Managing Web Application Security Computer Science Essay

Changes in business environments and the advances in web technologies have made the services of corporate, public and private firms to be more widespread over the web by making use of web applications. Although web services can provide greater convenience, flexibility and efficiency, they also possess great number of threats which could be a significant risk for the organization if not properly dealt with. This paper discusses the various vulnerabilities that web applications present and the best practices to apply counter-measures and mitigate those risks

II. Risks of Web Technologies

A. Omnipresence

In today's e-world the activities of web users are increasing day by day on the potentially vulnerable World Wide Web. The new impressing applications that are available today are developed using various tools and technologies, whose ease and convenience of implementation had made them so popular and to be widely used. Today almost all the private and government organizations depend on the web technologies and applications to carry out their everyday essential operations.

B. Web Application vulnerabilities

Much of the confidential and financial matters concerning an company and an individual are carried out using web which is prone to many security risks like hacker attacks, sql injection attacks, website intrusion, denial-of-service attack etc. There is an alarming increase in the number of attacks as hackers are finding new ways to attack the system.

Get Help With Your Essay

If you need assistance with writing your essay, our professional essay writing service is here to help!
Find out more about our Essay Writing Service

The vulnerabilities that are being attacked now-a-days are very different from those carried out in the past years. While some attacks were carried out for pure psychological satisfaction of the attacker, others aim at stealing sensitive data like credit-card numbers, bank account information, and sensitive data from organizations. This has made the organization to spend more on security related aspects.

C. Role of Management

Web application security should be taken care by management by right decisions and techniques. Periodical training sessions should be conducted to bring awareness among the developers, of new type of attacks and threats and how to implement effective security mechanisms to defense their applications or modules against these threats. Securing web applications should be done right from the starting of the project rather than adding at the end of the development process. The management should ensure that all necessary precautions are taken before releasing the applications to the outside world by thoroughly testing them.

III. Top Security risks and Counter Measures

This section discusses three of the top ten security risks of 2010 according to 'The Open Web Application Security Project' (OWASP).

A. Injection

Injection is the process of transmitting malicious code to another system through a web application. Malicious Commands written in scripting languages like html, JavaScript, python, Perl etc., are passed to a web application interpreter to exploit the vulnerabilities of a system.

Although there are many types of injection attacks, SQL injection attacks are most widespread.

1. SQL Injection

Sql injection attack involves insertion of malicious sql strings in to input parameters of sql statements, these makes the databases to compromise sensitive information and to view, modify or delete the information in databases by an attacker. For example, consider the following legitimate sql statement that retrieves the matched username from the input query

SELECT * FROM TableName WHERE username = '$username'

If an attacker modifies the statement to

SELECT * FROM TableName WHERE username = (' ' or '1'='1')

it retrieves all the rows in the selected table because 1 equals 1 is always true, thus compromising sensitive information.

Countermeasures and Prevention

Although injection attacks can be easily detected and avoided, more and more attacks are found to be occurring because of using dynamic queries for taking user input. An attack can be successfully prevented by validating user input, using parameterized queries and stored procedures. While parameterized statements include place holders like '?' to substitute the user input data, the attacker can easily substitute malicious strings in to the place holders. Using parameterized queries along with stored procedures is found to be effective as stored procedures use the already defined code in the database to take the input data from application. However the use of above two methods can affect the system's performance, so another technique can be used for rejecting the user supplied statements by using strong escape schemes or strings that are pertinent to each kind of statement so the DBMS can differentiate between user input and developer's code. It is advisable to apply string escaping both on client-side and server-side to provide stronger security.

B. Cross-site scripting(XSS)

It is the process of injecting malicious code in to a trusted website by using a vulnerable web application or sending malicious script to be executed in the web browser of an user. This may result in compromising of sensitive information like stealing passwords, cookies, session information stored in the browser, misshaping of website and also conducting phishing attacks. These types of attacks commonly arise from message boards, discussion boards, newsgroups, mail messages and forums. A user may embed malicious code in tags like . When a user views the message the code may be automatically executed thereby exploiting the vulnerability.

1. Stored XSS attacks

The injected code is permanently stored in the database servers, visitor log, fields etc. The malicious code is retrieved when users request stored information. The attack propagates to every user who requests the stored information.

2. Reflected XSS attacks

Malicious code is sent to the server through specifically crafted means like a form, the request is sent to the server and is responded to the user's browser. The user's browser executes the code as the respond came from a trusted source

Prevention and Countermeasures

XSS attacks are difficult to identify and prevent. One method of securing is 'input filtering' the data by omitting