blog

Significance of Application Security in the Business world.

OWASP TOP 10

The internet age and globalization of operations have seen the adoption of computing infrastructure to better facilitate organizations and people’s business operations. To facilitate this, web applications are used as the primary means of accessing and manipulating data distributed over various data centres. 

Despite their obvious advantages, security concerns remain as their major hurdle towards their full adoption. What are some of these vulnerabilities, and can they be addressed?

WEB APPLICATION VULNERABILITIES

A vulnerability is a weakness or hole in an application’s design that may be exploited by an attacker to cause harm to the application’s stakeholders. A stakeholder is any entity that relies on the application in any form.

The Open Web Application Security Project, a non-profit organization dealing with web application security, lists ten vulnerabilities that plague web applications.

  1. Injection. This is a weakness that allows the addition of untrusted data sent to the application’s interpreter sent as part of a command or query. This allows the attacker to be able to access unauthorized data or execute restricted commands on the application.
  2. Broken Authentication. This is a weakness in the authentication procedures that allows an attacker to masquerade as another entity through misconfigured session keys and passwords. This allows an attacker to assume another person’s identity temporarily or permanently.
  3. Sensitive Data Exposure. Web applications may not properly secure user data either in transit or at rest. This will allow an attacker to steal sensitive data to commit credit card fraud, identity theft, or other malicious activities. 
  4. XML External Entities (XXE). Poorly configured or older XML processors allow for the execution of external XML entities within scripts. These external entities can determine application structure and carry out attack vectors such as the denial of service attacks and internal port scanning.
  5. Broken Access Control. Attackers can exploit improper enforcement of what authenticated users can access and carry out on a web application. An attacker can use these to view sensitive data on user accounts, modify user’s data, and access sensitive files. 
  6. Security Misconfiguration. This is usually the result of using default configurations, incomplete configurations, misconfigured HTTP headers, and error messages containing sensitive information. All web application dependencies such as libraries, frameworks, and operating systems must be properly configured and upgraded in a timely manner to ensure the most up to date settings are used.
  7. Cross-Site Scripting XSS. XSS vulnerabilities occur when a web application uses user-supplied input as an output on a new web page without proper validation and sanitization. Cross-site scripting allows a malicious attacker to execute JavaScript code on the user’s browser, which can be used to hijack user sessions, steal sensitive data such as login credentials and redirect users to malicious websites.
  8. Insecure Deserialization. Deserialization is the process of converting data from a file or stream and rebuilding it into an object. Insecure deserialization is a vulnerability where untrusted or malicious data is used to exploit an application’s logic to carry out attacks. It can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks, or carry out remote code execution or denial of service attacks.
  9. Using Components with Known Vulnerabilities. Components of web applications such as libraries and frameworks run with similar privileges as the application. Attackers can exploit the use of these components with known vulnerabilities to compromise a web application. Should they be exploited, they can cause untold damage to the application’s infrastructure and data, and these may undermine all other security policies that have been implemented in the application.
  10. Insufficient Logging & Monitoring. A web application needs to be constantly monitored and logged in order to prevent repeat attacks and stop attacks such as a denial of service and session hijacking. In most cases, the time taken to detect attacks is normally more than 200 days on average and is usually done by external parties to the target organization. 

CONTINUOUS TESTING VS PENTESTING.

Two schools of thought are primarily considered to counter web application vulnerabilities, continuous testing and pen-testing. Continuous testing is the continuous testing of its creators’ application to ensure all security concerns have been addressed. At the same time, pen-testing is usually carried out by an external party to circumvent the existing security policies implemented on the application. While pen-testing is considered the most ideal as an external party will most likely find something overlooked, it is far more costly. There is a risk of sensitive data exposure to untrusted parties.  

How does one optimise for continuous testing?

Continuous testing is carried out early, regularly, and everywhere. In a continuous testing process, testing is done undisrupted continuously moving the software continuously from development, testing to deployment. This allows the development team to find the risk, address it, and improve the final product quality. In order to properly secure an application, continuous testing should be carried out in every stage of the computer development pipeline. Test suites should be set up at every point the web application code changes, merges, or is released. This allows the development team to run tests at specific points rather than running all the tests at once.

In order to carry this out, teams need to add additional modern testing practices in the form of minute quality checks. These checks are carried out throughout the application pipeline allowing for small sections of code in the application to be tested throughout the application’s development pipeline. Test automation should not be the first thing tacked due to test dependencies, which have to be satisfied before execution. 

This can be solved by dividing the process into two stages: continuous integration and continuous testing. In continuous integration, rather than waiting for all developers to commit their code, the code is merged into the main branch, built, and tested in a virtualized environment. This saves time in moving from the development environment to the testing environment. Should the test fail, the issues are reported back to the developers, and the process is repeated continuously until the production build is completed.

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore the critical cybersecurity implications of CVE-2024-23917 and CVE-2024-27199 vulnerabilities in JetBrains software. Learn how vulnerability management and EPSS guide organizations in strengthening their cyber defences.
Francesco Cipollone
Explore the interplay between the MITRE ATT&CK framework and EPSS for effective vulnerability management. Learn how these tools help predict and prioritize cyber threats, with deep dives into the most and least exploited techniques. Stay ahead in cybersecurity with Phoenix’s advanced analysis.
Francesco Cipollone
The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform. Application Security Posture Management – Team Graph – Team Dashboard Access Update Asset and Vulnerability Management – Saved Filters – Introducing Asset Lifecycle Management – Introducing Vulnerability Lifecycle Management Integrations – Out-of-the-box Nuclei Scanning – Wiz Integration – Control Snyk ignored vulnerabilities Other Improvements – Navigate to Asset from Impact Explorer chart – Improved display of Impact and Exposure in Risk Elements
Alfonso Eusebio
Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.