Having a secure application is critical in today’s digital age. Unfortunately, vulnerabilities are a significant threat to any application. To ensure your application is secure and free from vulnerabilities, you need to understand the basics of application security. In this blog post, we’ll discuss the fundamentals of application security and provide tips on focusing on the most important things to fix. By the end of this post, you should better understand how to secure your application against vulnerabilities.
What is Application Security?
Application security is critical to modern supply chain management as it protects data and code within an app from theft or hijacking. However, the complexity of current application security programs and the challenges of scaling an application security program can make it difficult for organizations to keep up with the latest threats and vulnerabilities. Modern application security do not use manual methods to monitor as is very expensive. One of the major challenges in the modern supply chain is the increased use of cloud-based technologies, which can make it more difficult to secure applications and protect against potential threats. Additionally, the complexity of modern application security programs can make it difficult for organizations to identify and address vulnerabilities promptly. To overcome these challenges, organizations must incorporate a comprehensive application security program into their software development life cycle (SDLC) and implement automated tools and processes to detect and remediate vulnerabilities. This includes incorporating a secure code review system, regular source-code analysis, and an application security education program for developers. Furthermore, organizations should conduct regular penetration testing to verify the overall security posture of their applications. In this way, they can ensure that their applications are protected against the latest threats and vulnerabilities and that they can scale their application security program as their business grows.
What reference frameworks are there?
Modern application security frameworks are designed to provide organizations with a comprehensive approach to protecting their applications and data from cyber threats. One of the most widely used frameworks is the Application Security Verification Standard (ASVS), which provides guidelines and best practices for verifying the security of web applications. The ASVS is organized into three levels, with each level representing a different level of security maturity. This framework helps organizations to identify and address vulnerabilities in their applications and to implement effective controls to mitigate risk. Another popular framework is the OWASP (Open Web Application Security Project). This international non-profit organization provides various resources and tools to help organizations improve the security of their web applications. OWASP projects include the OWASP Top Ten Project, a list of the most critical web application security risks and the OWASP Application Security Verification Standard (ASVS) project, which provides a set of guidelines for verifying the security of web applications. Other OWASP projects include the OWASP Proactive Controls project, which provides a set of best practices for preventing and mitigating common web application security risks, and the OWASP Security Knowledge Framework, which is a comprehensive knowledge base that guides how to secure web applications. These frameworks are essential for organizations to implement to secure their application.
What is OWASP and the OWASP top 10
Application security is critical in modern information technology, as applications are the primary way organizations interact with their customers, partners, and employees. However, as the number and complexity of applications have grown, so too have the threats to those applications.
The Open Web Application Security Project (OWASP) is a nonprofit foundation dedicated to improving software security. This organization operates under an “open community” model, meaning anyone can participate in and contribute to OWASP-related online chats, projects, and more. One of the most valuable resources from the OWASP is the OWASP Top 10, which provides rankings of and remediation guidance for the top 10 most critical web application security risks.
The report is based on a consensus among security experts from around the world, who rank risks according to their frequency of discovered security defects, the severity of the uncovered vulnerabilities, and the magnitude of their potential impacts. The report aims to offer developers and web application security professionals insight into the most prevalent security risks so that they may fold the report’s findings and recommendations into their own appsec program and overall application security strategy.
- A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than in any other category.
- A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
- A03:2021-Injection slides down to the third position. 94% of the applications were tested for injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.
- A04:2021-Insecure Design is a new category for 2021, focusing on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modelling, secure design patterns and principles, and reference architectures.
- A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.
- A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but it also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
- A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
- A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.
- A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
- A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above-average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
The OWASP top 10 has changed quite much from the original 2017
- Injection: Injection attacks are common in which an attacker injects malicious code into an application to gain unauthorized access to sensitive data. SQL injection is the most common type of injection attack, but other types, such as command injection, LDAP injection, and XML injection, are also possible. To protect against injection attacks, organizations should use input validation, parameterized queries, and a web application firewall (WAF) to detect and block malicious input.
- Broken Authentication and Session Management: Broken authentication and session management can occur when an application does not properly authenticate and authorize users or when it does not properly manage user sessions. This can lead to unauthorized access to sensitive data and the ability to perform actions on behalf of other users. To protect against broken authentication and session management, organizations should use secure authentication and session management mechanisms, such as two-factor authentication and session tokens, and use a WAF to detect and block unauthorized access.
- Cross-Site Scripting (XSS): Cross-site scripting (XSS) is a type of attack in which an attacker injects malicious code into an application to steal sensitive information or perform actions on behalf of the user. To protect against XSS attacks, organizations should use input validation and encoding and use a WAF to detect and block malicious input.
- Insecure Direct Object References: Insecure direct object references occur when an application does not properly validate user input and allows an attacker to access sensitive data or perform actions on behalf of the user. To protect against insecure direct object references, organizations should use input validation and use a WAF to detect and block unauthorized access.
- Security Misconfiguration: Security misconfiguration occurs when an application is not properly configured to protect against security threats. This can include weak passwords, unpatched software, and open ports and services. To protect against security misconfiguration, organizations should use a configuration management tool to ensure that all systems are properly configured and use a WAF to detect and block unauthorized access.
- Sensitive Data Disclosure: Sensitive data disclosure occurs when an application does not properly protect sensitive data from unauthorized access. This can include weak encryption, unencrypted data, and weak access controls. To protect against sensitive data disclosure, organizations should use encryption and access controls and a WAF to detect and block unauthorized access.
- Missing Function Level Access Control: When an application does not properly restrict access to sensitive data and functionality based on user roles and permissions, Missing function level access control occurs. To protect against missing function-level access control, organizations should use role-based access controls and use a WAF to detect and block unauthorized access.
- Cross-Site Request Forgery (CSRF): Cross-site request forgery (CSRF) is an attack in which an attacker can perform actions on behalf of the user without their knowledge. To protect against CSRF attacks, organizations should use anti-CSRF tokens and a WAF to detect and block unauthorized access.
- Insecure deserialization is when a website deserializes user-controllable data. This potentially enables an attacker to manipulate serialized objects to pass harmful data into the application code. It is even possible to replace a serialized object with an object of an entirely different class.
Using components with known vulnerabilities is a common security risk in which organizations use software or libraries identified as having security vulnerabilities. Attackers can exploit these vulnerabilities to gain unauthorized access to sensitive data or perform actions on behalf of the user. For example, an attacker could exploit a known vulnerability in a popular web application framework to gain access to sensitive data stored in a database.
One of the main challenges with using components with known vulnerabilities is that organizations may not be aware of the vulnerabilities in the components they use. This is because discovering new vulnerabilities is a continuous process, and it can be difficult to keep track of the latest vulnerabilities and patches. Additionally, many organizations may not have the resources or expertise to assess the security of the components they are using properly.
To protect against using components with known vulnerabilities, organizations should implement a software composition analysis (SCA) tool to identify and track the components they are using, including any known vulnerabilities. Additionally, organizations should ensure that all components are kept up-to-date with the latest patches, fixes and security updates. This can be achieved by leveraging a well-formed vulnerability management program. Furthermore, organizations should also have a policy that dictates not to use software or libraries with known vulnerabilities or to phase them out if they are already in use.
In summary, using components with known vulnerabilities is a significant security risk for organizations as attackers can exploit these vulnerabilities to gain unauthorized access to sensitive data or perform actions on behalf of the user. To protect against this risk, organizations should implement a software composition analysis (SCA) tool, a patch management system, and a policy that dictates not to use software or libraries with known vulnerabilities and when to fix them with SLA.
