Information in This Chapter
• Book Overview and Key Learning Points
• Book Audience
• How This Book Is Organized
• Where to Go from Here
Pick your favorite cliche or metaphor you’ve heard regarding the Web. The aphorism might carry a generic description of Web security or generate a mental image of the threats and risks faced by and emanating from Web sites. This book attempts to cast a brighter light on the vagaries of Web security by tackling seven of the most, er, deadliest vulnerabilities that are exploited by attackers. Some of the attacks will sound very familiar. Other attacks may be unexpected, or seem uncommon simply because they aren’t on a top 10 list or don’t make headlines. Attackers often go for the lowest common denominator, which is why vulnerabilities such as cross-site scripting (XSS) and Structured Query Language (SQL) injection garner so much attention.
Determined attackers also target the logic of a particular Web site – exploits that result in significant financial gain but have neither universal applicability from the attacker’s perspective nor universal detection mechanisms for the defender.
On the Web, information equals money. Credit cards clearly have value to attackers; underground e-commerce sites have popped up that deal in stolen cards. Yet our personal information, passwords, e-mail accounts, online game accounts, all have value to the right buyer. Then consider economic espionage and state-sponsored network attacks.
It should be possible to map just about any scam, cheat, trick, ruse, and other synonyms from real-world conflict between people, companies, and countries to an attack that can be accomplished on the Web. There’s no lack of motivation for trying to gain illicit access to the wealth of information on the Web that isn’t intended to be public.
Anyone who uses the Web to check e-mail, shop, or work will benefit from knowing how the personal information on those sites might be compromised or even how familiar sites can harbor malicious content. Although most security relies on the site’s developers, consumers of Web applications can follow safe browsing practices to help protect their data.
Web application developers and security professionals will benefit from the technical details and methodology behind the Web attacks covered in this book. The first step to creating a more secure Web site is understanding the threats and risks of insecure code. Also, the chapters dive into countermeasures that can be applied to a site regardless of the programming language or technologies underpinning it.
Executive level management will benefit from understanding the threats to a Web site, and in many cases, how a simple attack – requiring nothing more than a Web browser – can severely impact a site. It should also illustrate that even though many attacks are simple to execute, good countermeasures require time and resources to implement properly. These points should provide strong arguments for allocating funding and resources to a site’s security to protect the wealth of information that Web sites manage.
This book assumes some basic familiarity with the Web. Web security attacks manipulate HTTP traffic to inject payloads or take advantage of deficiencies in the protocol. They also require understanding HTML to manipulate forms or inject code that puts the browser at the mercy of the attacker. This isn’t a prerequisite for understanding the broad strokes of an attack or learning how attackers compromise a site.
For example, it’s good to know that HTTP uses port 80 by default for unencrypted traffic and port 443 for traffic encrypted with the Secure Sockets Layer (SSL). Sites use the https:// to designate SSL connections. Additional details are necessary for developers and security professionals who wish to venture deeper into the methodology of attacks and defense.
Readers already familiar with basic Web concepts can skip the next two sections.