Cloud Security Authors: Pat Romanski, Yeshim Deniz, Ed Featherston, Elizabeth White, Liz McMillan

Related Topics: Microservices Expo, Cloud Security

Microservices Expo: Article

Common Web Application Security Vulnerabilities and Mitigation

It's easy to avoid common vulnerabilities with little precaution

Web applications are vulnerable to a multitude of security attacks. This exposes the underlying businesses and the consumer data to public view. However it is a common observation that web developers hardly take any preventive steps to secure their web applications.

Most of the time web application developers focus only on authentication and authorization to secure the web applications. This may be a viable approach for designing an intranet application. However, for the Internet application, multiple programming practices need to be followed to prevent such attacks.

This article details in brief the various security vulnerabilities web applications face and how they can be mitigated.

Bypassing Input Validation
Generally developers validate the user input using JavaScript validations. Once the information is sent to the server side, developers do not validate again, since they assume that JavaScript validations can block all invalid data.

Hackers, however, can simply save the page to their local hard disk and modify the JavaScript to not do the validation. They can then submit the page.

All input should be validated twice - first on the client side and then on the server side. Client-side validation is done using Java Script. The server-side validation is done using the respective server-side technology like Java, .NET or PHP

SQL Injection
An attacker can submit input that would pass the JavaScript and server-side validation. However, the input is actually an SQL query. Since the input is used to construct the SQL queries, such an input would alter the SQL query and give unauthorized information back to the attacker.

Use Prepared Statements to fire queries. Don't use string concatenation with the user input to create dynamic queries

Unprotected Resources
The attacker can guess the URLs of unprotected resources. Such information can be divulged by reading the code comments or it could be guessed.

All web content must be protected by authentication. In the case of Java web application programming, keep all the unprotected and sensitive code under WEB-INF. A similar solution exists for PHP and other server-side technologies.

Reverse Engineering
For rich client applications such as those using Java Applets, Adobe Flex, Microsoft Silverlight, etc., the entire byte code gets transmitted to the client side. An attacker can decompile the byte code and gain sensitive information.

The client-side code shouldn't contain any business logic. It also shouldn't contain business logic validation. The code should be obfuscated before sending to the client.

Weak Authentication
Many times attackers can gain access to a secure website by using common terms like ‘admin,' ‘test,' etc. Developers often use these user names and passwords for testing purposes and often forget to remove them from the production systems.

Developers should not be given access to a production database for testing purposes. All testing must happen in UAT and it should use real user names and passwords.

Cross-Site Scripting (XSS)
When you open two websites in two different browser tabs, you don't expect one website on a given tab to steal your passwords from another tab.

However, this is possible, if you are using an old version of the browser or if you're using an infected browser

Encourage users to upgrade to the latest version of the browsers. Also technologies that use secure sandboxing such as Java Applets and Adobe Flex and many others should be used for creating rich-client applications.

About 80% of all web security breaches can be prevented by addressing the above vulnerabilities. A regular code review is very much required to correct the oversight on the part of programmers.

There are also various tools available that will detect the common vulnerabilities for you. Many of these tools, however, generate false positives and need substantial time to separate false positives from real alerts.

Ultimately these tools can't fix the code. That has to be done by the developer. Thus, appropriate review procedures must be established and awareness should be propagated to educate developers on the vulnerabilities and their mitigation.

More Stories By Mahesh K Punjabi

Mahesh K Punjabi is a senior technology architect with Infosys Technologies Ltd. He has extensive experience designing enterprise applications using Java and multitude of RIA technologies including Flex and GWT. His other passions include photography and speaking with Toastmasters' clubs.

@ThingsExpo Stories
Successful digital transformation requires new organizational competencies and capabilities. Research tells us that the biggest impediment to successful transformation is human; consequently, the biggest enabler is a properly skilled and empowered workforce. In the digital age, new individual and collective competencies are required. In his session at 19th Cloud Expo, Bob Newhouse, CEO and founder of Agilitiv, will draw together recent research and lessons learned from emerging and established ...
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Amazon has gradually rolled out parts of its IoT offerings, but these are just the tip of the iceberg. In addition to optimizing their backend AWS offerings, Amazon is laying the ground work to be a major force in IoT - especially in the connected home and office. In his session at @ThingsExpo, Chris Kocher, founder and managing director of Grey Heron, explained how Amazon is extending its reach to become a major force in IoT by building on its dominant cloud IoT platform, its Dash Button strat...
@ThingsExpo has been named the Top 5 Most Influential M2M Brand by Onalytica in the ‘Machine to Machine: Top 100 Influencers and Brands.' Onalytica analyzed the online debate on M2M by looking at over 85,000 tweets to provide the most influential individuals and brands that drive the discussion. According to Onalytica the "analysis showed a very engaged community with a lot of interactive tweets. The M2M discussion seems to be more fragmented and driven by some of the major brands present in the...
We are reaching the end of the beginning with WebRTC, and real systems using this technology have begun to appear. One challenge that faces every WebRTC deployment (in some form or another) is identity management. For example, if you have an existing service – possibly built on a variety of different PaaS/SaaS offerings – and you want to add real-time communications you are faced with a challenge relating to user management, authentication, authorization, and validation. Service providers will w...
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
SYS-CON Media announced today that @WebRTCSummit Blog, the largest WebRTC resource in the world, has been launched. @WebRTCSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. @WebRTCSummit Blog can be bookmarked ▸ Here @WebRTCSummit conference site can be bookmarked ▸ Here
SYS-CON Events announced today that Streamlyzer will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Streamlyzer is a powerful analytics for video streaming service that enables video streaming providers to monitor and analyze QoE (Quality-of-Experience) from end-user devices in real time.
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
One of biggest questions about Big Data is “How do we harness all that information for business use quickly and effectively?” Geographic Information Systems (GIS) or spatial technology is about more than making maps, but adding critical context and meaning to data of all types, coming from all different channels – even sensors. In his session at @ThingsExpo, William (Bill) Meehan, director of utility solutions for Esri, will take a closer look at the current state of spatial technology and ar...
SYS-CON Events announced today that SoftNet Solutions will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. SoftNet Solutions specializes in Enterprise Solutions for Hadoop and Big Data. It offers customers the most open, robust, and value-conscious portfolio of solutions, services, and tools for the shortest route to success with Big Data. The unique differentiator is the ability to architect and ...
The IoT industry is now at a crossroads, between the fast-paced innovation of technologies and the pending mass adoption by global enterprises. The complexity of combining rapidly evolving technologies and the need to establish practices for market acceleration pose a strong challenge to global enterprises as well as IoT vendors. In his session at @ThingsExpo, Clark Smith, senior product manager for Numerex, will discuss how Numerex, as an experienced, established IoT provider, has embraced a ...
Cloud based infrastructure deployment is becoming more and more appealing to customers, from Fortune 500 companies to SMEs due to its pay-as-you-go model. Enterprise storage vendors are able to reach out to these customers by integrating in cloud based deployments; this needs adaptability and interoperability of the products confirming to cloud standards such as OpenStack, CloudStack, or Azure. As compared to off the shelf commodity storage, enterprise storages by its reliability, high-availabil...
Donna Yasay, President of HomeGrid Forum, today discussed with a panel of technology peers how certification programs are at the forefront of interoperability, and the answer for vendors looking to keep up with today's growing industry for smart home innovation. "To ensure multi-vendor interoperability, accredited industry certification programs should be used for every product to provide credibility and quality assurance for retail and carrier based customers looking to add ever increasing num...
In the next forty months – just over three years – businesses will undergo extraordinary changes. The exponential growth of digitization and machine learning will see a step function change in how businesses create value, satisfy customers, and outperform their competition. In the next forty months companies will take the actions that will see them get to the next level of the game called Capitalism. Or they won’t – game over. The winners of today and tomorrow think differently, follow different...
“Media Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. CloudBerry Backup is a leading cross-platform cloud backup and disaster recovery solution integrated with major public cloud services, such as Amazon Web Services, Microsoft Azure and Google Cloud Platform.
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in Embedded and IoT solutions, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 7-9, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/Big Data, HPC and ...
Web Real-Time Communication APIs have quickly revolutionized what browsers are capable of. In addition to video and audio streams, we can now bi-directionally send arbitrary data over WebRTC's PeerConnection Data Channels. With the advent of Progressive Web Apps and new hardware APIs such as WebBluetooh and WebUSB, we can finally enable users to stitch together the Internet of Things directly from their browsers while communicating privately and securely in a decentralized way.
For basic one-to-one voice or video calling solutions, WebRTC has proven to be a very powerful technology. Although WebRTC’s core functionality is to provide secure, real-time p2p media streaming, leveraging native platform features and server-side components brings up new communication capabilities for web and native mobile applications, allowing for advanced multi-user use cases such as video broadcasting, conferencing, and media recording.
SYS-CON Events announced today that LeaseWeb USA, a cloud Infrastructure-as-a-Service (IaaS) provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LeaseWeb is one of the world's largest hosting brands. The company helps customers define, develop and deploy IT infrastructure tailored to their exact business needs, by combining various kinds cloud solutions.