Application security explained

Application security (short AppSec) includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications. It encompasses the whole application life cycle from requirements analysis, design, implementation, verification as well as maintenance.^[1]

Web application security is a branch of information security that deals specifically with the security of websites, web applications, and web services. At a high level, web application security draws on the principles of application security but applies them specifically to the internet and web systems.^{[2] [3]} The application security also concentrates on mobile apps and their security which includes iOS and Android Applications

Web Application Security Tools are specialized tools for working with HTTP traffic, e.g., Web application firewalls.

Approaches

Different approaches will find different subsets of the security vulnerabilities lurking in an application and are most effective at different times in the software lifecycle. They each represent different tradeoffs of time, effort, cost and vulnerabilities found.

• Design review. Before code is written the application's architecture and design can be reviewed for security problems. A common technique in this phase is the creation of a threat model.
• Whitebox security review, or code review. This is a security engineer deeply understanding the application through manually reviewing the source code and noticing security flaws. Through comprehension of the application, vulnerabilities unique to the application can be found.
• Blackbox security audit. This is only through the use of an application testing it for security vulnerabilities, no source code is required.
• Automated Tooling. Many security tools can be automated through inclusion into the development or testing environment. Examples of those are automated DAST/SAST tools that are integrated into code editor or CI/CD platforms.
• Coordinated vulnerability platforms. These are hacker-powered application security solutions offered by many websites and software developers by which individuals can receive recognition and compensation for reporting bugs.

Security threats

The Open Web Application Security Project (OWASP) provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2017 results from recent research based on comprehensive data compiled from over 40 partner organizations. This data revealed approximately 2.3 million vulnerabilities across over 50,000 applications.^[4] According to the OWASP Top 10 - 2021, the ten most critical web application security risks include:^[5]

1. Broken access control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentification Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures*
10. Server-Side Request Forgery (SSRF)*

Tooling for security testing

Security testing techniques scour for vulnerabilities or security holes in applications. These vulnerabilities leave applications open to exploitation. Ideally, security testing is implemented throughout the entire Software Development Life Cycle (SDLC) so that vulnerabilities may be addressed in a timely and thorough manner.

There are many kinds of automated tools for identifying vulnerabilities in applications. Common tool categories used for identifying application vulnerabilities include:

• Static Application Security Testing (SAST) analyzes source code for security vulnerabilities during an application's development. Compared to DAST, SAST can be utilized even before the application is in an executable state. As SAST has access to the full source code it is a white-box approach. This can yield more detailed results but can result in many false positives that need to be manually verified.
• Dynamic Application Security Testing (DAST, often called Vulnerability scanners) automatically detects vulnerabilities by crawling and analyzing websites. This method is highly scalable, easily integrated and quick. DAST tools are well suited for dealing with low-level attacks such as injection flaws but are not well suited to detect high-level flaws, e.g., logic or business logic flaws.^[6] Fuzzing tools are commonly used for input testing.^[7]
• Interactive Application Security Testing (IAST) assesses applications from within using software instrumentation. This combines the strengths of both SAST and DAST methods as well as providing access to code, HTTP traffic, library information, backend connections and configuration information.^{[8] [9]} Some IAST products require the application to be attacked, while others can be used during normal quality assurance testing.^{[10] [11]}
• Runtime application self-protection augments existing applications to provide intrusion detection and prevention from within an application runtime.
• Dependency scanners (also called Software Composition Analysis) try to detect the usage of software components with known vulnerabilities. These tools can either work on-demand, e.g., during the source code build process, or periodically.
• Abstraction is the idea of making more complex things less complex.
• Application security testing as a service (ASTaaS): In this scenario, the organization enlists an external company to perform all testing for their applications. ASTaaS usually combines static and dynamic security methods, including penetration testing and evaluating application programming interfaces (APIs).

Resin is a new tool for improving application security and reducing vulnerabilities. It allows developers to specify rules about how data should flow through an application to prevent security issues. This is done using policy objects to define the rules, data tracking to monitor the data flow, and filter objects to check the rules at specific points in the data flow.^[12]

Security standards and regulations

• CERT Secure Coding
• ISO/IEC 27034-1:2011 Information technology — Security techniques — Application security -- Part 1: Overview and concepts
• ISO/IEC TR 24772:2013 Information technology — Programming languages — Guidance to avoiding vulnerabilities in programming languages through language selection and use
• NIST Special Publication 800-53
• OWASP ASVS: Web Application Security Verification Standard^[13]

See also

• Common Weakness Enumeration
• Data security
• Mobile security
• OWASP
• Microsoft Security Development Lifecycle
• Usable security

Notes and References

1. Web site: Happe. Andreas. 3 June 2021. What is AppSec anyways?. snikt.net.
2. Web site: 2015-10-23 . Web Application Security Overview .
3. Shuaibu . Bala Musa . Norwawi . Norita Md . Selamat . Mohd Hasan . Al-Alwani . Abdulkareem . 2013-01-17 . Systematic review of web application security development model . Artificial Intelligence Review . 43 . 2 . 259–276 . 10.1007/s10462-012-9375-6 . 0269-2821 . 15221613.
4. Korolov. Maria. Apr 27, 2017. Latest OWASP Top 10 looks at APIs, web apps: The new OWASP Top 10 list is out, and while most of it remains the same, there are new additions focusing on web applications and APIs. CSO. .
5. Web site: 2021. OWASP Top 10 - 2021: The Ten Most Critical Web Application Security Risks. January 11, 2022. Open Web Application Security Project.
6. News: Web Application Vulnerability Scanners . NIST .
7. News: Fuzzing . OWASP .
8. Web site: I Understand SAST and DAST But What is an IAST and Why Does it Matter?. Contrast Security. Jeff. Williams. 2 July 2015. 10 April 2018.
9. Web site: What is IAST? All About Interactive Application Security Testing. Hdiv Security. Roberto. Velasco. 7 May 2020. 7 May 2020.
10. Web site: Introduction to Interactive Application Security Testing. Quotium. Irene. Abezgauz. February 17, 2014. January 25, 2018. April 3, 2018. https://web.archive.org/web/20180403193750/http://www.quotium.com/resources/interactive-application-security-testing/. dead.
11. Web site: IAST: A New Approach For Agile Security Testing. Secodis. Matthias . Rohr. November 26, 2015.
12. Book: Yip . Alexander . Wang . Xi . Zeldovich . Nickolai . Kaashoek . M. Frans . Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles . Improving application security with data flow assertions . 2009-10-11 . https://doi.org/10.1145/1629575.1629604 . SOSP '09 . New York, NY, USA . Association for Computing Machinery . 291–304 . 10.1145/1629575.1629604 . 978-1-60558-752-3. 1721.1/67015 . 7189495 . free .
13. Web site: OWASP Application Security Verification Standard.