Web Security, Privacy & Commerce, 2nd Edition

Chapter 1. The Web Security Landscape

This chapter looks at the basics of web security. We’ll discuss the risks of running a web server on the Internet and give you a framework for understanding how to mitigate those risks. We’ll look at the risks that the Web poses for users—people who simply want to use the Web to get information or participate in online communities. And we’ll look at the hype surrounding web security, analyze what companies (probably) mean when they use the phrase “secure web server,” and discuss overall strategies for reducing the risks associated with the World Wide Web.

The Web Security Problem

When we published the first edition of Practical Unix Security in 1991, we gave a simple definition of computer security:

A computer is secure if you can depend on it and its software to behave as you expect.

This definition has stood the test of time. Whether you are talking about a complex attack such as cross-site scripting, or you are discussing the age-old problem of password sharing, the fundamental goal of computer security is to minimize surprise and to have computers behave as we expect them to behave. Our definition puts forth a holistic approach to protecting computers and the information that they contain: a web site is as dead if it is compromised by an attacker as it is if the sole web server on which the site resides washes away in a flood. Web security, then, is a set of procedures, practices, and technologies for assuring the reliable, predictable operation ...