Web Application Security: What You Need to Know to Minimize Threats

Learn how practicing the basics of web application security and keeping up with the threat landscape can help keep your business secure.

When it comes to threat actors breaking into corporate networks and stealing data, most attacks start with relatively well-known vulnerabilities in web applications — the same ones corporations use to interact with their customers and the public at large.

“Web applications are still the top attack vector in terms of creating or causing data breaches,” said Nate Dyer, a senior product marketing manager at Tenable. And while web application security remains a major issue for enterprises, a few basic preventative measures can keep sensitive business and customer data safe.

During the recent Tenable webinar, Protect Your Web Applications from Component Vulnerabilities, Dyer and Eric Detoisien, Director of Research for Web Application Scanning (WAS) Content, discussed how — by paying attention to vulnerabilities and the threat landscape — businesses of all sizes can help pare back some of the attacks that can lead to a data breach and the headlines that come with it.

Web Application Security Basics

While web application vulnerabilities are the top source for data breaches in the enterprise, specific industries are more susceptible than others. These include healthcare, retail and even some public sector and government agencies — basically any organization that deals in large amounts of personally identifiable information (PII), credit card numbers or other types of customer data attackers look for during a breach.

At the same time, web applications — even the most simple looking, static webpage — are fairly complex. There’s the underlying content management system (CMS) that most pages are built on. Then there are the libraries and frameworks used to build these apps. And, finally, there’s typically custom code developers create to add functionality and other features for the businesses using these sites.

Each of these layers presents its own level of risk to the business. For example, the custom-code layer within most web applications is vulnerable to any of the Open Web Application Security Project (OWASP) Top 10 issues, including injections, misconfigurations or cross-site scripting.

Meanwhile, third-party web application components create their own unique set of problems. As an example, Dyer and Detoisien discussed Apache Struts and the unpatched vulnerability that eventually led to the breach at Equifax, which affected nearly 150 million customers and resulted in executive shake-ups, federal investigations and Congressional hearings. The issues with various CMS platforms are also well documented. “It seems every month, there’s a new vulnerability or a new exploit associated with either WordPress or Drupal or Joomla,” Dyer said.

Given the trove of personal data potentially accessible via web applications, it’s no surprise that attackers will swarm to take advantage of a vulnerability. Once a vulnerability is discovered, threat actors use what Detoisien described as “spray and raid” tactics to hit as many apps as possible before patches are rolled out, giving them enough victims to make the hacking profitable.

Web Application Scanning: Consider your Components

Dyer and Detoisien discussed two main themes for security professionals to remember to help prevent attacks on web applications:

• Basic cyber hygiene will address many weaknesses. If your business is able to detect the vulnerability and your security team is able to prioritize the remediation based on the actual cyber risk, this is a hugely important way to help secure web applications, as well as other types of IT assets on the network.
• Keeping abreast of the latest vulnerabilities and patches can prevent a breach. Many of the most basic web application components, such as jQuery plugin, are widely used, and attackers take advantage of these components for their purposes, so it’s worth keeping up with the latest security alerts and updates from the major application providers.

Once you’ve got the basics down, Dyer and Detoisien recommend making sure you’re assessing all the external components comprising your web applications. These can include web app servers, a CMS, web frameworks, JavaScript libraries and language engines. This involves:

• identifying all the entry points within various web apps;
• fingerprinting all components within the app, which can help assess what versions of the components your business is running; and
• assessing the components for flaws, such as misconfigurations.

Practicing these tactics can take your web application security plan beyond looking at the OWASP Top 10, giving you a much fuller view not only of the apps your business is running, but the components that make up those applications. Armed with this level of detail, your security team can make smarter decisions when it comes to assessing risk and rolling out patches to address critical flaws and vulnerabilities.

Learn More:

• View the on-demand webinar: Protect Your Web Applications from Component Vulnerabilities 
• Download the eBook: 5 Best Practices for Web Application Security
• Read the 2018 Application Security Report