application security this article is part of a series oninformation security related security categories internet security cyberwarfare computer security mobile security network security threats computer crime vulnerability eavesdropping malware spyware ransomware trojans viruses worms rootkits bootkits keyloggers screen scrapers exploits backdoors logic bombs payloads denial of service defenses computer access control application security antivirus software secure coding secure by default secure by design secure operating systems authentication multifactor authentication authorization datacentric security encryption firewall intrusion detection system mobile secure gateway runtime application selfprotection rasp vte application security encompasses measures taken to improve the security of an application often by finding fixing and preventing security vulnerabilities different techniques are used to surface such security vulnerabilities at different stages of an applications lifecycle such design development deployment upgrade maintenance an always evolving but largely consistent set of common security flaws are seen across different applications see common flaws terms asset a resource of value such as the data in a database money in an account file on the filesystem or any system resource vulnerability a weakness or gap in security program that can be exploited by threats to gain unauthorized access to an asset attack or exploit an action taken to harm an asset threat anything that can exploit a vulnerability and obtain damage or destroy an asset techniques different techniques will find different subsets of the security vulnerabilities lurking in an application and are most effective at different times in the software lifecycle they each represent different tradeoffs of time effort cost and vulnerabilities found whitebox security review or code review this is a security engineer deeply understanding the application through manually reviewing the source code and noticing security flaws through comprehension of the application vulnerabilities unique to the application can be found blackbox security audit this is only through use of an application testing it for security vulnerabilities no source code required design review before code is written working through a threat model of the application sometimes alongside a spec or design document tooling there exist many automated tools that test for security flaws often with a higher false positive rate than having a human involved coordinated vulnerability platforms these are hackerpowered application security solutions offered by many websites and software developers by which individuals can receive recognition and compensation for reporting bugs utilizing these techniques appropriately throughout the software development life cycle sdlc to maximize security is the role of an application security team application threats attacks according to the patterns practices improving web application security book the following are classes of common application security threats attacks category threats attacks input validation buffer overflow crosssite scripting sql injection canonicalization software tampering attacker modifies an existing applications runtime behavior to perform unauthorized actions exploited via binary patching code substitution or code extension authentication network eavesdropping brute force attack dictionary attacks cookie replay credential theft authorization elevation of privilege disclosure of confidential data data tampering luring attacks configuration management unauthorized access to administration interfaces unauthorized access to configuration stores retrieval of clear text configuration data lack of individual accountability overprivileged process and service accounts sensitive information access sensitive code or data in storage network eavesdropping codedata tampering session management session hijacking session replay man in the middle cryptography poor key generation or key management weak or custom encryption parameter manipulation query string manipulation form field manipulation cookie manipulation http header manipulation exception management information disclosure denial of service auditing and logging user denies performing an operation attacker exploits an application without trace attacker covers his or her tracks the owasp community publishes a list of the top 10 vulnerabilities for web applications and outlines best security practices for organizations and while aiming to create open standards for the industry category threats attacks injection sql injection nosql os command objectrelational mapping ldap injection broken authentication credential stuffing brute force attacks weak passwords sensitive data exposure weak cryptography unenforced encryption xml external entities xml external entity attack broken access control cors misconfiguration force browsing elevation of privilege security misconfiguration unpatched flaws failure to set security values in settings out of date or vulnerable software crosssite scripting xss reflected xss stored xss dom xss insecure deserialization object and data structure is modified data tampering using components with known vulnerabilities out of date software failure to scan for vulnerabilities failure to fix underlying platform frameworks failure to updated or upgraded library compatibility insufficient logging monitoring failure to log auditable events failure to generate clear log messages inappropriate alerts failure to detect or alert for active attacks in or near realtime mobile application security mobile security the proportion of mobile devices providing open platform functionality is expected to continue to increase in future the openness of these platforms offers significant opportunities to all parts of the mobile ecosystem by delivering the ability for flexible program and service delivery options that may be installed removed or refreshed multiple times in line with the users needs and requirements however with openness comes responsibility and unrestricted access to mobile resources and apis by applications of unknown or untrusted origin could result in damage to the user the device the network or all of these if not managed by suitable security architectures and network precautions application security is provided in some form on most open os mobile devices symbian os there are several strategies to enhance mobile application security including application white listing ensuring transport layer security strong authentication and authorization encryption of data when written to memory sandboxing of applications granting application access on a perapi level processes tied to a user id predefined interactions between the mobile application and the os requiring user input for privilegedelevated access proper session handling security testing for applications security testing techniques scour for vulnerabilities or security holes in applications these vulnerabilities leave applications open to exploitation ideally security testing is implemented throughout the entire software development life cycle sdlc so that vulnerabilities may be addressed in a timely and thorough manner unfortunately testing is often conducted as an afterthought at the end of the development cycle with the growth of continuous delivery and devops as popular software development and deployment models vulnerability scanners and more specifically web application scanners otherwise known as penetration testing tools ie ethical hacking tools have been historically used by security organizations within corporations and security consultants to automate the security testing of http requestresponses however this is not a substitute for the need for actual source code review physical code reviews of an applications source code can be accomplished manually or in an automated fashion given the common size of individual programs often 500000 lines of code or more the human brain cannot execute a comprehensive data flow analysis needed in order to completely check all circuitous paths of an application program to find vulnerability points the human brain is suited more for filtering interrupting and reporting the outputs of automated source code analysis tools available commercially versus trying to trace every possible path through a compiled code base to find the root cause level vulnerabilities there are many kinds of automated tools for identifying vulnerabilities in applications some require a great deal of security expertise to use and others are designed for fully automated use the results are dependent on the types of information source binary http traffic configuration libraries connections provided to the tool the quality of the analysis and the scope of vulnerabilities covered common technologies used for identifying application vulnerabilities include static application security testing sast is a technology that is frequently used as a source code analysis tool the method analyzes source code for security vulnerabilities prior to the launch of an application and is used to strengthen code this method produces fewer false positives but for most implementations requires access to an applications source code dynamic application security testing dast is a technology which is able to find visible vulnerabilities by feeding a url into an automated scanner this method is highly scalable easily integrated and quick dasts drawbacks lie in the need for expert configuration and the high possibility of false positives and negatives interactive application security testing iast is a solution that assesses applications from within using software instrumentation this technique allows iast to combine the strengths of both sast and dast methods as well as providing access to code http traffic library information backend connections and configuration information security protection for applications the advances in professional malware targeted at the internet customers of online organizations have seen a change in web application design requirements since 2007 it is generally assumed that a sizable percentage of internet users will be compromised through malware and that any data coming from their infected host may be tainted therefore application security has begun to manifest more advanced antifraud and heuristic detection systems in the backoffice rather than within the clientside or web server code coordinated vulnerability disclosure the cert coordination center describes coordinated vulnerability disclosure cvd as a process for reducing adversary advantage while an information security vulnerability is being mitigated cvd is an iterative multiphase process that involves multiple stakeholders users vendors security researchers who may have different priorities and who must work together to resolve the vulnerability because cvd processes involve multiple stakeholders managing communication about the vulnerability and its resolution is critical to success from an operational perspective many tools and processes can aid in cvd these include email and web forms bug tracking systems and coordinated vulnerability platforms security standards and regulations cert secure coding cwe disastig grammleachbliley act health insurance portability and accountability act hipaa isoiec 2703412011 information technology security techniques application security part 1 overview and concepts isoiec tr 247722013 information technology programming languages guidance to avoiding vulnerabilities in programming languages through language selection and use nist special publication 80053 owasp pci data security standard pci dss sarbanesoxley act sox countermeasure data security database security herasaf information security trustworthy computing security development lifecycle web application web application framework 