An integrated approach to web application development

Abstract

Software systems are prone to attack regardless of their deployment environment. Securing the applications that are part of these systems should be a first consideration of the architects. This paper discusses the dangers and costs of treating security as a post-deployment notion and proposes an integrated methodology that stresses the importance of designing in the security features of an application and of writing code that passes tests designed to ensure correct and focused functionality. This amalgamated methodology is meant to produce applications that minimal and secure across all trust boundaries.