Web Application Security assessment
There is no doubt that every business is integrating web applications or already done so to allow employees and customers to interact on daily basis. This can be an employee who is checking his or her emails or a customer placing an order thru a shopping cart application. The first problem is that we cannot distinguish between a normal user and a criminal one. The second problem, applications are written by humans therefore are susceptible to bugs and errors.
Most of the threats are errors while coding the application and wrong assumptions by the programmer how his application will be executed within the browser. Other threats are relay on patch management or system misconfiguration. As a reference we are using the Top 10 threats that were defined by the OWASP organization for 2010-2013:
Year 2017 Top 10
Year 2021 Top 10
A3:2017-Sensitive Data Exposure
A4:2017-XML External Entities (XXE)
A5:2017-Broken Access Control
A7:2017-Cross-Site Scripting (XSS)
A9:2017-Using Components with Known Vulnerabilities
A10:2017-Insufficient Logging & Monitoring
A1:2021-Broken Access Control
A2:2021-Sensitive Data Exposure
A6:2021-Using Components with Known Vulnerabilities
A9:2021-Insufficient Logging & Monitoring
A10:2021-Server-Side Request Forgery (SSRF)
2Secure has developed a solution that has three stages that can help and mitigate the threats:
- Preform risk assessments BEFORE & AFTER web application is in production
- Based on the results from the risk assessment, implement mitigating controls.
- Integrate safeguards during the Software Development Life Cycle (SDLC) BEFORE the application is published on the Internet or Intranet.
Ready to start conversation about your
web application security assessment needs?
Talk to us now.