NAVEEN CEO OF INDIA
UNIT 1
1. WEB APPLICATION SECURITY (WAS) OR SECURING :
PROTECTS (OR) SAFEGUARD WEBSITES AND APPLICATIONS FROM CYBERSATTACK (OR)
VULNERABILITIES .
WORKS:
DEVELOPMENT
TESTING
CONTROLS
INPUT VALIDATION
ENCRYPTION
AUDIT OR LOGGING
1. DEVELOPMENT
USE SECURE CODING AND DESIGN TO AVOID VULNERABILITIES .
2. TESTING
RUN TEST THROUGHOUT DEVELOPMENT TO FIND BUGS AND CONFIGURATION .
3. CONTROLS
USE FIREWALLS AND CONTROLS TO PREVENT UNAUTHORIZED ACCESS
4. INPUT VALIDATION
TO PREVENT USER INPUT FROM MALICIOUS THREAT .
5. ENCRYPTION
PROTECT DATA INTRANSIT
6. AUDIT AND LOGGING
KEEP TRACK OF USER ACTIVITY TO HELP IDENTIFY AND RESPOND TO OTHERS.
COMMON WEB APPLICATION ATTACKS :
BRUTE FORCE
CREDENTIAL STUFFING
SQL INJECTION
ERROR WITH SCRIPTING
COOKIES
POISIONING
SESSION HIJACKING
TOOLS:
WAF(WEB APPLICATION FIREWALL )
SPECTRAL
RUNTIME APPLICATION SELF PROTECTION
FUNDAMENTALS OF WAS (OR) KEY CONCEPT OF WAS :
1. AUTHENTICATION
2. AUTHORIZATION
3. INPUT VALIDATION
4. SECURING CODING PRACTICES
5. ENCRYPTION
6. ACCESS CONTROL
7. LOGGING
8. MONETARY
9. REGULAR CACHE
10. PRINCIPAL OF
11. VULNERABILITY MANAGEMENT
12. PERFORMING SECURITY ASSESSMENT
HISTORY OF SOFTWARE SECURITY:
IT IS A LONG AND EVOLVING STRONG SHAPE BY THE INCREASING COMPLEXITY OF COMPUTER
SYSTEM, THE RAISE OF THE INTERNET & THE NEED TO SAFEGUARD DIGITAL ASSESTS.
EARLY COMPUTING [1940-1960]:
o FIRST COMPUTER SECURITY CONCEPT :
EARLY COMPUTING WAS PRIMARILY FOCUSED ON SOLVING MATHEMATICAL AND
SCIENTIFIC PROBLEMS .
IN 1960’S IBM MAINFRAME STARTED BEING USED FOR BUSINESS .
APPLICATION : BASIC
SECURITY CONCEPT LIKE PASSWORD AND ACCESS CONTROL MECHANISMS.
2.THE RISE OF PASSWORD :(1970’S) :
ONE OF THE EARLIEST SECURITY SYSTEMS DESIGNED FOR A MULTIPLE USER ENVIRONMENT .
UNIX SECURITY :
AS UNIX GAINED 1970’S AND 1980’S FILE PERMISSIONS AND PASSWORD PROTECTION, WERE
INTEGRAL PART OF THE SYSTEM .
SECURITY DESIGN :
THE BIRTH OF FIRST VIRUSES :
o IN THE EARLY 1970’S
o THE CONCEPT OF COMPUTER VIRUSES BEGAN TO EMERGE .
EXAMPLE: CREEPER VIRUSES .
3.THE ADVENT OF PUBLIC NETWORKS (1980’S):
ARPANET AND NETWORDED SECURITY :
FIRST TIME THAT MULTIPLE COMPUTER’S WERE CONNECTED IN A NETWORKED ENVIRONMENT
ALLOW FOR REMOTE ACCESS AND VULNERABILITY .
THE MORIS WORM (1988):
SELF REPLICATING MALWARE THAT CAUSED SIGNIFICANT DISRUPTION ACROSS THE ARPANET.
INTRODUCTION OF FIREWALLS :
AS THE NEED FOR NETWORK SECURITY INCREASED , THE CONCEPT OF FIREWALLS
MERGED TO PROTECT PRIVATE NETWORK FROM UNAUTHORIZED ACCESS.
THE 1990’S THE WEB AND HIJACKING CULUTURE EMERGES :
THE RISE OF THE WORLD WIDE WEB :
AS THE WEB BEGAN TO GAIN TRACTION, SOFTWARE VULNERABILITIES BECAME,MARE
PUBLICLY RECOGNIZED .
WEB SECURITY BECAME A SIGNIFICANT FOCUS WITH THE DEVELOPMENT OF BROWSER
BASED THREATS .
THE FIRST MAJOR MALWARE (1990’S):
DURING THIS PERIOD , MARE SOPHISTICATED FROMS OF MALWARE INCLUDING
TROJANS ,WORMS AND VIRUS STARTED TO SPREAD RAPIDLY .
THE LOVE BUG VIRUSES (2000’S):
FOR INSTANCE INFECTED MILLIONS OF COMPUTERS THROUGH EMAIL.
ETHICAL HACKING AND HACKER CULTURE :
THE 1990’S SAW THE RISE OF A MORE ORGANIZED HACKER CULTURE
INDIVIDUALS AND GROUPS STARTED TO EXPLOIT VULNERABILITIES FOR BOTH MALICIOUS
PURPOSES AND TO TEST AND IMPROVE SYSTEM SECURITY .
ETHICAL HACKING ALSO EMERGED AS A PROFESSION .DURING THIS TIME,WHERE SECURITY
PROFESSIONALS WOULD ATTEMPT TO FIND VULNERABILITIES BEFORE MALICIOUS HACKERS
COULD .
VULNERABILITIES AND EXPLOITS:
o MANY ATTACK SUCH AS SQL INJECTION AND CROSS-SIDE SCRIPTING (XSS) WERE FIRST
RECOGNIZED IN THE 1990’S.
o THE WIDESPREAD USE OF THE INTERNET LED TO MORE SYSTEMATIC IDENTIFICATION OF
SECURITY FLOWS IN WEB APPLICATION .
THE 2000’S :THE GROWING IMPORTANCE SOFTWARE SECURITY :
THE CONCEPT OF SOFTWARE ASSURANCE :
SOFTWARE ASSURANCE EMERGED AS AN ESSENTIAL CONCEPT, EMPHASSING THE SECURE
DESIGN, CODING AND MAINTENANCE OF APPLICATION .
WIDE SPREAD CYBER SECURITY THREATS:
ATTACKS PHISHING DENIAL OF SERVICE ATTACKS AND SPYWARE BECAME MORE COMMON AND
ORGANIZATION STARTED INVESTING MORE HEAVILY IN CYBER SECURITY TECHNOLOGIES .
ANTIVIRUS SOFTWARE AND INCLUSION DEDUCTION SYSTEM BECAME STAPLES IN ENTERPRISE
ENVIRONMENT .
BUFFER OVERFLOW ATTACKS :
o THE EXPLOITATION OF SUCH VULNERABILITIES LED TO SIGNIFICANT WAS WRITTEN WITH
DEVELOPERS STARTING TO ADOPT MORE SECURE CODING PRACTICES .
THE 2010’S CLOUD COMPUTING ,MOBILE APPS AND ADVANCED THREATS .
MOBILE SECURITY :
THE RAPID ADOPTION OF SMART PHONES AND MOBILE APPLICATION INTRODUCED . NEW
ATTACK VECTORS SUCH AS MOBILE MALWARE AND PRIVACY CONCERNS RELATED TO
PERMISSION .
SECURE DEVELOPMENT PRACTICE FOR MOBILE APPS,INCLUDING DATA ENCRYPTION AND APP
SAND BOXING BECAME CRITICAL.
CLOUD SECURITY :
NEW CHALEENGES EMERGED AROUND SCARING CLOUD INFRASTRUCTURE ,DATA STORAGE
AND MULITITALENT ENVIRONMENT .
IDENTITY AND I AM ALONG WITH ENCRYPTION BECAME CENTRAL TO CLOUD COMPUTING .
THE 2020’S :AI ZERO TRUST AND NEXT GENERATION THREATS :
ZERO TRUST ARCHITECTURE :
THE ZERO TRUST SECURITY MODEL WERE KNOWN ENTITY TRUSTED BY DEFAULT .
SUPPLY CHAIN ATTACKS LIFE SOL OR WIND HACK 2020 DEMONSTRATOR THE VULNERABILITIES
OF THE SOFTWARE SUPPORT CHAIN WHERE HACKERS TARGETER SOFTWARE VENDORS TO GAIN
ACCESS TO THEY CUSTOMERS NETWORKS .
PRIVACY REGULATION :
WITH GROWING CO NCERN OVER USER PRIMARY REGULATION LIKE GDPR MN0PR (GENERAL
DATA PRODUCTION REGULATION ) IN THE YEAR 2018. AND CCPA (CALIFORNIA CONSUMER
PRIVATE ATTACK) .AT CALIFORNIA CONSUMER PRIVACY HACK BEGAN TO STRICT REQUIREMENT
FOR SECURING PERSONAL DATA .ONGOING TRENDS AND CHALLENGES. THE INTEGRATION
SECURITY PRACTICES INTO DEPARTMENT PIPELINE IS BECOMING INCREASING THE IMPORTANT .
MOMENT ENSURE THAT SECURITY IS THAT PART OF DEVELOP AND DEPLOYMENT LIFE CYCLE.
