Web application security

Web application security is a branch of information security that deals specifically with security of websites and web applications.

At a high level, Web application security draws on the principles of application security but applies them specifically to Internet and Web systems. Typically web applications are developed using programming languages such as PHP, Java EE, Java, Python, Ruby, ASP.NET, C#, VB.NET or Classic ASP.

Security threats

With the emergence of Web 2.0, increased information sharing through social networking and increasing business adoption of the Web as a means of doing business and delivering service, websites are often attacked directly. Hackers either seek to compromise the corporate network or the end-users accessing the website by subjecting them to drive-by downloading^[1][2].

As a result, industry^[3] is paying increased attention to the security of the web applications^[4] themselves in addition to the security of the underlying computer network and operating systems.

The majority of web application attacks occur through cross-site scripting (XSS) and SQL injection attacks^[5] which typically result from flawed coding, and failure to sanitize input to and output from the web application. These are ranked in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors^[6].

Security standards

OWASP is the emerging standards body for Web application security. In particular they have published the OWASP Top 10 which describes in detail the major threats against web applications. The Web Application Security Consortium (WASC) has created the Web Hacking Incident Database^[7] and also produced open source best practice documents on Web application security.

Security technology

While security is fundamentally based on people and processes, there are a number of technical solutions to consider when designing, building and testing secure web applications. At a high level, these solutions include:

• Black Box testing tools such as web application scanners^[8], vulnerability scanners and penetration testing software
• White Box testing tools such as static source code analyzers^[9]
• Fuzzing^[10] Tools used for input testing
• Web application firewalls (WAF)^[11] used to provide firewall-type protection at the web application layer
• Password cracking tools for testing password strength and implementation

See also

• Application service architecture (ASA)
• w3af a free open-source web application security scanner

References

1. ^ "The Ghost in the Browser". Niels Provos et al. May 2007. http://www.usenix.org/events/hotbots07/tech/full_papers/provos/provos.pdf. 
2. ^ "All Your iFrames Point to Us". Niels Provos et al. February 2008. http://research.google.com/archive/provos-2008a.pdf. 
3. ^ "Improving Web Application Security: Threats and Countermeasures". Microsoft Corporation. June 2003. http://msdn.microsoft.com/en-us/library/ms994921.aspx. 
4. ^ "Microsoft fortifies IE8 against new XSS exploits". Dan Goodin, The Register. February 2009. http://www.theregister.co.uk/2009/02/02/ie8_xss_filter_improvements/. 
5. ^ "Testing and Comparing Web Vulnerability Scanning Tools for SQL Injection and XSS Attacks". Fonseca, J.; Vieira, M.; Madeira, H., Dependable Computing, IEEE. Dec 2007. http://ieeexplore.ieee.org/Xplore/login.jsp?url=http%3A%2F%2Fieeexplore.ieee.org%2Fiel5%2F4459624%2F4459625%2F04459684.pdf%3Farnumber%3D4459684&authDecision=-203. 
6. ^ "CWE/SANS Top 25 Most Dangerous Programming Errors". CWE/SANS. May 2009. http://cwe.mitre.org/top25/. 
7. ^ "The Web Hacking Incidents Database". WASC. January 2010. http://projects.webappsec.org/Web-Hacking-Incident-Database. 
8. ^ "Web Application Vulnerability Scanners". NIST. http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners.html. 
9. ^ "Source Code Security Analyzers". NIST. http://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html. 
10. ^ "Fuzzing". OWASP. http://www.owasp.org/index.php/Fuzzing. 
11. ^ "Web application firewalls for security and regulatory compliance". Secure Computing Magazine. February 2008. http://www.scmagazineus.com/Hot-or-not-Web-application-firewalls-for-security-and-regulatory-compliance/article/113146/.