Web Security Considerations

Web Security deals with the security of data over the internet/network or web while it is being transferred to the internet. Websites are always prone to security threats/risks. Hacking of Website may result in theft of important Customer Data.

Security attacks are mainly aimed at stealing altering or destroying a piece of personal and confidential information, stealing the hard drive space, illegally accessing passwords.

Security Consideration:

• Updated Software: It is mandatory to keep your software updated, It plays an important role in keeping your personal data secure. Hackers may be aware of vulnerabilities in certain software, which are sometimes caused by bugs and can be used to damage your computer system and steal personal data. Older versions of software can become a gateway for hackers to enter your network. There is a need to always update software which will fix vulnerable or exposed areas.

• Beware of SQL Injection: SQL Injection is an attempt to manipulate your data or your database by inserting a rough code into your query. One should be aware of the SQL injection attack.

• Cross-Site Scripting (XSS): XSS allows the attackers to insert client-side script into web pages. It is a term used to describe a class of attacks that allow an attacker to inject client-side scripts into other users’ browsers through a website. As the injected code enters the browser from the site, the code is reliable and can do things like sending the user’s site authorization cookie to the attacker.

• Error Messages: Error messages are generated to give the information to the users while users access the website and some error messages are generated due to one or another reason. Provider should be very careful while providing the information to the users. For example a login attempt fails the error message should not let the user know which field is incorrect: Username or Password.

• Data Validation:  Validation of data should be performed on both server-side and client-side. Data validation should occur when data is received from an outside party, especially if the data is from untrusted sources.

• Password: Password provides the first line of defense against unauthorized access to your device and personal information. Hackers in many cases use sophisticated software that uses brute force to crack passwords. Passwords must be complex to protect against brute force. It is good to enforce password requirements such as a minimum of eight characters long must including uppercase letters, lowercase letters, special characters, and numerals.

Identity management and web services

Identity management (IdM), ensures that only authorized people have access to the technology resources they need to perform their job functions.

It includes polices and technologies that encompass an organization-wide process to properly identify, authenticate, and authorize people, groups of people, or software applications through attributes including user access rights and restrictions based on their identities.

Identity management works hand-in-hand with identity and access management (IAM) systems. Identity management is focused on authentication, while access management is aimed at authorization.

The main goal of identity management is to ensure only authenticated users are granted access to the specific applications, systems or IT environments for which they are authorized. This includes control over user provisioning and the process of onboarding new users such as employees, partners, clients and other stakeholders.

Identity management also includes control over the process of authorizing system or network permissions for existing users and the offboarding of users who are no longer authorized to access organization systems.

Identity management is an important part of the enterprise security plan, as it is linked to both the security and productivity of the organization.

Using identity management, organizations can safeguard their corporate assets against many threats including hacking, ransomware, phishing and other malware attacks.

Identity management systems add an additional layer of protection by ensuring user access policies and rules are applied consistently across an organization.

Web services will be the easiest and most affordable way to integrate one or more PACS (physical access control system) to an IDMS, enabling enterprise-wide, policy-driven access management. While Web services technologies and standards are still evolving, most of the challenges that remain are in the realm of Internet-based services intended for widespread general use and business-to-business e-commerce.

A Web services “wrapper” can be used as appropriate for the various access control system interface capabilities. (A wrapper is software code that changes an existing interface to an application without substantially increasing its functionality.)

Implementation of an enterprise-wide identity management system

The implementation of an enterprise-wide identity management system is of great interest to corporate security for several reasons.

• An IDMS will close IT security gaps related to enrolling and terminating employees.

• The deployment of an IDMS is typically accompanied by a role-based access control (RBAC) scheme for the information systems. Once roles are jointly defined by human resources and business managers, and once IT security privileges are assigned to the roles, security privileges can be automatically granted upon enrollment in the IDMS. Privileges are also automatically changed when an employee's position changes, and revoked automatically upon the employee's termination.

• Physical security can leverage the HR enrollment of employees by integrating the physical access control system (PACS) with the IDMS, so that access control privileges are managed automatically along with IT privileges as HR enrolls, re-assigns and terminates employees.

Using an IDMS as a common point of reference, physical and IT access control can be synchronized. And using role-based access control to establish privileges based upon job functions, both physical and IT access control can be policy-driven.

SOAP services - SOAP structure - Security risks

SOAP (Simple Object Access Protocol) is an XML (extensible markup language)-based messaging protocol for exchanging information among computers.

• SOAP is a communication protocol designed to communicate via Internet.
• SOAP can extend HTTP for XML messaging.
• SOAP provides data transport for Web services.
• SOAP can exchange complete documents or call a remote procedure.
• SOAP can be used for broadcasting a message.
• SOAP is platform- and language-independent.
• SOAP is the XML way of defining what information is sent and how.
• SOAP enables client applications to easily connect to remote services and invoke remote methods.

Although SOAP can be used in a variety of messaging systems and can be delivered via a variety of transport protocols, the initial focus of SOAP is remote procedure calls transported via HTTP.

SOAP provides a way to communicate between applications running on different operating systems, with different technologies and programming languages.

SOAP is a messaging protocol, meaning that SOAP security is primarily concerned with preventing unauthorized access to these messages and to users' information.

SOAP messages are secured through XML digital signature, confidentiality through XML encryption, and credential propagation through security tokens.

WS (Web Standards) Security is a set of principles that regulate the confidentiality and authentication procedures for SOAP messaging.

SOAP Message Structure:

Whenever a client application calls a method in the web service, the web service will automatically generate a SOAP message which will have the necessary details of the data which will be sent from the web service to the client application.

A simple SOAP Message has the following elements –

• The Envelope element
• The header element and
• The body element
• The Fault element (Optional)

The SOAP message is nothing but a mere XML document which has the below components.

• An Envelope element that identifies the XML document as a SOAP message –  is used to encapsulate all the details in the SOAP message. This is the root element in the SOAP message.
• The header element can contain information such as authentication credentials which can be used by the calling application. It can also contain the definition of complex types which could be used in the SOAP message.
• A Body element that contains call and response information - the actual data which needs to be sent between the web service and the calling application.
• The Fault element - When a request is made to a SOAP web service, the response returned can be of either two forms which are a successful response or an error response. When a success is generated, the response from the server will always be a SOAP message. But if SOAP faults are generated, they are returned as “HTTP 500” errors.

Common SOAP Security Risks

There are many different kinds of cyber security vulnerabilities and attacks, and some are uniquely aimed at APIs. A few of these are code injections, DoS (Denial of Service), breached or leaked access/authorization, XSS (Cross-site Scripting) and session hijacking.

Code Injections

Code injections, using SQL or, in the case of SOAP, XML, introduce malicious code into the database or application itself. The only way to prevent these is with careful access control.

Breached or Leaked Access/Authorization

The majority of attacks, including code injections, start with breached or leaked access. Making sure SOAP messages get revealed only to the correct user is one important part of SOAP security.

DoS

A Denial of Service, or Distributed Denial of Service (DDoS) attack overwhelms and disrupts a web service with messages that are too many or too long. SOAP security includes measures that can make DoS attacks impossible by limiting the length and volume of messages.  

XSS

Cross-site scripting is another form of code injection, but more specifically it occurs when someone injects malicious browser-side script into the web site through the web application. 

Session Hijacking

Session hijacking is another failure of access control. It occurs when an unauthorized user obtains a session ID. The user then has full access to the application and/or another user’s account. 

·         Building Secure Web Services

In order to create a secure SOAP web service, you need to add a security layer through the SOAP header. A security credential to the SOAP header is added. The username and password as variables added so that each time SOAP message is generated, these credentials are also generated as part of the header. This way, whenever the user calls the web service, it requires the password and username.

The protections that SOAP can offer include regular testing, IAM (Identity and Access Management), request monitoring, input validation and redundant security standards.  

Regular Testing - Various types of tests can be performed to ensure that the API will stand up to any possible threats and to find any vulnerabilities that attackers might exploit. These types of tests include fuzz testing and injection testing, among others.

The fuzz testing can be used to determine how the API reacts to an unexpected input. The injection testing can be used to detect vulnerabilities where a hacker might introduce malicious code. 

Identity and Access Management - It is one of the most basic and essential aspects of cyber security. It involves everything from passwords and usernames to advanced authentication techniques.

IAM prevents unauthorized users from accessing the application at the wrong time or stealing another user’s session token and hijacking the session. 

Request Monitoring - Monitoring requests and SOAP messaging for any abnormalities is another important part of security.

Request monitoring makes it much more likely to be able to solve vulnerabilities or data leaks quickly. In order to monitor requests, a logging system is required that can checked on a regular basis for any irregularities. 

Input Validation - There are two aspects of input validation for SOAP: Schema compliance validation and SOAP response validation. 

Schema compliance validation ensures that the message is in accordance with XML schema and the WSDL (Web Service Description Language). 

SOAP response validation ensues that the response to your message is in the correct format. 

Redundant Security Standards

WSDL, XML standards and SOAP standards overlap in many places. These redundant security standards give a level of insurance obtained by few other systems. 

HTTP – Security

HTTP stands for Hypertext Transfer Protocol, and it is a protocol – or a prescribed order and syntax for presenting information – used for transferring data over a network. Most information that is sent over the Internet, including website content and API calls, uses the HTTP protocol. There are two main kinds of HTTP messages: requests and responses.

HTTP requests are generated by a user's browser as the user interacts with web properties. These HTTP requests all go to either an origin server or a proxy caching server, and that server will generate an HTTP response. HTTP responses are answers to HTTP requests.

HTTP is used for communications over the internet, so application developers, information providers, and users should be aware of the security limitations in HTTP/1.1.

Suggestions for reducing security risks are:

Personal information

Users must be very careful to prevent unintentional leakage of information via the HTTP protocol to other sources.

HTTP cannot regulate the content of data that is transferred. HTTP cannot have any prior method to determine the sensitivity of any particular part of the information within the context of any request.

All the confidential information should be stored at the server in encrypted form.

Authors of services that use the HTTP protocol should not use GET based forms for the submission of sensitive data, because it will cause the data to be encoded in the Request-URI (Uniform resource identifier).

File and Path Names Based Attack

The documents returned by HTTP requests should be restricted to be only those that were intended by the server administrators.

An HTTP server MUST disallow any such construct in the Request-URI, if it would otherwise allow access to a resource outside those intended to be accessible via the HTTP server.

DNS Spoofing

Clients using HTTP depend heavily on the Domain Name Service, and are thus generally prone to security attacks based on the deliberate mis-association of IP addresses and DNS names.

Clients need to be cautious in assuming the continuing validity of an IP number/DNS name association.

If the clients of HTTP cache the results of hostname lookups to improve the performance, they must observe the TTL information, which was reported by the DNS. When the IP address of the previously accessed server is changed, then the HTTP clients could be spoofed if they do not observe this rule.

Authentication Credentials and Idle Clients

Existing HTTP clients and user agents typically retain authentication information indefinitely. HTTP/1.1 does not provide a method for a server to direct clients to discard these cached credentials which are a big security risk.

It is recommended to make the use of password protection in screen savers, idle time-outs, and other methods that mitigate the security problems inherent in this problem.

Proxies and Caching

Proxies have access to security-related information, personal information about individual users and organizations, and proprietary information belonging to users and content providers. Proxy systems should be protected as they contains or transports sensitive information.

Caching proxies provide additional potential vulnerabilities, since the contents of the cache represent an attractive target for malicious exploitation. Therefore, cache contents should be protected as sensitive information.

Web application security

Web application security refers to a variety of processes, technologies, or methods for protecting web servers, web applications, and web services such as APIs from attack by Internet-based threats. Web application security is crucial to protecting data, customers, and organizations from data theft, interruptions in business continuity, or other harmful results of cybercrime.

Web application security is a central component of any web-based business. The global nature of the Internet exposes web properties to attack from different locations and various levels of scale and complexity. Web application security deals with the security of websites, web applications and web services such as APIs.

Common web application security vulnerabilities

Attacks against web apps range from targeted database manipulation to large-scale network disruption. The most common attacks include:

• Cross site scripting (XSS) - XSS is a vulnerability that allows an attacker to inject client-side scripts into a webpage in order to access important information directly, impersonate the user, or trick the user into revealing important information.
• SQL injection (SQi) - SQi is a method by which an attacker exploits vulnerabilities in the way a database executes search queries. Attackers use SQi to gain access to unauthorized information, modify or create new user permissions, or otherwise manipulate or destroy sensitive data.
• Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks - Through a variety of vectors, attackers are able to overload a targeted server or its surrounding infrastructure with different types of attack traffic. When a server is no longer able to effectively process incoming requests, it begins to behave sluggishly and eventually deny service to incoming requests from legitimate users.
• Memory corruption - Memory corruption occurs when a location in memory is unintentionally modified, resulting in the potential for unexpected behavior in the software. Bad actors will attempt to sniff out and exploit memory corruption through exploits such as code injections or buffer overflow attacks.
• Buffer overflow - Buffer overflow is an anomaly that occurs when software writing data to a defined space in memory known as a buffer. Overflowing the buffer’s capacity results in adjacent memory locations being overwritten with data. This behavior can be exploited to inject malicious code into memory, potentially creating vulnerability in the targeted machine.
• Cross-site request forgery (CSRF) - Cross site request forgery involves tricking a victim into making a request that utilizes their authentication or authorization. By leveraging the account privileges of a user, an attacker is able to send a request masquerading as the user. Once a user’s account has been compromised, the attacker can destroy or modify important information. Highly privileged accounts such as administrators or executives are commonly targeted.
• Data breach - Different than specific attack vectors, a data breach is a general term referring to the release of sensitive or confidential information, and can occur through malicious actions or by mistake. The scope of what is considered a data breach is fairly wide, and may consist of a few highly valuable records all the way up to millions of exposed user accounts.

Threat Management

Cyber threat management is the process of identifying, analysing, evaluating and addressing an organisation’s cyber security requirements.

Cyber threat management helps organisations prevent data breaches, but it also ensures that they’re equipped to deal with security risks when they do occur.

The framework increases the collaboration between people, processes and technology, helping organisations detect and respond to incidents.       

Organizations that successfully adopt and implement the threat management framework often benefit from:

• Lower risk with faster threat detection, consistent investigations and faster response
• Continuous improvement through built-in process measurement and reporting
• Increased security team skills and effectiveness.

Threat Management Challenges

1. Lack of Visibility

Security teams do not have complete visibility of their entire threat landscape with relevant context, including internal and external data sources. This lack of visibility is often caused by the conflict that exists between the lack of integration between point solutions, information technology security teams, and inconsistent processes throughout the organization.

2. Lack of Insights and Necessary Reporting

A security team does not necessarily have insight into specific KPIs (Key Point Indicators) that need to be tracking down. Additionally, there is no easy way to develop progress reports that identify maturity standards and compliance due to a lack of integration between the organization’s point solutions. 

3. Skill Shortage

Due to a skill shortage in the market, security leaders are having a difficult time hiring qualified talent and keeping the current staff motivated.

It is also difficult to find additional staff budget, and security leaders have to find creative ways to “borrow” talent from other cross-functional units such as customer support, technical sales, etc. and then train them to be effective in the field.

Practices for Effective Threat Management

 Effective threat management is achieved when the following framework is applied:

• Insight: Insight into current threat operations with global services that can be tailored locally to meet the unique needs of an organization.

• Visibility: Visibility into the threat landscape, inside and out, with services to test cyber resiliency and technology that can integrate security and non-security data sources.

• Detection: Detection of the most critical threats to an organization through integrations of AI, threat intelligence and attack models derived from years of experience securing top Fortune 500 companies.

• Investigation: Investigation assisted by AI and advanced analytics across structured and unstructured data sources along with multiple degrees of separation correlation capabilities.

• Response: Response that delivers automated actions against the most common threats and dynamic business-wide playbooks that offer orchestration across people, processes and technologies.

As organizations continue to struggle with increasingly frequent and complex attacks, it is essential for them to unite people, process and technology to stop threats faster and more efficiently. Threat management provides a great framework to deliver insights into the threat landscape, help organizations detect threats faster, investigate intelligently with AI and advanced analytics, and remediate rapidly with orchestration and automation.

Scanning

Scanning is a set of procedures for identifying live hosts, ports, and services, discovering Operating system and architecture of target system, Identifying vulnerabilities and threats in the network. Network scanning is used to create a profile of the target organization.

Security scanning, or vulnerability scanning, can be simply described as scanning the security of a website, web-based program, network, or file system for either vulnerabilities or unwanted file changes. 

Server security scanning is a type of preventative maintenance that needs to be conducted on a regular basis. As a result of network security issues, servers are very often put at risk. Examples of server types that need to be monitored are exchange servers, proxy servers, web servers, file servers, print servers, application servers, and many more.

Network scans work by running vulnerability tests on network components. The tests look for faulty settings in the machines connected to the network, the router, and the servers themselves. The tests look for misconfigured internet protocols, server settings, weak passwords, and much more.