Web application security program

First, I stop all the bleeding, and then I create processes and security awareness for developers. When you have a secure coding training, a bunch of developers will self-identify as the security developer. There will be one person who asks multiple questions.

Natalia: What are some of the key performance indicators KPIs for measuring security posture? Tanya: As application security professionals, we want to minimize the risk of scary apps and then try to bring everything across the board up to a higher security posture. Each organization sets that differently. For an application security program, I would measure that every app receives security attention in every phase of the software development life cycle.

For a program, I take inventory of all their apps and APIs. Once you have an inventory, you want to figure out if you can do a quick dynamic application security testing DAST scan on everything.

You will see it light up like a Christmas tree on some, and on others, it found a couple of lows. You can scan a whole bunch of things quickly and see OK, so these things are terrifying, these things look OK.

Danger, Will Robinson, danger. The security person wants to spend time with us. What have we done wrong? I like the STRIDE methodology , where each of the letters represents a different thing that you need to worry about happening to your apps.

Specifically, spoofing, tampering, repudiation, information disclosure, denial of service DOS , and elevation of privilege. Could someone pretend to be someone else? Could someone pretend to be you? With threat modeling in the cloud, you must ask more questions, especially if your organization has had previous problems.

You want to ask about those because there will be patterns. Natalia: How can security professionals convince decision-makers to invest in AppSec? Tanya: I have a bunch of tricks. The first one is to give presentations on AppSec. I would do lunch and learns. Web Application Security Perpetrators consider web applications high-priority targets due to: The inherent complexity of their source code, which increases the likelihood of unattended vulnerabilities and malicious code manipulation.

High value rewards, including sensitive private data collected from successful source code manipulation. Ease of execution, as most attacks can be easily automated and launched indiscriminately against thousands, or even tens or hundreds of thousands of targets at a time.

Such vulnerabilities enable the use of different attack vectors, including: SQL Injection — Occurs when a perpetrator uses malicious SQL code to manipulate a backend database so it reveals information.

Consequences include the unauthorized viewing of lists, deletion of tables and unauthorized administrative access. Stored XSS occurs when malicious code is injected directly into an application. Remote File Inclusion — A hacker uses this type of attack to remotely inject a file onto a web application server.

This can result in the execution of malicious scripts or code within the application, as well as data theft or manipulation. Cybersecurity Trends and Predictions Register Now. See how Imperva Web Application Firewall can help you with web application security. Request demo Learn more. Article's content. Latest Blogs. Application Security Application Delivery Data Security. Erez Hasson , Bruce Lynch.

Application Delivery Application Security. Application Delivery. Pamela Weaver. Bruce Lynch. Eyal Gur. Erez Hasson. DDoS Mitigation Grainne McKeever. Latest Articles.