Scribd
Upload
111 views

Web Application Security

The document discusses security goals and threats related to web applications. The goal of security is to maintain confidentiality, integrity, and availability of information. Common security threats include spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Various mitigation approaches are outlined such as authentication, encryption, access controls, and input validation to address these threats. The Open Web Application Security Project (OWASP) provides tools and resources to help developers secure web applications.

Uploaded by

Daffy Duck
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
111 views

Web Application Security

The document discusses security goals and threats related to web applications. The goal of security is to maintain confidentiality, integrity, and availability of information. Common security threats include spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Various mitigation approaches are outlined such as authentication, encryption, access controls, and input validation to address these threats. The Open Web Application Security Project (OWASP) provides tools and resources to help developers secure web applications.

Uploaded by

Daffy Duck
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 12

Web Application Security

The Goal of Security


The goal of software security is to maintain the confidentiality, integrity,
and availability of information resources in order to enable successful
business operations

This goal is accomplished through the implementation of security controls


The Goal of Security
Information is probably the most valuable item we now have

Malicious users are looking for ways to steal users’ data and identities by
sneaking into insecure applications
Security Attack Categories
Spoofing impersonating something or someone else

Tampering modifying something you’re not supposed to modify. It can


include packets on the wire (or wireless), bits on disk, or the bits in memory

Repudiation claiming you didn’t do something

Denial of Service attacks designed to prevent a system from providing


service, including by crashing it, making it unusably slow, or filling all its
storage
Security Attack Categories
Information Disclosure exposing information to people who are not
authorized to see it

Elevation of Privilege when a program or user is technically able to do things


that they’re not supposed to do
Threat Mitigation Approach
What can you do to prevent these attacks?

Threat Type Property Violated Mitigation Approach

Spoofing Authentication

Tampering Integrity

Repudiation Non-repudiation

Information Disclosure Confidentiality

Denial of Service Availability

Elevation of Privilege Authorization


Threat Mitigation Approach
Threat Type Property Violated Mitigation Approach

Passwords, Multi-Factor
Spoofing Authentication
Authentication, Digital Signature

Tampering Integrity Permissions/ACLs, Digital Signature

Secure Logging and Auditing, Digital


Repudiation Non-repudiation
Signature

Information Disclosure Confidentiality Encryption, Permissions/ACLs

Denial of Service Availability Quotas, Permissions/ACLs

Elevation of Privilege Authorization Permissions/ACLs, Input Validation


Open Web Application Security Project (OWASP)
The Open Web Application Security Project® (OWASP)

is a nonprofit foundation that works to improve the security of software

OWASP Foundation is the source for developers and technologists to


secure the web

OWASP provides

tools and resources

community and networking

education & training


Top 10 Web Application Security Risks
Comparing top 10 during 2017 and 2021

There are new risks in 2021

https://owasp.org/www-project-top-ten/
OWASP Secure Coding Checklist
Input Validation Data Protection

Output Encoding Communication Security

Authentication & Password Management System Configuration

Session Management Database Security

Access Control File Management

Cryptographic Practices Memory Management

Error Handling & Logging


Security in NestJS
https://docs.nestjs.com/security
Further References
https://www.owasp.org/index.php/OWASP_Guide_Project
https://www.owasp.org/index.php/Category:OWASP_Code_Review_P
roject
https://www.owasp.org/index.php/OWASP_Secure_Coding_Practice
s_-_Quick_Reference_Guide
https://www.owasp.org/images/b/ba/Web_Application_Developmen
t_Dos_and_Donts.ppt

You might also like