13

I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level of defense?

In order of importance for a web app, please label each layer, briefly define it, and then list one or more resources for further information.

Improve this question

4 Answers 4

Reset to default
6

The most important asset in the defense in depth paradigm is human intelligence: employing security savvy people responsible for continuous and persistent defense.

Tools change, web app frameworks change, new exploit techniques are discovered – things preluding building a strong human team to help defend.

Moving onto tactics, but still at high level:

secure coding (app layer) -> empowering teams to develop attacker-resilient applications -> OWASP

secure infrastructure -> empowering teams to deploy attacker-resilient servers and supporting equipment

http://cisecurity.org/ The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.

http://iase.disa.mil/stigs/checklist/ Defense Information Systems Agency (DISA)

http://web.nvd.nist.gov/view/ncp/repository
http://csrc.nist.gov/fdcc/faq-common_security_configurations.html
The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

capable incident detection and response -> empowering teams to detect, contain, respond, & fix

collection of incident response checklists: http://www.knowyourenemy.eu/checklists.php

Richard Bejtlich recently blogged:

"Resources for Building Incident Response Teams Recently a colleague asked me for resources for building incident response teams. I promised I would provide a few ideas [...]

The CERT.org CSIRT Development site is probably the best place to start. From there you can find free documents, links to classes offered by SEI on building CIRTs, and so on. I don't think you can beat that site!

I don't think the resources at the FIRST site are as helpful, but the process of working toward membership is a great exercise for a new CIRT.

My TaoSecurity books page lists several books which CIRTs will likely find helpful."

In the name of brevity, maybe the above suffices?

Improve this answer
1
  • I would add that within your application you are going to have multiple layers (UI, Business, Data) and multiple modules in each layer. Defense in Depth means that you enforce security on every module at every layer. It is not enough to validate inputs in your front end, you also validate them in your code-behind and in the (hopefully separate) data access layer. It is not enough to check the login in your login page, you have to understand how that identity gets passed from page request to page request in your framework, and how you can bolster and enforce the process. It is not enough...
    – AgapwIesu
    Feb 23, 2017 at 14:51
7

I think it's arguably more important to understand what 'defense in depth' does NOT mean. It does not mean 'a long laundry list of impressive sounding controls, such as firewalls and encryption algorithms'.

Defense in depth is a technology-neutral term that means that two or more independent controls should have to fail before a system is compromised. E.g. holding your trousers up with belt & braces & string:-)

The key point here is 'independent' - if all your controls have common failure modes, or if only one of them needs to fail before you've lost, then there is no 'defense in depth'. For example if each of your tiers is accessible from the previous one via HTTP, and they all have the same vulnerability, then the firewall/DMZ setup is effectively rendered irrelevant since the attacker can use the same vulnerability to own them all.

Improve this answer
4

Since you started off asking sepcifically about a web-app, i.e. from an application point of view, I will mostly focus on that. In order of layers from outside-in, here is a sampling:

  • Secure protocol (SSL/TLS)
  • firewall
  • DMZ
  • WAF
  • IDS/IPS
  • hardened OS
  • hardened Webserver
  • managed code with hardened framework
  • authentication
  • file access control (e.g. NTFS ACLs)
  • URL access control (e.g. ASP.NET's web config)
  • applicative access control
  • input validation
  • stored procedures
  • db parameter binding (e.g. ADO command/parameter objects) or ORM
  • hardened DB
  • strict permissions on DB objects
  • output encoding
  • etc.

Note that most of these are applicative in nature, and most of the network/OS items are architectural in nature...

Improve this answer
2

You're asking for a rather lengthy answer so I'll just take a little stab at it.

If we approach a web app from the user's perspective, then there's the:

  • Network layer (HTTP packets/physical wires/routers/ISPs)
    • See Wikipedia
  • Server software (aka IIS/httpd/etc)
    • It depends on what your server stack is (LAMP/.NET/etc.)
  • Your application code
    • Depends on what your application is made of
  • More that I won't go into.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .