The World Wide Web has been an environment with many security threats and lots of reported cases of security
breaches. Various tools and techniques have been applied in trying to curb this problem, however new attacks continue
to plague the Internet. We discuss risks that affect web applications and explain how network-centric and host-centric
techniques, as much as they are crucial in an enterprise, lack necessary depth to comprehensively analyze overall appli-
cation security. The nature of web applications to span a number of servers introduces a new dimension of security re-
quirement that calls for a holistic approach to protect the information asset regardless of its physical or logical separa-
tion of modules and tiers. We therefore classify security mechanisms as either infrastructure-centric or application-cen-
tric based on what asset is being secured. We then describe requirements for such application-centric security mecha-
nisms.