Securing Web Applications in 2022: XDR, DAST, PTaaS & More

What is Web Application Security?

Web application security involves protecting websites and web applications from security threats, most of which are caused by vulnerabilities in web application code and configuration.

Many web applications store sensitive data, or are critical for business operations (for example, in the case of an eCommerce website), meaning that breaches can have a major effect on a business. According to a study by the Ponemon Institute, the average cost of data breaches to businesses in the USA was over $8 million.

Web application security, part of the discipline of application security (AppSec), is becoming an integral part of development practices. Organizations are implementing security testing and scanning at all stages of the development lifecycle—from planning to development, staging, and deployment.

Web Application Security Risks

The Open Web Application Security Project (OWASP) maintains a list of the ten most important security risks facing web applications. Below is a summary of the list.

Injection flaws

Injection attacks involve injecting untrustworthy code into a program. This is made possible by failure to sanitize user inputs—for example, allowing users to provide data in a field, without checking if a malicious user submitted executable code instead of legitimate data. For example, SQL, NoSQL, operating system and LDAP injections may cause software to execute unintended....

Read the rest of this story with a free account.

Already have an account? Sign in

Author

Hakin9 TEAM: Hakin9 is a monthly magazine dedicated to hacking and cybersecurity. In every edition, we try to focus on different approaches to show various techniques - defensive and offensive. This knowledge will help you understand how most popular attacks are performed and how to protect your data from them. Our tutorials, case studies and online courses will prepare you for the upcoming, potential threats in the cyber security world. We collaborate with many individuals and universities and public institutions, but also with companies such as Xento Systems, CATO Networks, EY, CIPHER Intelligence LAB, redBorder, TSG, and others.