View source for Web application security

{{Short description|Branch of information security that deals specifically with security of websites, web applications and web services}}
{{Information security}}
'''Web application security''' is a branch of [[Information security|information security]] that deals specifically with security of websites, [[Web application|web applications]] and web services. At a high level, web application security draws on the principles of [[Application security|application security]] but applies them specifically to [[Internet|internet]] and [[World Wide Web|web]] systems.<ref>{{cite web |url=https://msdn.microsoft.com/en-us/library/ff648636.aspx |title= Web Application Security Overview |date=2015-10-23}}</ref>

== Security threats ==

The majority of web application attacks occur through [[Cross-site scripting|cross-site scripting (XSS)]] and [[SQL injection]] attacks<ref>{{cite news | title= Testing and Comparing Web Vulnerability Scanning Tools for SQL Injection and XSS Attacks | publisher=Fonseca, J.; Vieira, M.; Madeira, H., Dependable Computing, IEEE |date= Dec 2007|url= https://ieeexplore.ieee.org/document/4459684 | doi=10.1109/PRDC.2007.55 }}</ref> which typically are made possible by flawed coding and failure to sanitize application inputs and outputs. These attacks are ranked in the 2009 [[Organization:Mitre Corporation|CWE]]/[[Organization:SANS Institute|SANS]] Top 25 Most Dangerous Programming Errors.<ref>{{cite news | title= CWE/SANS Top 25 Most Dangerous Programming Errors | publisher=CWE/SANS |date= May 2009|url= http://cwe.mitre.org/top25/}}</ref>

According to the security vendor Cenzic, the top vulnerabilities in March 2012 include:<ref>{{Cite web |url=https://info.cenzic.com/Trend-Report-Application-Security.html|title=2012 Trends Report: Application Security Risks|publisher=Cenzic, Inc.|date=11 March 2012|access-date=9 July 2012 }}</ref>

{| class="wikitable"
|-
| 37% || [[Cross-site scripting]]
|-
| 16% || [[SQL injection]]
|-
| 5% || Path disclosure
|-
| 5% || [[Denial-of-service attack]]
|-
| 4% || [[Arbitrary code execution]]
|-
| 4% || [[Memory corruption]]
|-
| 4% || [[Cross-site request forgery]]
|-
| 3% || [[Data breach]] (information disclosure)
|-
| 3% || Arbitrary [[File inclusion vulnerability|file inclusion]]
|-
| 2% || [[File inclusion vulnerability|Local file inclusion]]
|-
| 1% || [[File inclusion vulnerability|Remote file inclusion]]
|-
| 1% || [[Buffer overflow]]
|-
| 15% || Other, including [[Code injection|code injection]] (PHP/JavaScript), etc.
|}

The Open Web Application Security Project ([[Organization:OWASP|OWASP]]) provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2017 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations. From this data, approximately 2.3 million vulnerabilities were discovered across over 50,000 applications.<ref>{{Cite journal|last=Korolov|first=Maria|date=Apr 27, 2017|title=Latest OWASP Top 10 looks at APIs, web apps: The new OWASP Top 10 list is out, and while most of it remains the same, there are new additions focusing on web applications and APIs|journal=CSO|id={{ProQuest|1892694046}}}}</ref> According to the OWASP Top 10 - 2017, the ten most critical web application security risks include:<ref>{{Cite web|date=2017|title=OWASP Top 10 - 2017: The Ten Most Critical Web Application Security Risks|url=https://owasp.org/www-pdf-archive/OWASP_Top_10-2017_%28en%29.pdf.pdf|access-date=June 30, 2018|website=Open Web Application Security Project}}</ref>

# Injection
# Broken authentication
# Sensitive data exposure
# [[XML external entity attack|XML external entities (XXE)]]
# Broken access control
# Security misconfiguration
# Cross-site scripting (XSS)
# Insecure deserialization
# Using components with known vulnerabilities
# Insufficient logging and monitoring

== Best practices recommendation ==
Secure web application development should be enhanced by applying security checkpoints and techniques at early stages of development as well as throughout the [[Software development process|software development lifecycle]]. Special emphasis should be applied to the coding phase of development. Security mechanisms that should be used include, threat modeling, risk analysis, [[Finance:Static analysis|static analysis]], [[Digital signature|digital signature]], among others.<ref>{{Cite journal|title = Systematic review of web application security development model|journal = Artificial Intelligence Review|date = 2013-01-17|issn = 0269-2821|pages = 259–276|volume = 43|issue = 2|doi = 10.1007/s10462-012-9375-6|first1 = Bala Musa|last1 = Shuaibu|first2 = Norita Md|last2 = Norwawi|first3 = Mohd Hasan|last3 = Selamat|first4 = Abdulkareem|last4 = Al-Alwani|s2cid = 15221613}}</ref>

==Security standards==

OWASP is the emerging standards body for web application security. In particular they have published the OWASP Top 10,<ref>[https://owasp.org/www-project-top-ten/ OWASP Top 10]</ref> which describes in detail the major threats against web applications. The Web Application Security Consortium (WASC) has created the Web Hacking Incident Database (WHID) and also produced open source best practice documents on web application security. The WHID became an OWASP project in February 2014.<ref>{{cite web | title= WHID Project is now a Joint WASC/OWASP Project | publisher=WASC | date=18 February 2014 | url= http://lists.webappsec.org/pipermail/wasc-whid_lists.webappsec.org/2014-February/000100.html}}</ref>

==Security technology==

While security is fundamentally based on people and processes, there are a number of technical solutions to consider when designing, building and testing secure web applications. At a high level, these solutions include:

*[[Application security#Security testing for applications|Black box]] testing tools such as [[Web application security scanner]]s,<ref>{{cite news | title= Web Application Vulnerability Scanners | publisher=NIST |url= http://samate.nist.gov/index.php/Web_Application_Vulnerability_Scanners.html}}</ref> [[Vulnerability scanner|vulnerability scanner]]s and penetration testing<ref>{{Cite web|url=https://readdive.com/top-penetration-testing-companies-for-the-year-2019/|title=Top Penetration Testing Companies|date=2019-11-06}}</ref> software
*[[Application security#Security testing for applications|White box]] testing tools such as static source code analyzers<ref>{{cite news | title= Source Code Security Analyzers | publisher=NIST |url= http://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html}}</ref>
*Fuzzing,<ref>{{cite news | title= Fuzzing | publisher=OWASP |url=https://owasp.org/www-community/Fuzzing}}</ref> tools used for input testing 
*[[Web application security scanner]] (vulnerability scanner)
*[[Software:Web application firewall|Web application firewall]]s (WAF),<ref>{{cite news | title= Web application firewalls for security and regulatory compliance  | publisher=TestingXperts Blog |date=March 2017|url= https://www.testingxperts.com/blog/7-Crucial-Activities-to-Test-the-Security-of-your-Mobile-Applications/}}</ref> used to provide [[Firewall (computing)|firewall]]-type protection at the web application layer
*[[Password cracking]] tools for testing [[Password strength|password strength]] and implementation

==See also==
*[[Application service architecture]] (ASA)
*[[Electronic authentication]]
*[[Software:W3af|w3af]], a free open-source web application security scanner
*[[Web application security scanner]]
*[[Runtime application self-protection]]

==References==
<references/>

[[Category:Computer network security]]
[[Category:Web applications]]

{{Sourceattribution|Web application security|1}}