Be Prepared! Common Web Application Security Vulnerabilities

The number of businesses operating in the cloud grows every day. Consumer demand for 24/7 access to any data is pushing organizations to make this data available via web applications, online banking and e-stores. Attackers find in this opening a new opportunity to get hold of and maliciously use sensitive information, such as credit card data.

Companies looking to improve the security of their websites and applications apply web application security practices and tools. In this article, you’ll learn what is web application security, what are the most common web app vulnerabilities, and best practices to protect your web applications.

What Is Web Application Security?

Web application security is a branch of information security that specializes in the security of websites, web applications and web services. Given the growing need for security solutions and resources, several initiatives were taken by developers and organizations.

In 2001, was founded the Open Web Security Project (OWASP) is a non-profit organization with the goal to improve the security of software and web applications. The organization gathers information from several security organizations and compiles a list of the top web security vulnerabilities called OWASP Top Ten. They released the OWASP Dependency-Check, a free software composition analysis tool that identifies project dependencies and checks if they have any known vulnerabilities.

The Most Common Web App Security Vulnerabilities

Web application vulnerabilities can result from human error or improperly applied security measures, such as a lack of proper input/output protection. Attackers can use a range of methods to manipulate a database or disrupt an entire network. The OWASP prioritizes the vulnerabilities according to:

• Exploitability—How exploitable is the vulnerability? When the attacker can disrupt the system with the less complex programming and tools we talk about high exploitability.
• Detectability—defines how easy is to detect a threat.
• Impact—the amount of damage that can be done if the vulnerability is exploited. Attackers can exploit vulnerabilities using different methods including:
• SQL Injection—an attacker can expose the back-end database by making a web application execute a database SQL command. You can prevent this by avoiding detailed error messages, which can be useful to an attacker.
• Cross Site Scripting—also known as XSS. Attackers use XSS to execute scripts on the victim’s browser. When the application can take untrusted data and send it to the web browser, there is a vulnerability open for an attacker to hijack session cookies, deface websites or run malware on the victim’s machines. Can be prevented
• Broken Authentication and Session Management—when a user ends a session and the cookies are not invalidated, the sensitive data remains in the system. An attacker can use the same system, opening the previous session by stealing sensitive data. You can prevent these threats by defining the authentication and session management requirements according to the OWASP Application Security Verification Standard.
• Insecure Direct Object Reference—an attacker uses an exposed reference to an internal implementation object, (a file or a database key, for example) to access other objects as a bridge to reach unauthorized data. You can avoid such breaches by implementing access control checks.
• Security Misconfiguration—when the security configuration is not defined and deployed for all parts of the network, attackers can gain access to sensitive data and compromise the confidentiality of the data or the functionality of the system. Maintaining a strong application architecture and updated software can help secure the system. Another good practice is to disable directory listings and implementing access control checks.
• Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks—attackers overload a targeted server with large volumes of traffic, which saturates the bandwidth. The server, thus, cannot effectively process incoming requests, slowing processes and eventually denying services to incoming requests. This can be prevented by testing for anti-automation, account lockout, HTTP protocol DoS and DDoS attacks.
• Buffer overflow—attackers write malicious code to a buffer with the intention to overrun its boundaries and cause adjacent memory locations to be overwritten with data. This can result in memory malfunctions or crashes. The attackers can also inject malicious code into the targeted machine’s memory. ## How Can I Secure My Web Applications? There are several best practices and tools that can help protect against application layer attacks. One such method is to put in place a barrier in the form of a Web Application Firewall (WAF). This firewall can protect against attacks like cross-site forgery, cross-site scripting and SQL injection.

Other practices to protect your web applications include:

• Keep updated with the OWASP Top Ten—check regularly the OWASP Web Application Security Testing Cheat Sheet for information about new known vulnerabilities and other security-related issues.
• Audit your application security—this will create a baseline from which to grow. It is important to carry an external application security audit to have an independent point of view about the security of the application. This can help you build secure applications from the start by refactoring the code according to the findings of the audit.
• Log your activities properly—to have the information at hand when a threat happens. This can be achieved by implementing tools to instrument your application, and storing the information in a way that can be parsed quickly and efficiently when it is needed.
• Use real-time security monitoring—add a Runtime Application Self-Protection (RASP) tool or use an Application Security Management platform to protect your application from internal and external threats.
• Encrypt everything—it is important to consider encryption from every angle, including data at rest, not only in transit. That way, if someone can enter your server and clone or remove the drives, be they an internal or an external threat, the encryption makes the attackers' job more difficult.
• Keep your hardware and software updated—updating your resources based on the latest security releases is a tried and tested way to prevent security issues. There are tools that can help you automate the search for and implementation of security updates.

The Bottom Line

By following these best practices, such as installing security patches, installing tools to monitor the servers in real-time and using security tools, you can set yourself on the right path to protecting your applications. Moreover, you contribute to building secure applications from the start by staying on top of the latest known vulnerabilities. This will ultimately strengthen your security posture and benefit your users.