Page 1 of 2

SECURITY ARCHITECTURE CHEAT SHEETFOR INTERNET APPLICATIONSThis cheat sheet offers tips for the initial design andreview of an application’s security architecture.

#1: BUSINESS REQUIREMENTS
Business Model

Which third‐parties process the application’s data?
What mechanisms are used to share data with third‐
parties besides the application itself?
What security requirements do the partners impose?

Administrators

What network and system security monitoring
requirements have been defined?

Virtualization and Externalization
What aspects of the application lend themselves tovirtualization?

Who has administrative capabilities in theapplication?

What virtualization requirements have been definedfor the application?

How will the application make money?

What administrative capabilities does the application
offer?

What aspects of the product may or may not be
hosted via the cloud computing model?

What are the planned business milestones fordeveloping or improving the application?

Regulations

How is the application marketed?

#3: APPLICATION REQUIREMENTS
Environment

What security‐related regulations apply?

What key benefits does the application offer users?

What auditing and compliance regulations apply?

What is the application’s primary business purpose?

What business continuity provisions have been
defined for the application?
What geographic areas does the application service?

Data Essentials
What data does the application receive, produce,and process?

In what industries does the application operate?

#2: INRASTRUCTURE REQUIREMENTS
Network
What details regarding routing, switching,firewalling, and load‐balancing have been defined?
What network design supports the application?

What frameworks and programming languages havebeen used to create the application?
What process, code, or infrastructure dependencies
have been defined for the application?
What databases and application servers support theapplication?

Data Processing
What data entry paths does the application support?

How can the data be classified into categories
according to its sensitivity?

What core network devices support the application?
What network performance requirements exist?

What data output paths does the application
support?

How might an attacker benefit from capturing ormodifying the data?

What private and public network links support theapplication?

How does data flow across the application’s internalcomponents?

What data backup and retention requirements havebeen defined for the application?

Systems
What operating systems support the application?

What data input validation requirements have beendefined?

End‐Users

What hardware requirements have been defined?

What data does the application store and how?

Who are the application’s end‐users?
How do the end‐users interact with the application?

What details regarding required OS components andlock‐down needs have been defined?

What data is or may need to be encrypted and what
key management requirements have been defined?

What security expectations do the end‐users have?

Infrastructure Monitoring

Partners

What capabilities exist to detect the leakage ofsensitive data?

Which third‐parties supply data to the application?

What network and system performance monitoring
requirements have been defined?

Which third‐parties receive data from theapplications?

What mechanisms exist to detect malicious code orcompromised application components?

What encryption requirements have been definedfor data in transit over WAN and LAN links?

Authored by Lenny Zeltser, who leads the security consulting practice at Savvis and teaches at SANS Institute. You can find him on Twitter. Special thanks to Slava Frid for feedback. Page 1 of 2.
Creative Commons v3 “Attribution” License for this cheat sheet version 1.2. See Lenny’s other cheat sheets.

Page 2 of 2

AccessWhat user privilege levels does the application
support?
What user identification and authentication
requirements have been defined?
What user authorization requirements have beendefined?
What session management requirements have beendefined?
What access requirements have been defined for URIand Service calls?

What staging, testing, and Quality Assurance
requirements have been defined?

What secure coding processes have been
established?

#4: SECURITY PROGRAM REQUIREMENTS
Operations

Corporate

What is the process for identifying and addressing
vulnerabilities in the application?
What is the process for identifying and addressing
vulnerabilities in network and system components?
What access to system and network administrators
have to the application’s sensitive data?

What user access restrictions have been defined?

What security incident requirements have beendefined?

How are user identities maintained throughout
transaction calls?

How do administrators access production
infrastructure to manage it?

Application Monitoring

What physical controls restrict access to theapplication’s components and data?

What application auditing requirements have beendefined?
What application performance monitoring
requirements have been defined?

What is the process for granting access to theenvironment hosting the application?

Change Management

What application security monitoring requirements
have been defined?

How are changes to the code controlled?

What application error handling and logging
requirements have been defined?

How is code deployed to production?

How are changes to the infrastructure controlled?

How are audit and debug logs accessed, stored, andsecured?

What mechanisms exist to detect violations ofchange management practices?

Application Design

Software Development

What application design review practices have been
defined and executed?
How is intermediate or in‐process data stored in theapplication components’ memory and in cache?
How many logical tiers group the application'scomponents?

What data is available to developers for testing?
How do developers assist with troubleshooting anddebugging the application?
What requirements have been defined forcontrolling access to the applications source code?

What corporate security program requirements havebeen defined?
What security training do developers andadministrators undergo?
Which personnel oversees security processes andrequirements related to the application?
What employee initiation and termination
procedures have been defined?
What application requirements impose the need toenforce the principle of separation of duties?
What controls exist to protect a compromised in thecorporate environment from affecting production?
What security governance requirements have beendefined?

Additional Resources
OWASP Guide to Building Secure Web Applications
http://www.owasp.org/index.php/OWASP_Guide...
ISO 27002 Standard: Code of Practice
http://www.iso.org/iso/catalogue...
BITS Standards for Vendor Assessments
http://www.sharedassessments.org/download...
Guidance for Critical Areas ... in Cloud Computing
http://www.cloudsecurityalliance.org/guidance...
Payment Card Industry (PCI) Data Security Standard
https://www.pcisecuritystandards.org/security...
How to Write an Information Security Policy
http://www.csoonline.com/article/print/495017
IT Infrastructure Threat Modeling Guide
http://www.microsoft.com/downloads...

Authored by Lenny Zeltser, who leads the security consulting practice at Savvis and teaches at SANS Institute. You can find him on Twitter. Special thanks to Slava Frid for feedback. Page 2 of 2.
Creative Commons v3 “Attribution” License for this cheat sheet version 1.1. See Lenny’s other cheat sheets.