The principle of defence in depth is to have layered security mechanisms. Having multiple security mechanisms in place means if there is an attack on your system, hopefully only one mechanism has been breached, and there are others to continue protecting your system (owasp 2015). When adding extra defence mechanisms additional risks should be evaluated. For example, changing password requirements to force lengthy complicated passwords may result in users physically writing passwords down on pieces of paper, this may create a greater risk than requiring a shorter, less complicated password (owasp 2015). A two-step authentication process would be better in this scenario, banks use two step authentication processes when a user is withdrawing money from an ATM, the first is something you possess – the ATM card, and secondly, something you know – your pin number. Two-step verification is increasingly seen in email and social networking sites and other websites requiring improved security. The two-step authentication for websites is usually a username and password, coupled with a code that is sent to the users phone. The advantage to this two-step method is even if the password is guessed or stolen, without the code sent to the account holder’s mobile phone, the attacker will be unable to login (Barnatt 2014). Applications where users login via username and password must have several additional security mechanisms in place. These include session management, authentication using tokens, and having restricted access measures in place. It is important to restrict the application to the lowest possible level of privileges when accessing the database. When the majority of the access to the database is read only, if an attacker is able to hijack a users account, they will be unable to write or delete important information from the database (Stuttard & Pinto 2011 p.342). Token authentication is another useful tool. Tokens are cryptographically signed by the server, which guarantees they have not been forged or altered (Barbettini 2016).
OWASP regularly compiles a list of the top 10 of the most critical web application security flaws. Thoroughly understanding these top 10 threats and implementing layered protections to defend against them is crucial in any application.
OWASP Top 10 Application Security Risks – 2013 Report
1. Injection
Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
2.Broken Authentication and Session Management
Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
3. Cross-Site Scripting (XSS)
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
4. Insecure Direct Object References
A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
5. Security Misconfiguration
Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.
6. Sensitive Data Exposure
Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
7. Missing Function Level Access Control
Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.
8. Cross-Site Request Forgery (CSRF)
A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
9. Using Components with Known Vulnerabilities
Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts.
10. Unvalidated Redirects and Forwards
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.
References
Barbettini N, 5 August 2016, Stormpath, online video, accessed 11 September 2016.
https://www.youtube.com/watch?v=5uIenyM55gU
Barnatt C, 7 July 2014, Explaining Computers, online video, accessed 14 September 2016.
https://www.youtube.com/watch?v=AIOUlQeQbNM
OWASP, 2013, The ten most critical web application security risks. PDF download link
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
OWASP, 14 August 2015, Defense in depth, accessed 13 September 2016.
https://www.owasp.org/index.php/Defense_in_depth
Stuttard D & Pinto M, 2011, The Web Application Hacker’s Handbook, Wiley Publishing, Inc. Indianapolis, Indiana USA.
No comments:
Post a Comment