Semantic Checks
  Boundary Validation
  Multistep Validation and Canonicalization

Handling Attackers

• Handling errors
  Maintaining audit logs
  Alerting administrators
  Reacting to attacks

Managing the Application

• Weaknesses in the authentication mechanism
  "do not implement effective access control of some of their administrative functions."