Web Application Security

Web application security is the process of protecting web applications from Internet threats. Traditionally, this is provided by a WAF: a web application firewall.

What is a web application?

A web application is a client-server system that runs over the Internet, where the client is a web browser or native/mobile software.

In a traditional client-server system, client software communicates with server software, usually on separate physical devices. The two applications are tightly coupled in their design; changing or updating one of them often requires changing the other also.

In the early 1990s, “web” clients and servers became popular. (The name comes from Tim Berners-Lee’s 1990 proposal for a “WorldWideWeb” system of hyperlinked information.) The first websites were static; clients used browser software to interpret and display HTML documents that were stored on web servers.

Over time, web sites became dynamic. In 1995, JavaScript was introduced: a client-side scripting language which allowed pages to be more interactive with their users. As Flash, Java, DHTML, and other technologies also became available, they extended the potential capabilities of a “web page.” Today, the most sophisticated pages are full-blown applications.

Therefore, a web application is a client-server system which runs over the Internet, using a web browser as the client. However, as mobile devices became widespread, software ecosystems have arisen for these platforms. Many of these mobile client applications use web protocols for communication with the servers. Therefore, they are often considered to be web applications as well, even though a browser is not used.

The majority of Internet usage today involves web applications. Web application security has thus become a vitally important part of today’s Internet.

Web Applications and APIs

Web applications use APIs to communicate with other systems, such as databases, file systems, and other web applications. APIs allow two pieces of software to talk to each other seamlessly. They can be used to share data, send messages, or perform other tasks.

APIs can be a security risk if they are not properly secured. This is because they can be used to access sensitive data or to launch attacks on web applications (e.g., injection attacks). Developers should implement robust security measures to protect APIs. This includes using strong authentication, encrypting data, input validation and sanitization, and monitoring API traffic.

Understanding the relationship between web applications and APIs is vital for maintaining a secure digital ecosystem. This is because APIs can sometimes be used to bypass security measures that are in place for web applications, because developers often do not treat incoming API traffic as strictly as they do other http/s requests.

It emphasizes the need for stringent security measures and best practices to safeguard not only the web application itself but also the interconnected APIs, ensuring a robust and resilient architecture in the face of evolving cyber threats.

What is web application security?

As commercial activity on the Internet has continued to grow, so have the incentives for hostile activity and abuse.

Web applications can be vulnerable in a variety of ways. As the Internet has evolved, some of these have been mitigated. For example, thanks to the adoption of HTTPS as the default protocol for the majority of websites, MitM (Man in the Middle) attacks have become more difficult.

However, web application servers are inherently difficult to secure. By their nature, they must accept incoming connections from clients. Therefore, servers must have the ability to distinguish legitimate clients from hostile clients, and be able to deny further access to those which are discovered to be hostile.

There are a wide variety of malicious activities that are possible (e.g., the OWASP Top 10 Web Application Security Risks). Some of the most common threats and attacks include:

• Injection Attacks involve the insertion of malicious code or commands into input fields or data entry points of an application. SQL injection, one of the most prevalent types, allows attackers to manipulate a database by injecting SQL commands through input fields.
• Cross-Site Scripting (XSS) involves injecting malicious scripts into web pages, leading to the execution of unauthorized scripts in the browsers of unsuspecting users. This allows attackers to steal sensitive information or execute actions on behalf of the user.
• Security Misconfigurations in web application servers, frameworks, or databases can leave vulnerabilities open for exploitation. These misconfigurations can range from default settings, open ports, unpatched software, or unnecessary services running on the server, providing opportunities for attackers to gain unauthorized access.
• Insecure Deserialization occurs when an application deserializes untrusted data without proper validation, potentially leading to remote code execution or denial-of-service attacks.
• Inadequate Access Controls enable unauthorized users to gain elevated privileges or access resources they shouldn’t have. It includes poorly managed authentication, overly permissive permissions, or improper session management.
• Insufficient Logging and Monitoring hinders the ability to detect and respond to security incidents effectively. It becomes challenging to track and analyze potential threats or unauthorized access attempts without comprehensive logs and monitoring systems in place.

Some developers have tried to build security into their web applications, so that they include the ability to detect hostile activity within the requests that they receive.

However, this approach has several problems. First, it requires the application developers to be security experts (which is very unlikely in today’s complex threat environment). It’s also incompatible with modern development practices, which tend to favor small, independent services over large monolithic applications.

Therefore, the most effective approach for web application security is for servers to run separate, dedicated security applications to filter and scrub incoming traffic. Modern threat actors are well-financed, tenacious, and sophisticated: therefore, a next-generation WAF is a crucial component of any web application system today.

Share this post