April 24, 2002

roviding a service on the Web entails a wealth of concerns, from system design, network architecture, and application development, to maintenance and security. This last aspect is often overlooked and undervalued because proactive application, system, and network security offer little tangible return. Not until a Web service vulnerability causes loss

hen deploying a web server and web applications, you must defend against malicious attackers who can identify and exploit the vulnerabilities in these servers and apps. The nimda worm and its predecessors painfully reminded us of that. After all, robust firewall rules and strict router access control lists alone will