[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572450-105":53,"doc-detail-572450-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","web-application-security-standards-and-practices-effective-date-january-2011","Web Application Security Standards and Practices - Effective Date January 2011","","Web Application Security Standards and Practices sets baseline security requirements for Columbia University-supported web services and websites, including third-party hosted Columbia-branded applications. It targets personnel responsible for developing and supporting these web systems, defining coding standards and industry-based practices to reduce security exploits caused by improper or nonstandard coding. The document also links core concepts to common vulnerability root causes and appropriate remediation, and requires adherence for all relevant development and support activities.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/web-application-security-standards-and-practices-effective-date-january-2011/572450/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/web-application-security-standards-and-practices-effective-date-january-2011/572450.png","ImageObject",442,249,{"name":88,"@type":89},"adawds","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the objective and scope of this web application security document?","Question",{"text":109,"@type":110},"It establishes baseline security-related requirements for all Columbia University-supported web services and websites, including third-party supported/hosted Columbia-branded applications. It applies to staff developing and supporting these web applications and sites.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"Who is the document intended for?",{"text":114,"@type":110},"Personnel responsible for developing and supporting Columbia University’s web applications, services, and websites. Developers and support teams must adhere to the standards and practices described.",{"name":116,"@type":107,"acceptedAnswer":117},"How does the document guide teams in selecting security controls?",{"text":118,"@type":110},"It recommends performing threat risk evaluation using CUIT-approved methodologies, specifically the OWASP Threat Risk Model process. It then determines needed control types using the CIAA approach (Confidentiality, Integrity, Availability, Accountability).","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572450,1792109136,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":20,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":47},3985747872983,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Web Application Security Standards and Practices  \nColumbia University  \nWeb Application Security Standards and Practices  \nObjective and Scope  \nEffective Date: January 2011  \nThis Web Application Security Standards and Practices document establishes a baseline of security related requirements for all Columbia University-supported web services and websites, including Columbia University-branded applications supported/hosted by 3rd parties.  \nThis document is intended for personnel responsible for developing and supporting Columbia University’s web applications, services, and websites. The purpose of this document is to provide coding standards, which are based on accepted industry practices, to minimize security exploits due to improper and nonstandard coding practices. It also provides references to information about common web security vulnerabilities to enhance understanding of the root causes of such issues and how to remediate them appropriately.  \nIf you are responsible for developing and supporting Columbia University’s web applications, services, and websites, you must adhere to the standards and practices established by this document.  \n1. INTRODUCTION ........................................................................................................ 2  \n2. THREAT RISK MODELING......................................................................................... 3  \n3. WEB SECURITY STANDARDS .................................................................................... 3  \n4. OWASP WEB APPLICATION SECURITY CHECKLIST ................................................ 9  \n5. OWASP TOP 10 APPLICATION SECURITY RISKS ..................................................... 9  \n6. SANS TOP 25 MOST DANGEROUS SOFTWARE ERRORS ......................................... 10  \n7. ADDITIONAL SECURITY BEST PRACTICES .............................................................. 11  \n8. REFERENCES .......................................................................................................... 13  \nPage 1 of 14 Web Application Security Standards and Practices  \nWeb Application Security Standards and Practices  \n1. Introduction  \nThe materials presented in this document are obtained from the Open Web Application Security Project (OWASP), the SANS (SysAdmin, Audit, Network, Security) Institute, and other recognized sources of industry best practices.  \nOWASP is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security.  \nSANS Institute was established as a cooperative research and education organization. Atthe heart of SANS are the many security practitioners in varied global organizations from corporations to universities working together to help the entire information security community.  \nThis document is divided into seven sections that cover the following topics:  \n\n| Section | Description |\n| --- | --- |\n| Threat Risk Modeling | Brief description of approved threat risk modeling methodologies to provide context for the application of web security standards described in the next section. |\n| Web Security Standards | Specifies coding standards and basic security practices that must be followed when developing and improving websites and web applications. |\n| OWASP Application Security Checklist | A checklist of key items to review and verify effectiveness. |\n| OWASP Top 10 Application Security Risks | Issues commonly identified as susceptible to exploitation using well-known techniques, and recommended remediation approaches. |\n| SANS Top 25 Most Dangerous Software Errors | Commonly exploited coding mistakes and recommended remediation approaches. |\n| Additional Security Best Practices | Supplemental security controls that may optionally be considered. |\n| References | Hyperlinks to materials referenced within this document ","cbCaihBqydzPYIT3","https://ap.wps.com/l/cbCaihBqydzPYIT3","pdf",81154,"English","# Objective and Scope\n# Introduction\n# Threat Risk Modeling\n# Web Security Standards\n# OWASP Web Application Security Checklist\n# OWASP Top 10 Application Security Risks\n# SANS Top 25 Most Dangerous Software Errors\n# Additional Security Best Practices\n# References","[{\"question\":\"What is the objective and scope of this web application security document?\",\"answer\":\"It establishes baseline security-related requirements for all Columbia University-supported web services and websites, including third-party supported/hosted Columbia-branded applications. It applies to staff developing and supporting these web applications and sites.\"},{\"question\":\"Who is the document intended for?\",\"answer\":\"Personnel responsible for developing and supporting Columbia University’s web applications, services, and websites. Developers and support teams must adhere to the standards and practices described.\"},{\"question\":\"How does the document guide teams in selecting security controls?\",\"answer\":\"It recommends performing threat risk evaluation using CUIT-approved methodologies, specifically the OWASP Threat Risk Model process. It then determines needed control types using the CIAA approach (Confidentiality, Integrity, Availability, Accountability).\"}]","Web Application Security Standards and Practices - Effective Date January 2011 | PDF",1791927442]