Seven Deadliest Web Application Attacks

Restricting Network Connections

Complex firewall rules are unnecessary for Web sites. Sites typically only require two ports for default HTTP and HTTPS connections, 80 and 443. The majority of attacks described in this book work over HTTP, effectively bypassing the restrictions enforced by a firewall. This doesn't completely negate the utility of a firewall; it just puts into perspective where the firewall would be most and least effective.

A rule sure to reduce certain threats is to block outbound connections initiated by servers. Web servers by design always expect incoming connections. Outbound connections, even domain name system (DNS) queries, are strong indicators of suspicious activity. Hacking techniques use DNS to exfiltrate data ...