Web Application Security How to Minimize Prevalent Risk of Attacks
|
|
- Benedict Mitchell
- 8 years ago
- Views:
Transcription
1 guide: Web Application Security How to Minimize Prevalent Risk of Attacks Table of Contents I. Summary II. Primer on Web App Security III. Types of Web App Vulnerabilities IV. Detecting Web App Vulnerabilities V. QualysGuard WAS Automates Detection of Vulnerabilities IV. Protect Your Web Applications V. About Qualys
2 page 2 Summary Vulnerabilities in web applications are now the largest vector of enterprise security attacks. Last year, almost 55% of vulnerability disclosures affected web applications. 1 At year end, 74% of web application vulnerabilities had no available patch for remediation, according to that report. Stories about exploits that compromise sensitive data frequently mention culprits such as cross-site scripting, SQL injection, and buffer overflow. Vulnerabilities like these fall often outside the traditional expertise of network security managers. The relative obscurity of web application vulnerabilities thus makes them useful for attacks. As many organizations have discovered, these attacks will evade traditional enterprise network defenses unless you take new precautions. To help you understand how to minimize these risks, Qualys provides this guide as a primer to web application security. The guide surveys typical web application vulnerabilities, compares options for detection, and introduces the QualysGuard Web Application Scanning solution a new on demand service from Qualys that automates detection of the most prevalent vulnerabilities in custom web applications. Primer on Web Application Security Attacks on vulnerabilities in web applications began appearing almost from the beginning of the World Wide Web, in the mid-1990s. Attacks are usually based on fault injection, which exploits vulnerabilities in a web application s syntax and semantics. Using a standard browser and basic knowledge of HTTP and HTML, an attacker attempts a particular exploit by automatically varying a Uniform Resource Indicator (URI) link, which in turn could trigger an exploit such as SQL injection or cross-site scripting < SQL Injection < Cross-site Scripting (XSS) Some attacks attempt to alter logical workflow. Attackers also execute these by automatically varying a URI. < Increase privileges A significant number of attacks exploit vulnerabilities in syntax and semantics. You can discover many of these vulnerabilities with an automated scanning tool. Logical vulnerabilities are very difficult to test with a scanning tool; these require manual inspection of web application source code analysis and security testing. Web application security vulnerabilities usually stem from programming errors with a web application programming language (e.g., Java,.NET, PHP, Python, Perl, and Ruby), a code library, design pattern, or architecture. 1 IBM ISS X-Force 2008 Trend & Risk Report
3 page 3 These vulnerabilities can be complex and may occur under many circumstances. Using a web application firewall might control effects of some exploits but will not resolve the underlying vulnerabilities. Types of Web Application Vulnerabilities Web applications may have any of two dozen types of vulnerabilities. Security consultants who do penetration testing may focus on finding top vulnerabilities, such as those in a list published by the Open Web Application Security Project ( Other efforts to systematically organize web application vulnerabilities include six categories published by the Web Application Security Consortium ( The following descriptions of web vulnerabilities are modeled on the WASC schema. Authentication stealing user account identities n Brute Force attack automates a process of trial and error to guess a person s username, password, credit-card number or cryptographic key. Enterprise-class web application scanning solutions are broader, and should include a wide range of tests for major web application vulnerability classes, such as SQL injection, cross-site scripting, and directory traversals. The OWASP Top 10 is a good starting list of major vulnerabilities, but an enterprise class solution shouldn t limit itself to just one list or category of vulnerabilities. An enterprise solution should also be capable of scanning multiple applications, tracking results over time, providing robust reporting (especially compliance reports), and providing reports customized for local requirements. Building a Web Application Security Program Whitepaper Securosis.com n Insufficient Authentication permits an attacker to access sensitive content or functionality without proper authentication. n Weak Password Recovery Validation permits an attacker to illegally obtain, change or recover another user s password. Authorization illegal access to applications n Credential / Session Prediction is a method of hijacking or impersonating a user. n Insufficient Authorization permits access to sensitive content or functionality that should require more access control restrictions. n Insufficient Session Expiration permits an attacker to reuse old session credentials or session IDs for authorization. n Session Fixation attacks force a user s session ID to an explicit value.
4 page 4 Client-side Attacks illegal execution of foreign code n Content Spoofing tricks a user into believing that certain content appearing on a web site is legitimate and not from an external source. n Cross-site Scripting (XSS) forces a web site to echo attacker-supplied executable code, which loads into a user s browser. Command Execution hijacks control of web application n Buffer Overflow attacks alter the flow of an application by overwriting parts of memory. n Format String Attack alters the flow of an application by using string formatting library features to access other memory space. n LDAP Injection attacks exploit web sites by constructing LDAP statements from user-supplied input. n OS Commanding executes operating system commands on a web site by manipulating application input. n SQL Injection constructs illegal SQL statements on a web site application from user-supplied input. n SSI Injection (also called Server-side Include) sends code into a web application, which is later executed locally by the web server. n XPath Injection constructs XPath queries from user-supplied input. Information Disclosure shows sensitive data to attackers n Directory Indexing is an automatic directory listing / indexing web server function that shows all files in a requested directory if the normal base file is not present. n Information Leakage occurs when a web site reveals sensitive data such as developer comments or error messages, which may aid an attacker in exploiting the system. n Path Traversal forces access to files, directories and commands that potentially reside outside the web document root directory. n Predictable Resource Location uncovers hidden web site content and functionality.
5 page 5 Logical Attacks interfere with application usage n Abuse of Functionality uses a web site s own features and functionality to consume, defraud or circumvent access control mechanisms. n Denial of Service (DoS) attacks prevent a web site from serving normal user activity. n Insufficient Anti-automation is when a web site permits an attacker to automate a process that should only be performed manually. The number of vulnerabilities affecting Web applications has grown at a staggering rate. In 2008, vulnerabilities affecting Web server applications accounted for 54 percent of all vulnerability disclosures and were one of the primary factors in the overall growth of vulnerability disclosures during the year. IBM X-Force 2008 Trend & Risk Report n Insufficient Process Validation permits an attacker to bypass or circumvent the intended flow of an application. Detecting Web Application Vulnerabilities There is no silver bullet to detecting web application vulnerabilities. The strategy for their detection is identical to the multi-layer approach used for security on a network. Detection and remediation of some vulnerabilities requires source code analysis, particularly for complex enterprise-scale web applications. Detection of other vulnerabilities may also require on-site penetration testing. As mentioned earlier, the most prevalent web application vulnerabilities can also be detected with an automated scanner. An automated web application vulnerability scanner both supplements and complements manual forms of testing. It provides five key benefits: n Lowers total cost of operations by automating repeatable testing processes n Identifies vulnerabilities of syntax and semantics in custom web applications n Performs authenticated crawling n Profiles the target application n Ensures accuracy by effective reduction of false positives and false negatives A scanner does not have access to a web application s source code, so the only way it can detect vulnerabilities is by performing likely attacks on the target application. Time required for scanning varies, but doing a broad simulated attack on an application takes significantly longer than doing a network vulnerability scan against a single IP. A major requirement for a web application vulnerability scanner is comprehensive coverage of the target application s functionality. Incomplete coverage will cause the scanner to overlook existing vulnerabilities.
6 page 6 QualysGuard WAS Automatically Detects Major Web Application Vulnerabilities The QualysGuard Web Application Scanning (WAS) solution is an on demand service integrated into the QualysGuard security and compliance Security-as-a- Service (SaaS) suite. Use of the QualysGuard WAS presumes no specialized knowledge of web security. The service allows a network security or IT administrator to execute comprehensive, accurate vulnerability scans on custom web applications such as shopping carts, forms, login pages, and other types of dynamic content. The broad scope of coverage focuses tests on Web application security. Key Benefits. WAS automates repeatable techniques used to identify the most prevalent web vulnerabilities, such as SQL injection and cross-site scripting. It combines pattern recognition and observed behaviors to accurately identify and verify vulnerabilities. The WAS service identifies and profiles login forms, session state, error pages, and other customized features of the target application even if it extends across multiple web sites. This site profile data helps WAS to adapt to changes as the web application matures. Adaptability enables the scanner to be used against unknown or legacy web applications that may carry little information about error pages or other behavior. As a result, WAS delivers highly accurate detection and reduces false positives. The automated nature of Web Application Scanning enables regular testing that produces consistent results and easily scales for large numbers of web sites. Current Features. The table describes comprehensive capabilities in QualysGuard WAS to assess and track web application vulnerabilities. Qualys plans to add other features during Q2/Q Crawling & Link Discovery Authentication Black List White List Performance Tuning Sensitive Content Embedded web crawler parses HTML and some JavaScript to extract links. Automatically balances breadth and depth of discovered links to crawl up to 5,000 links per web application. HTTP Basic and NTLM server-based authentication. Simple form authentication. Prevents crawler from visiting certain links in a web application. Instructs the crawler to only visit links explicitly defined in this list. User-determined bandwidth level for parallel scanning to control impact on application performance. Enables user-specified expression search for content in HTML, such as a Social Security Numbers.
7 page 7 Reports such as the Web Application Scorecard provide big-picture and drill-down visibility on vulnerabilities for each web application Operations. QG WAS is delivered as an on demand service fully integrated with the QualysGuard solutions already in use by thousands of customers for vulnerability management and policy compliance. Users can manage web applications, launch scans, and generate reports with the familiar interface of the QualysGuard web interface. WAS scans may be pre-scheduled or executed on demand. The WAS service can be scaled to the largest web applications hosted anywhere in the world. Account rights management allows an organization to centrally control which web applications may be scanned by individual users. Finally, with QualysGuard WAS, at least one person in your organization must be responsible for managing remediation of vulnerabilities found in your web applications. Protect Your Web Applications The QualysGuard Web Application Scanning service will help your organization immediately begin identifying the most prevalent security vulnerabilities open to criminal exploit. The scanner will be a powerful supplement to existing security efforts such as source code analysis and penetration testing. The latter controls are necessary, but QualysGuard WAS will automate detection testing for the majority of threats the kinds you read about when data thieves breach confidential information via web applications. In addition to comprehensive testing and accurate detection, QualysGuard WAS is cost effective. Just like QualysGuard, WAS is an easy-to-use on demand service allowing administrators to execute scans without any special knowledge of web application security.
8 page 8 QualysGuard WAS trials are available now. General public release is scheduled for April If you would like a free trial of the QualysGuard WAS, please contact Qualys to get started. About Qualys Qualys, Inc. is the leading provider of on demand IT security risk and compliance management solutions delivered as a service. Qualys Software-as-a-Service solutions are deployed in a matter of hours anywhere in the world, providing customers an immediate and continuous view of their security and compliance postures. The QualysGuard service is used today by more than 3,500 organizations in 85 countries, including 40 of the Fortune Global 100 and performs more than 200 million IP audits per year. Qualys has the largest vulnerability management deployment in the world at a Fortune Global 50 company. Qualys has established strategic agreements with leading managed service providers and consulting organizations including BT, Etisalat, Fujitsu, IBM, I(TS)2, LAC, SecureWorks, Symantec, Tata Communications, TELUS and VeriSign. For more information, please visit USA Qualys, Inc Bridge Parkway, Redwood Shores, CA T: 1 (650) sales@qualys.com UK Qualys, Ltd. 224 Berwick Avenue, Slough, Berkshire, SL1 4QT T: +44 (0) Germany Qualys GmbH München Airport, Terminalstrasse Mitte 18, München T: +49 (0) France Qualys Technologies Maison de la Défense, 7 Place de la Défense, Courbevoie T: +33 (0) Japan Qualys Japan K.K. Pacific Century Place 8F, Marunouchi, Chiyoda-ku, Tokyo T: United Arab Emirates Qualys FZE P.O Box 10559, Ras Al Khaimah, United Arab Emirates T: China Qualys Hong Kong Ltd. Suite 1901, Tower B, TYG Center, C2 North Rd, East Third Ring Rd, Chaoyang District, Beijing T: Qualys, the Qualys logo and QualysGuard are registered trademarks of Qualys, Inc. All other trademarks are the property of their respective owners. 03/09
Using QUalysgUard to Meet sox CoMplianCe & it Control objectives
WHITE PAPER Using QualysGuard to Meet SOX Compliance & IT Objectives Using QualysGuard To Meet SOX Compliance and IT Objectives page 2 CobIT 4.0 is a significant improvement on the third release, making
More informationDelivering Security & Compliance On Demand
TECHNICAL BRIEF QualysGuard Policy Compliance Delivering Security & Compliance On Demand Table of Contents I. Executive Summary II. Introduction III. QualysGuard Policy Compliance: Architecture & Features
More informationLast update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
More informationHOW TO PASS AN IT AUDIT
GUIDE HOW TO PASS AN IT AUDIT As told by an enterprise end-user who deployed QualysGuard Policy Compliance Table of Contents I. Objective II. Migration Process III. Fostering Buy-In from IT Owners IV.
More informationAvoiding 7 Common Mistakes of IT Security Compliance
guide: Avoiding 7 Common Mistakes of IT Security Compliance Table of Contents I. Summary I. Decentralized Policy Management II. Failure to Define Compliance III. Tactical Instead of Strategic Response
More informationWeb Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
More informationThe Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
More informationThe Top 10 Reports for Managing Vulnerabilities
guide: The Top 10 Reports for Managing Vulnerabilities Top 10 Reports #1 Network Perimeter Map Report #2 Unknown Internal Devices Report #3 SANS Top 20 Vulnerabilities Report #4 25 Most Vulnerable Hosts
More informationWeb Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
More informationWeb App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
More informationWEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
More informationCriticial Need for Stronger Network Security. QualysGuard SaaS-based Vulnerability Management for Stronger Security and Verification of Compliance
GUIDE Strengthening Ne t wor k Securit y with On Demand Vulnerability Management and Policy Compliance Table of Contents Criticial Need for Stronger Network Security QualysGuard SaaS-based Vulnerability
More informationAttack Vector Detail Report Atlassian
Attack Vector Detail Report Atlassian Report As Of Tuesday, March 24, 2015 Prepared By Report Description Notes cdavies@atlassian.com The Attack Vector Details report provides details of vulnerability
More informationIntegrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
More informationI. Overview. II. Vulnerability Management Improves Security. III. Automating Vulnerability Workflow is Crucial
GUIDE Guide to Effective Remediation of Ne t wor k Vulnerabilities and Compliance Table of Contents I. Overview II. Vulnerability Management Improves Security 2 2 III. Automating Vulnerability Workflow
More informationWeb Application Security
About SensePost SensePost is an independent and objective organisation specialising in information security consulting, training, security assessment services and IT Vulnerability Management. SensePost
More informationWHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
More informationlocuz.com Professional Services Security Audit Services
locuz.com Professional Services Security Audit Services Today s Security Landscape Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System layer.
More informationWeb Security Testing Cookbook*
Web Security Testing Cookbook* Systematic Techniques to Find Problems Fast Paco Hope and Ben Walther O'REILLY' Beijing Cambridge Farnham Koln Sebastopol Tokyo Table of Contents Foreword Preface xiii xv
More informationExternal Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
More information2,000 Websites Later Which Web Programming Languages are Most Secure?
2,000 Websites Later Which Web Programming Languages are Most Secure? Jeremiah Grossman Founder & Chief Technology Officer 2010 WhiteHat Security, Inc. WhiteHat Security Founder & Chief Technology Officer
More informationOut of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development
More informationApplication Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
More informationWeb Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com
More informationWeb application security: automated scanning versus manual penetration testing.
Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 Contents
More informationQualysGuard WAS. Getting Started Guide Version 3.3. March 21, 2014
QualysGuard WAS Getting Started Guide Version 3.3 March 21, 2014 Copyright 2011-2014 by Qualys, Inc. All Rights Reserved. Qualys, the Qualys logo and QualysGuard are registered trademarks of Qualys, Inc.
More informationSix Essential Elements of Web Application Security. Cost Effective Strategies for Defending Your Business
6 Six Essential Elements of Web Application Security Cost Effective Strategies for Defending Your Business An Introduction to Defending Your Business Against Today s Most Common Cyber Attacks When web
More informationOptimizing Anti-Phishing Solutions Based on User Awareness, Education and the Use of the Latest Web Security Solutions
Informatica Economică vol. 14, no. 2/2010 27 Optimizing Anti-Phishing Solutions Based on User Awareness, Education and the Use of the Latest Web Security Solutions Ion LUNGU 1, Alexandru TĂBUŞCĂ 2 1 Academy
More informationIT Security & Compliance. On Time. On Budget. On Demand.
IT Security & Compliance On Time. On Budget. On Demand. IT Security & Compliance Delivered as a Service For businesses today, managing IT security risk and meeting compliance requirements is paramount
More informationFINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
More informationWhere every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
More informationColumbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
More informationWeb Security Threat Report: January April 2007. Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots
Web Security Threat Report: January April 2007 Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots What are we reporting? We are presenting real, live web attack data captured in-the-wild.
More informationDANNY ALLAN, STRATEGIC RESEARCH ANALYST. A whitepaper from Watchfire
WEB APPLICATION SECURITY: AUTOMATED SCANNING OR MANUAL PENETRATION TESTING? DANNY ALLAN, STRATEGIC RESEARCH ANALYST A whitepaper from Watchfire TABLE OF CONTENTS Introduction... 1 History... 1 Vulnerability
More informationFINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
More informationOWASP AND APPLICATION SECURITY
SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly
More information(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
More informationWeb Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
More informationRational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
More informationWhat is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
More informationApplication Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
More informationWeb application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
More informationAdobe ColdFusion. Secure Profile Web Application Penetration Test. July 31, 2014. Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661
Adobe ColdFusion Secure Profile Web Application Penetration Test July 31, 2014 Neohapsis 217 North Jefferson Street, Suite 200 Chicago, IL 60661 Chicago Dallas This document contains and constitutes the
More informationMatriXay WEB Application Vulnerability Scanner V 5.0. 1. Overview. (DAS- WEBScan ) - - - - - The best WEB application assessment tool
MatriXay DAS-WEBScan MatriXay WEB Application Vulnerability Scanner V 5.0 (DAS- WEBScan ) - - - - - The best WEB application assessment tool 1. Overview MatriXay DAS- Webscan is a specific application
More informationChapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
More informationPCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker www.quotium.com 1/14 Summary Abstract 3 PCI DSS Statistics 4 PCI DSS Application Security 5 How Seeker Helps You Achieve PCI DSS
More informationApplication Security: What Does it Take to Build and Test a Trusted App? John Dickson, CISSP Denim Group
Application Security: What Does it Take to Build and Test a Trusted App? John Dickson, CISSP Denim Group Overview What is Application Security? Examples of Potential Vulnerabilities Potential Strategies
More informationCross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
More informationAutomatic vs. Manual Code Analysis
Automatic vs. Manual Code Analysis 2009-11-17 Ari Kesäniemi Senior Security Architect Nixu Oy ari.kesaniemi@nixu.com Copyright The Foundation Permission is granted to copy, distribute and/or modify this
More informationIronBee Open Source Web Application Firewall
IronBee Open Source Web Application Firewall Building a universal web application firewall engine www.ironbee.com Introduction Qualys is announcing the development of IronBee, a new open source project
More informationWHITE PAPER FORTIWEB WEB APPLICATION FIREWALL. Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL Ensuring Compliance for PCI DSS 6.5 and 6.6 CONTENTS 04 04 06 08 11 12 13 Overview Payment Card Industry Data Security Standard PCI Compliance for Web Applications
More informationIBM Rational AppScan: Application security and risk management
IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM
More informationDFW INTERNATIONAL AIRPORT STANDARD OPERATING PROCEDURE (SOP)
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manage
More informationSAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
More informationQualysGuard WAS. Getting Started Guide Version 4.1. April 24, 2015
QualysGuard WAS Getting Started Guide Version 4.1 April 24, 2015 Copyright 2011-2015 by Qualys, Inc. All Rights Reserved. Qualys, the Qualys logo and QualysGuard are registered trademarks of Qualys, Inc.
More informationIBM Protocol Analysis Module
IBM Protocol Analysis Module The protection engine inside the IBM Security Intrusion Prevention System technologies. Highlights Stops threats before they impact your network and the assets on your network
More informationSecuring Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
More informationIntro. The Prevalence of Network Vulnerabilities. Recent Changes in Vulnerability Attacks. VM Controls the Removal of Vulnerabilities
WHITE PAPER The Need for Vulnerability Management Table of Contents Intro The Prevalence of Network Vulnerabilities Recent Changes in Vulnerability Attacks VM Controls the Removal of Vulnerabilities VM
More informationKASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
More informationCriteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
More informationelearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
More informationWHITE PAPER. FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FortiWeb Web Application Firewall Ensuring Compliance for PCI DSS 6.5 and 6.6 Ensuring compliance for PCI DSS 6.5 and 6.6 Page 2 Overview Web applications and the elements surrounding them
More informationApplication security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
More informationAutomating Security Testing. Mark Fallon Senior Release Manager Oracle
Automating Security Testing Mark Fallon Senior Release Manager Oracle Some Ground Rules There are no silver bullets You can not test security into a product Testing however, can help discover a large percentage
More informationNational Information Security Group The Top Web Application Hack Attacks. Danny Allan Director, Security Research
National Information Security Group The Top Web Application Hack Attacks Danny Allan Director, Security Research 1 Agenda Web Application Security Background What are the Top 10 Web Application Attacks?
More informationPenetration Testing Service. By Comsec Information Security Consulting
Penetration Testing Service By Consulting February, 2007 Background The number of hacking and intrusion incidents is increasing year by year as technology rolls out. Equally, there is no hiding place your
More informationNew IBM Security Scanning Software Protects Businesses From Hackers
New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications
More informationHow Web Application Security Can Prevent Malicious Attacks
Securing Enterprise Web Applications for Critical Data Protection and PCI-DSS Compliance Selecting the Right Technology is Essential in Guarding Against Malicious Attacks White_Paper As today s organizations
More informationExecutive Summary On IronWASP
Executive Summary On IronWASP CYBER SECURITY & PRIVACY FOUNDATION 1 Software Product: IronWASP Description of the Product: IronWASP (Iron Web application Advanced Security testing Platform) is an open
More informationCommon Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
More informationWINNING THE PCI COMPLIANCE BATTLE
WHITE PAPER WINNING THE PCI COMPLIANCE BATTLE A Guide for Merchants and Member Service Providers Table of Contents I. The Payment Card Industry Locks Down Customer Data II. Compliance Requirements of the
More informationApplication Security and the SDLC. Dan Cornell Denim Group, Ltd. www.denimgroup.com
Application Security and the SDLC Dan Cornell Denim Group, Ltd. www.denimgroup.com Overview Background What is Application Security and Why is It Important? Specific Reference Examples Integrating Security
More informationPentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security
More informationIntegrating Security Testing into Quality Control
Integrating Security Testing into Quality Control Executive Summary At a time when 82% of all application vulnerabilities are found in web applications 1, CIOs are looking for traditional and non-traditional
More informationSample Report. Security Test Plan. Prepared by Security Innovation
Sample Report Security Test Plan Prepared by Security Innovation Table of Contents 1.0 Executive Summary... 3 2.0 Introduction... 3 3.0 Strategy... 4 4.0 Deliverables... 4 5.0 Test Cases... 5 Automation...
More informationSENSITIVE AUSTRALIAN SPORTS COMMISSION ATHLETE MANAGEMENT SYSTEM (AMS) SMARTBASE SECURITY TEST PLAN. Final. Version 1.0
SENSITIVE AUSTRALIAN SPORTS COMMISSION ATHLETE MANAGEMENT SYSTEM (AMS) SMARTBASE SECURITY TEST PLAN Final Version 1.0 Preconditions This security testing plan is dependent on the following preconditions:
More informationHow to achieve PCI DSS Compliance with Checkmarx Source Code Analysis
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis Document Scope This document aims to assist organizations comply with PCI DSS 3 when it comes to Application Security best practices.
More informationBringing Continuous Security to the Global Enterprise
Bringing Continuous to the Global Enterprise Asset Discovery Network Web App Compliance Monitoring Threat Protection The Most Advanced Platform 3+ Billion IP Scans/Audits a Year 1+ Trillion Events The
More informationThe monsters under the bed are real... 2004 World Tour
Web Hacking LIVE! The monsters under the bed are real... 2004 World Tour Agenda Wichita ISSA August 6 th, 2004 The Application Security Dilemma How Bad is it, Really? Overview of Application Architectures
More informationETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110
More informationNE T GENERATION CLOUD SECURITY PLATFORM
Qualys Cloud Platform The Qualys Cloud Platform and integrated suite of solutions enable organizations to simplify the process and reduce the cost of identifying and securing their IT assets, while ensuring
More informationWeb Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
More informationHTTPParameter Pollution. ChrysostomosDaniel
HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider
More informationAdobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
More informationSECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
More informationRecon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins
Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins During initial stages of penetration testing it is essential to build a strong information foundation before you
More informationApplication Security Testing
Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the
More informationWhiteHat Security Sentinel Service
WhiteHat Security Sentinel Service User Guide Version 3.0 September 2010 Contents Preface... 4 Intended audience...4 How to use this guide...4 Administrators...4 Security Operators...4 Developers...4 Viewers...5
More informationPenetration Testing: Lessons from the Field
Penetration Testing: Lessons from the Field CORE SECURITY TECHNOLOGIES SCS SERVICES May 2009 1 Agenda: About me: Alberto Soliño Director of Security Consulting Services at Core Security One of first five
More informationEC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST.
CENTER FOR ADVANCED SECURITY TRAINING 619 Advanced SQLi Attacks and Countermeasures Make The Difference About Center of Advanced Security Training () The rapidly evolving information security landscape
More informationTesting the OWASP Top 10 Security Issues
Testing the OWASP Top 10 Security Issues Andy Tinkham & Zach Bergman, Magenic Technologies Contact Us 1600 Utica Avenue South, Suite 800 St. Louis Park, MN 55416 1 (877)-277-1044 info@magenic.com Who Are
More informationWeb Application Security. Radovan Gibala Senior Field Systems Engineer F5 Networks r.gibala@f5.com
Web Application Security Radovan Gibala Senior Field Systems Engineer F5 Networks r.gibala@f5.com Security s Gaping Hole 64% of the 10 million security incidents tracked targeted port 80. Information Week
More informationHow to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.
More informationWeb Vulnerability Scanner by Using HTTP Method
Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 4, Issue. 9, September 2015,
More informationWeb Application Attacks and Countermeasures: Case Studies from Financial Systems
Web Application Attacks and Countermeasures: Case Studies from Financial Systems Dr. Michael Liu, CISSP, Senior Application Security Consultant, HSBC Inc Overview Information Security Briefing Web Applications
More informationNSFOCUS Web Application Firewall White Paper
White Paper NSFOCUS Web Application Firewall White Paper By NSFOCUS White Paper - 2014 NSFOCUS NSFOCUS is the trademark of NSFOCUS Information Technology Co., Ltd. NSFOCUS enjoys all copyrights with respect
More informationNetwork Security Audit. Vulnerability Assessment (VA)
Network Security Audit Vulnerability Assessment (VA) Introduction Vulnerability Assessment is the systematic examination of an information system (IS) or product to determine the adequacy of security measures.
More informationPentests more than just using the proper tools
Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Security testing 3. Penetration testing Introduction Evaluation scheme Security Analyses of web applications
More information3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
More information