Introduction to Web security and Rational AppScan

This article will begin with an analysis of the current situation of Web applications, by listing common attack methods, to clarify the current challenges facing Web applications, at the same time, throughRationalThe AppScan platform helps enterprises develop Web Application Security Solutions and provide armor for their Web applications.

　　Preface

In today's world, Internet (Internet) has become a very important basic platform. Many enterprises have deployed applications on this platform to provide customers with more convenient and fast service support. These applications are constantly improved and improved in terms of functions and performance. However, they are not paid enough attention to very important security issues. As the network technology is becoming increasingly mature, hackers gradually shift their attention from attacks on network servers to attacks on Web applications. According to Gartner's latest survey, 75% of information security attacks occur on Web applications rather than the network layer. At the same time, the data shows that 2/3 of Web sites are quite fragile and vulnerable to attacks. However, the reality is that the vast majority of enterprises spend a lot of money on network and server security, without truly guaranteeing the security of Web applications and giving hackers a chance.

This article will begin with an analysis of the current situation of Web applications, and clarify the challenges faced by Web applications by listing common attack methods. At the same time, through the introduction of the Rational AppScan platform, assists enterprises in developing Web Application Security Solutions to provide armor for their Web applications.

　　Web Application Status

　　Basic concepts of Web Applications

Before discussing Web Application Security, let's briefly introduce the basic concepts of Web applications to help you understand why Web applications are vulnerable and vulnerable to attacks.

1. What is a Web application?

Web applications are composed of dynamic scripts and compiled code. It is usually deployed on a Web server. Users send requests in a Web browser. These requests use the HTTP protocol to interact with Enterprise Web applications over the Internet, the Web application communicates with the enterprise's back-end databases and other dynamic content.

2. Web application architecture

Although different enterprises may build different Web environments, a typical Web application is usually a standard three-tier architecture model, as shown in figure 1.

Figure 1: Web applications are typically a standard three-tier architecture model

　　

In this most common model, the client is the first layer; the dynamic Web content technology is the middle layer; and the database is the third layer. A user sends a request to the middle layer through a Web browser. The middle layer converts the request to query or update background data and displays the final result in the browser.

　　Web Application Security Overview

When discussing Web Application Security, we often hear the following answer:

We use firewalls, network vulnerability scanning tools, SSL technology, and penetration tests every quarter "...... Therefore, "our applications are secure ". Is that true? Let's take a look at the panorama of Web Application Security.

Figure 2: Information Security Panorama

　　

Different technologies are used to ensure security at all levels of Enterprise Web applications. To protect the security of client machines, users will install anti-virus software. To ensure the transmission security of user data to Enterprise Web servers, the communication layer usually uses SSL (Secure Sockets Layer) technology to encrypt data. Enterprises will use firewalls and IDS (intrusion diagnostic systems)/IPS (intrusion defense systems) to ensure that only specific access is allowed, and unnecessary exposure of ports and illegal access are allowed, it is blocked here. Even with a firewall, enterprises still use the identity authentication mechanism to authorize users to access Web applications.

However, even with anti-virus protection, firewalls, and IDS/IPS, enterprises still have to allow some communications to pass through the firewall. After all, the purpose of Web applications is to provide services for users, protection measures can disable unnecessary exposed ports, but Web applications must open ports 80 and 443. This part of the communication that can be successfully passed may be in good faith or malicious nature, which is difficult to identify. It should be noted that a Web application is composed of software, so it will certainly contain bugs that can be exploited by malicious users, they steal, manipulate, or

Attackers can destroy important information in Web applications.

Therefore, we can see that the enterprise's answer does not really guarantee the application security of the enterprise:

• The network vulnerability scanning tool is only used to analyze vulnerabilities at the network layer and does not understand the application itself. Therefore, it cannot completely improve the security of Web applications;
• The firewall can block access to important ports, but ports 80 and 443 must always be open. We cannot determine whether the communication data in the two ports is malicious or malicious;
• SSL can encrypt data, but it only protects data security during transmission and does not protect Web applications;
• Quarterly penetration tests cannot meet the needs of constantly changing applications.
• As long as the access can pass through the enterprise's firewall smoothly, Web applications will be displayed to users without reservation. Only by enhancing the security of Web applications is the real solution to Web Application Security.

　　Common Web application attacks

　　Two important international application security organizations

Before discussing common Web application attacks, we need to understand two organizations: WASC and OWASP. These two organizations have played an important role in calling on enterprises to strengthen their application security awareness and guide enterprises to develop secure Web applications.

Web Application Security Consortium (WASC) is an international group composed of Security experts, industry consultants, and representatives of many organizations. They are responsible for developing widely accepted application security standards for WWW. One of WASC's key projects is "Web security threat Classification", which describes the threats and attacks to Web applications and classifies them into common features. This project aims to develop and promote industry standard terms for security risks of Web applications. WASC classifies Web Application Security threats into the following six categories:

　　Authentication)

Attack methods used to identify a user, service, or application.

　　Authorization (Authorization)

It is used to determine whether a user, service, or application has the necessary permissions to execute the request action.

　　Client-Side Attacks (customer-Side attack)

Attack methods used to disrupt or detect Web site users.

　　Command Execution)

Attackers can execute remote commands on websites.

　　Information Disclosure (Information exposure)

Attackers can exploit this vulnerability to obtain system information of a website.

　　Logical Attacks (Logical attack)

Attack means used to disrupt or detect the logic flow of Web applications.

You can visit the website of the organization through the following URL for more details: www.webappsec.org. You can also refer to the link in the document to learn more about the "Web security threat Classification" project.

Open Web Application Security Project (OWASP), the organization is committed to discovering the root cause of unsecure Web applications. One of their most important projects is "top ten security risks of Web applications". This section summarizes the ten most common attacks against Web applications and sorts them according to the probability of attacks. This project aims to unify the most critical Web application security risks in the industry and enhance enterprises' awareness of Web Application Security.

Figure 3: Top Ten security risks of Web Applications

　　

You can visit the organization on the following URL for more details: www.owasp.org. You can also go to the link in the reference documents to learn more about the "Top Ten security risks of Web Applications" project.

IBM Rational is a member of the above two organizations. Common Web application attack examples

Among the top ten Web Application Security risks listed by OWASP, there are two most likely attack methods: Cross-Site Scripting) and Injection Flaws ). The following is an example of how these two attacks are implemented.

1. Cross-Site Scripting

First, let's take a look at the use process of Cross-Site Scripting, 4.

Figure 4 Cross-Site Scripting