Application Level Security Management
- Art: Diplomarbeit
- Autor: Michael Neuhaus
- Abgabedatum: Februar 2005
- Umfang: 106 Seiten
- Dateigröße: 3,4 MB
- Note: 1,3
- Institution / Hochschule: Fachhochschule Konstanz Deutschland
- ISBN (eBook): 978-3-8324-8705-8
-
ISBN (Paperback) :
978-3-8324-8705-8 P - ISBN (CD) :978-3-8324-8705-8 CD
- Sprache: Englisch
- Prämierung:
- Arbeit zitieren: Neuhaus, Michael Februar 2005: Application Level Security Management, Hamburg: Diplomica Verlag
- Schlagworte: Web Application Firewall, Internet Security, Security, Intrusion Prevention, Software Development Lifecycle Security
In den Warenkorb
74,00 €
Diplomarbeit von Michael Neuhaus
Abstract:
Today, more and more enterprises are developing business applications for Internet usage, which results in the exposure of their sensitive data not only to customers, and business partners but also to hackers. Because web applications provide the interface between users sitting somewhere within the World Wide Web and enterprises’ backend-resources, hackers can execute sophisticated attacks that are almost untraceable, aiming to steal, modify or delete enterprises‘ vital data, even when it is protected by passwords or encryption.
As recent viruses and worms such as Nimda, CodeRed or MSBlast have shown, modern attacks are occurring at the application itself, since this is where high-value information is most vulnerable. Such attack scenarios a becoming very problematic nowadays, since traditional network security products such as firewalls or network intrusion detection systems are completely blind to those malicious activities and therefore can not offer any protection at all. Modern protection mechanisms require more sophisticated detection capabilities in order to protect enterprises assets from such attacks now and in the future.
Additionally web application security currently is a highly dynamic and also very emerging field within enterprises’ IT security activities. Therefore this diploma thesis aims to provide a strong focussed picture on the current state of web application security and its different possibilities to raise the overall security level of already implemented web applications and also of future web applications.
Acting as a basis for further analysis, the currently most common web application vulnerabilities are described to get an overview of what a web application has to be protected of and where the root problems of these weaknesses are lying. Although these generic categories may not be applicable to every actually implemented web application, they may be used as baseline for future web applications.
Armed with the background of the current vulnerabilities and their related root causes, a detailed analysis of currently available countermeasures will provide recommendations that may be taken at each of the certain stages of a web application’s lifecycle. Since all further decisions generally should be based upon risk evaluations of specifically considered systems, a possible risk management assessment methodology is provided within the thesis.
Controls and countermeasures are provided from an attack’s timeline perspective, describing preventive countermeasures attached to each certain stage within the web application lifecycle and also different protective controls which are actively capable to defend enterprises from being successfully attacked. These countermeasures are analyzed form a functionality point of view, followed by currently available products providing such dedicated mechanisms. If available, such products and technologies were additionally judged with analyst’s perspectives for the provision of a more prospective view on current possibilities and future opportunities.
Table of Contents:
| 1. | Introduction | 1 |
| 1.1 | The Business Perspective | 1 |
| 1.1.2 | The Problem inherent to Web Applications | 2 |
| 1.1.3 | Different Forms of Attacks | 4 |
| 1.2 | Basics of Web Application Security | 5 |
| 1.2.1 | The Basic Principles of Security | 5 |
| 1.2.2 | Common Security Terms Defined | 6 |
| 1.2.3 | Application Security – A Holistic Approach | 6 |
| 1.3 | Contents of this Thesis | 8 |
| 2. | Architecture of a Web Applications | 9 |
| 2.1 | The Logical View | 10 |
| 2.2 | The Physical View | 10 |
| 2.3 | Communication between Web Client and Web Server | 12 |
| 2.3.1 | The ISO/OSI Reference Model | 12 |
| 2.3.2 | HTTP | 13 |
| 2.3.3 | HTTP over SSL | 13 |
| 3. | Risks and Vulnerabilties of Web Applications | 16 |
| 3.1 | Risk Management | 16 |
| 3.1.2 | Definition of Risk | 16 |
| 3.1.3 | The NIST Risk Assessment Methodology | 17 |
| 3.2 | The 10 Most Common Web Application Vulnerabilities | 21 |
| 3.2.1 | Unvalidated Input | 23 |
| 3.2.2 | Broken Access Control | 27 |
| 3.2.3 | Broken Authentication and Session Management | 28 |
| 3.2.4 | Cross-Site Scripting (XSS) Flaws | 31 |
| 3.2.5 | Buffer Overflows | 34 |
| 3.2.6 | Injection Flaws | 35 |
| 3.2.7 | Improper Error Handling | 35 |
| 3.2.8 | Insecure Storage | 36 |
| 3.2.9 | Denial of Service | 36 |
| 3.2.10 | Insecure Configuration Management | 37 |
| 3.3 | Web Application Security Checklist | 38 |
| 4. | Current Controls and Countermeasures | 39 |
| 4.1 | Web Application Architecture Revisited | 39 |
| 4.2 | Pre-Attack Measures | 41 |
| 4.2.1 | Web Application Lifecycle Management – From a Security Perspective | 41 |
| 4.2.1.1 | Project definition | 43 |
| 4.2.1.2 | Software Development Lifecycle (SDLC) | 43 |
| 4.2.1.3 | Operations and Maintenance | 46 |
| 4.2.2 | Automatic Source Code Analysis | 46 |
| 4.2.2.1 | Commercial Automatic Source Code Analyzers | 48 |
| 4.2.2.2 | Open-Source Automatic Source Code Analyzers | 50 |
| 4.2.3 | Secure Coding Libraries | 51 |
| 4.2.4 | Web Application Vulnerability Scanning | 52 |
| 4.2.4.1 | Web Application Scanner | 52 |
| 4.2.4.2 | Database Scanner | 53 |
| 4.2.5 | Security Services of Providers | 55 |
| 4.2.5.1 | Architecture and Design Assessment Services | 55 |
| 4.2.5.2 | Code Review Services | 56 |
| 4.2.5.3 | Managed Web Application Assessments | 56 |
| 4.2.6 | Summary of currently available Preventive Countermeasures | 58 |
| 4.3 | Attack Defense | 59 |
| 4.3.1 | Web Application Security Gateways | 59 |
| 4.3.1.1 | HTTP Filtering | 62 |
| 4.3.1.2 | Static and Dynamic Configuration Mechanisms | 66 |
| 4.3.1.2 | WASG Network Integration Options | 66 |
| 4.3.1.3 | Current Products | 68 |
| 4.3.2 | Host Intrusion Prevention Systems | 73 |
| 4.3.3 | Proxies for Backend Protocols | 76 |
| 4.4 | Post-Attack Measures | 77 |
| 5. | Future Trends | 78 |
| 5.1 | Web Services | 78 |
| 6. | Conclusions and Outlook | 82 |
| Appendix A | List of Acronyms | A-1 |
| Appendix B | References | B-1 |
| Appendix C | Web Application Security Checklist | C-1 |
In den Warenkorb
74,00 €
Link zur Arbeit:
http://www.diplom.de/ean/9783832487058
Arbeit zitieren:
Neuhaus, Michael Februar 2005: Application Level Security Management, Hamburg: Diplomica Verlag
Schlagworte:
Web Application Firewall, Internet Security, Security, Intrusion Prevention, Software Development Lifecycle Security
Entdecken Sie mehr zum Thema
