When information protection is approached as an afterthought, the enterprise's security design suffers, and is most often unable to withstand a sophisticated attack.
Security needs to be addressed by way of an architecture based on clearly defined requirements.
This architecture must address the nature of security services, where they should be placed within the enterprise's technical environment and how they should to be managed. Effective management also extends to the design and implementation of code on servers. Over the last years, CERT has released a number of vulnerability reports concerning cgi-bin, which can be vulnerable when input checks are not completed. Such a compromise usually leads to denial of service, unauthorized access to sensitive information, or modification of Web-server content. The sad comment is that in spite of the numerous warnings, CGI scripts frequently present an avenue for attack and compromise.