# Web 2.0 Security Part 5: Strategies to CUT RISK

**URL:** <https://community.f5.com/t/web-2-0-security-part-5-strategies-to-cut-risk/67094>\
**Category:** F5 Technical Articles\
**Tags:** applications, application-security, web-2.0, security, ajax, javascript, application, us\
**Created:** [July 23, 2007, 3:29pm UTC](https://community.f5.com/t/web-2-0-security-part-5-strategies-to-cut-risk/67094 "2007-07-23T15:29:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lori\_MacVittie](https://avatars.discourse-cdn.com/v4/letter/l/7feea3/32.png) [@Lori\_MacVittie](https://community.f5.com/u/Lori_MacVittie)\
**Post date:** [July 23, 2007, 3:29pm UTC](https://community.f5.com/t/web-2-0-security-part-5-strategies-to-cut-risk/67094/1 "2007-07-23T15:29:02Z")

</div>

Over the past few weeks we’ve examined the issues inherent with Web 2.0 and in particular AJAX-based applications. These issues need to be dealt with, but they should not be considered “show stoppers” to moving ahead with your Web 2.0 initiative. Consider the security ramifications of the design, implementation, and deployment of your new application carefully. Build security into your new application up front and you’ll certainly be able to decrease the potential risks associated with this growing technology.

Consider the following methods&nbsp;to **CUT** the **RISK** associated with deploying Web 2.0 applications:

> • **C** heck VA tools for AJAX support. Validate that the assessment and test tools you use to verify the security of your applications are capable of:
> 
> - Interpreting and evaluating dynamic URLs from JavaScript
> - Creating (or capturing at a minimum) requests in the appropriate markup languages
> - JSON, XML, D/HTML
> 
> • **U** nderstand the application. Document and examine regularly:
> 
> - Scripts associated with the application
> - Data sources accessed
> - Access patterns
> - Cookies used
> 
> • **T** rust no client. Implement policies that assumes the request is coming from an attacker
> 
> - Validate input
> - Validate request
> - Validate client
> 
> • **R** educe the number of scripts. If possible, reduce the number of scripts/applications to reduce the entry points through which attackers can gain entry/access to the application
> 
> • **I** nvest in a web application firewall. Web Application Firewalls mediate between client and server and provide:
> 
> - Application security through request verification
> - Client security through response verification
> - Not a panacea, but a first line of defense
> - Cannot stop logic layer attacks
> 
> • **S** ecure sensitive data using SSL.
> 
> - SSL for transport layer encryption
> - Cookie encryption
> 
> • **K** ick back suspicious data. Data Integrity should be validated on both request and response
> 
> - Stop sensitive data from leaving the organization
> - Stop malicious data and code from entering the organization
> - Choose from one or more options: code (custom), software, hardware

_Imbibing: Coffee_

Technorati tags: [F5](http://technorati.com/tags/F5), [MacVittie](http://technorati.com/tags/MacVittie), [Web 2.0](http://technorati.com/tags/Web%202.0), [security](http://technorati.com/tags/security), [AJAX](http://technorati.com/tags/AJAX), [application security](http://technorati.com/tags/application%20security), [javascript](http://technorati.com/tags/javascript)