Application security (short AppSec) includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications. It encompasses the whole application life cycle from requirements analysis, design, implementation, verification as well as maintenance.[1]

Approaches

Different approaches will find different subsets of the security vulnerabilities lurking in an application and are most effective at different times in the software lifecycle. They each represent different tradeoffs of time, effort, cost and vulnerabilities found.

Web application security

Web application security is a branch of information security that deals specifically with the security of websites, web applications and web services. At a high level, web application security draws on the principles of application security but applies them specifically to internet and web systems.[2][3]

Web Application Security Tools are specialized tools for working with HTTP traffic, e.g., Web application firewalls.

Security threats

The Open Web Application Security Project (OWASP) provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2017 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations. From this data, approximately 2.3 million vulnerabilities were discovered across over 50,000 applications.[4] According to the OWASP Top 10 - 2021, the ten most critical web application security risks include:[5]

  1. Broken access control
  2. Cryptographic Failures
  3. Injection
  4. Insecure Design
  5. Security Misconfiguration
  6. Vulnerable and Outdated Components
  7. Identification and Authentification Failures
  8. Software and Data Integrity Failures
  9. Security Logging and Monitoring Failures*
  10. Server-Side Request Forgery (SSRF)*

Tooling for security testing

Security testing techniques scour for vulnerabilities or security holes in applications. These vulnerabilities leave applications open to exploitation. Ideally, security testing is implemented throughout the entire Software Development Life Cycle (SDLC) so that vulnerabilities may be addressed in a timely and thorough manner.

There are many kinds of automated tools for identifying vulnerabilities in applications. Common tool categories used for identifying application vulnerabilities include:

Security standards and regulations

See also

References

  1. ^ Happe, Andreas (3 June 2021). "What is AppSec anyways?". snikt.net.
  2. ^ "Web Application Security Overview". 2015-10-23.
  3. ^ Shuaibu, Bala Musa; Norwawi, Norita Md; Selamat, Mohd Hasan; Al-Alwani, Abdulkareem (2013-01-17). "Systematic review of web application security development model". Artificial Intelligence Review. 43 (2): 259–276. doi:10.1007/s10462-012-9375-6. ISSN 0269-2821. S2CID 15221613.
  4. ^ Korolov, Maria (Apr 27, 2017). "Latest OWASP Top 10 looks at APIs, web apps: The new OWASP Top 10 list is out, and while most of it remains the same, there are new additions focusing on web applications and APIs". CSO. ProQuest 1892694046. ((cite journal)): External link in |title= (help)
  5. ^ "OWASP Top 10 - 2021: The Ten Most Critical Web Application Security Risks". Open Web Application Security Project. 2021. Retrieved January 11, 2022.
  6. ^ "Web Application Vulnerability Scanners". NIST.
  7. ^ "Fuzzing". OWASP.
  8. ^ Williams, Jeff (2 July 2015). "I Understand SAST and DAST But What is an IAST and Why Does it Matter?". Contrast Security. Retrieved 10 April 2018.
  9. ^ Velasco, Roberto (7 May 2020). "What is IAST? All About Interactive Application Security Testing". Hdiv Security. Retrieved 7 May 2020.
  10. ^ Abezgauz, Irene (February 17, 2014). "Introduction to Interactive Application Security Testing". Quotium.
  11. ^ Rohr, Matthias (November 26, 2015). "IAST: A New Approach For Agile Security Testing". Secodis.
  12. ^ "OWASP Application Security Verification Standard".