Web Application Security assessment
There is no doubt that every business is integrating web applications or already done so to allow employees and customers to interact on daily basis. This can be an employee who is checking his or her emails or a customer placing an order thru a shopping cart application. The first problem is that we cannot distinguish between a normal user and a criminal one. The second problem, applications are written by humans therefore are susceptible to bugs and errors.
Most of the threats are errors while coding the application and wrong assumptions by the programmer how his application will be executed within the browser. Other threats are relay on patch management or system misconfiguration. As a reference we are using the Top 10 threats that were defined by the OWASP organization for 2010-2013:
Year 2017 Top 10
Year 2021 Top 10
A1:2017-Injection
A2:2017-Broken Authentication
A3:2017-Sensitive Data Exposure
A4:2017-XML External Entities (XXE)
A5:2017-Broken Access Control
A6:2017-Security Misconfiguration
A7:2017-Cross-Site Scripting (XSS)
A8:2017-Insecure Deserialization
A9:2017-Using Components with Known Vulnerabilities
A10:2017-Insufficient Logging & Monitoring
A1:2021-Broken Access Control
A2:2021-Sensitive Data Exposure
A3:2021-Injection
A4:2021-Insecure Design
A5:2021-Security Misconfiguration
A6:2021-Using Components with Known Vulnerabilities
A7:2021-Broken Authentication
A8:2021-Insecure Deserialization
A9:2021-Insufficient Logging & Monitoring
A10:2021-Server-Side Request Forgery (SSRF)
The Solution
2Secure has developed a solution that has three stages that can help and mitigate the threats:
- Preform risk assessments BEFORE & AFTER web application is in production
- Based on the results from the risk assessment, implement mitigating controls.
- Integrate safeguards during the Software Development Life Cycle (SDLC) BEFORE the application is published on the Internet or Intranet.
(Click to Download)
(Click to Download)
Ready to start conversation about your
web application security assessment needs?
Talk to us now.
