Web application security is a branch of Information Security that deals
specifically with security of websites, web applications and web services. At a
high level, Web application security draws on the principles of application
security but applies them specifically to Internet and Web systems.
Security threats With the emergence of Web 2.0, increased
information sharing through social networking and increasing business
adoption of the Web as a means of doing business and delivering service,
websites are often attacked directly. Hackers either seek to compromise the
corporate network or the end-users accessing the website by subjecting them
to drive-by downloading. As a result, industry is paying
increased attention to the security of the web applications themselves in
addition to the security of the underlying computer network and
operating systems. The majority of web application attacks
occur through cross-site scripting and SQL injection attacks which typically
result from flawed coding, and failure to sanitize input to and output from the
web application. These are ranked in the 2009 CWE/SANS Top 25 Most Dangerous
Programming Errors. Phishing is another common threat to the
Web application and global losses from this type of attack in 2012 were
estimated at $1.5 billion. According the security vendor Cenzic,
the top vulnerabilities in March 2012 include:
Best Practices Recommendation Secure web application development
should be enhanced by applying security checkpoints and techniques at early
stages of development as well as throughout the software development
lifecycle. Special emphasis should be applied to the coding phase of
development. Security mechanisms that should be used include, threat modeling,
risk analysis, static analysis, digital signature, among others.
Security standards OWASP is the emerging standards body for
Web application security. In particular they have published the OWASP Top 10
which describes in detail the major threats against web applications. The
Web Application Security Consortium has created the Web Hacking Incident
Database and also produced open source best practice documents on Web
application security. Security technology
While security is fundamentally based on people and processes, there are a number
of technical solutions to consider when designing, building and testing secure
web applications. At a high level, these solutions include:
Black box testing tools such as Web application security scanners,
vulnerability scanners and penetration testing software
White box testing tools such as static source code analyzers
Fuzzing Tools used for input testing Web application security scanner
Web application firewalls used to provide firewall-type protection at the
web application layer Password cracking tools for testing
password strength and implementation See also
Application service architecture w3af a free open-source web application
security scanner OWASP Open Web Application Security
Project Web application security scanner
References ^ "The Ghost in the Browser". Niels
Provos et al. May 2007. ^ "All Your iFrames Point to Us". Niels
Provos et al. February 2008. ^ "Improving Web Application Security:
Threats and Countermeasures". Microsoft Corporation. June 2003.
^ "Microsoft fortifies IE8 against new XSS exploits". Dan Goodin, The Register.
February 2009. ^ "Testing and Comparing Web
Vulnerability Scanning Tools for SQL Injection and XSS Attacks". Fonseca, J.;
Vieira, M.; Madeira, H., Dependable Computing, IEEE. Dec 2007.
^ "CWE/SANS Top 25 Most Dangerous Programming Errors". CWE/SANS. May 2009.
^ "2012 Global Losses From Phishing Estimated At $1.5 Bn". FirstPost.
February 20, 2013. Retrieved December 21, 2014.
^ "2012 Trends Report: Application Security Risks". Cenzic, Inc. 11 March
2012. Retrieved 9 July 2012. ^ Shuaibu, Bala Musa; Norwawi, Norita
Md; Selamat, Mohd Hasan; Al-Alwani, Abdulkareem. "Systematic review of web
application security development model". Artificial Intelligence Review 43:
259–276. doi:10.1007/s10462-012-9375-6. ISSN 0269-2821.
^ "The Web Hacking Incidents Database". WASC. January 2010.
^ "Web Application Vulnerability Scanners". NIST.
^ "Source Code Security Analyzers". NIST.
^ "Fuzzing". OWASP. ^ "Web application firewalls for
security and regulatory compliance". Secure Computing Magazine. February
2008.