Testing and Securing Web Applications

Description

Web applications occupy a large space within the IT infrastructure of a business or a corporation. They simply just don’t touch a front end or a back end; today’s web apps impact just about every corner of it. Today’s web apps have become complex, which has made them a prime target for sophisticated cyberattacks. As a result, web apps must be literally tested from the inside and out in terms of security before they can be deployed and launched to the public for business transactions to occur. The primary objective of this book is to address those specific areas that require testing before a web app can be considered to be completely secure. The book specifically examines five key areas: Network security: This encompasses the various network components that are involved in order for the end user to access the particular web app from the server where it is stored at to where it is being transmitted to, whether it is a physical computer itself or a wireless device (such as a smartphone). Cryptography: This area includes not only securing the lines of network communications between the server upon which the web app is stored at and from where it is accessed from but also ensuring that all personally identifiable information (PII) that is stored remains in a ciphertext format and that its integrity remains intact while in transmission. Penetration testing: This involves literally breaking apart a Web app from the external environment and going inside of it, in order to discover all weaknesses and vulnerabilities and making sure that they are patched before the actual Web app is launched into a production state of operation. Threat hunting: This uses both skilled analysts and tools on the Web app and supporting infrastructure to continuously monitor the environment to find all security holes and gaps. The Dark Web: This is that part of the Internet that is not openly visible to the public. As its name implies, this is the "sinister" part of the Internet, and in fact, where much of the PII that is hijacked from a web app cyberattack is sold to other cyberattackers in order to launch more covert and damaging threats to a potential victim. Testing and Securing Web Applications breaks down the complexity of web application security testing so this critical part of IT and corporate infrastructure remains safe and in operation. Cover Half Title Title Page Copyright Page Dedication Contents Acknowledgments About the Authors 1. Network Security Introduction A Chronological History of the Internet The Evolution of Web Applications The Fundamentals of Network Security – The OSI Model The OSI Model What Is the Significance of the OSI Model to Network Security? The Classification of Threats to the OSI Model The Most Probable Attacks Assessing a Threat to a Web Application Network Security Terminology The Types of Network Security Topologies Best Suited for Web Applications The Types of Attack That Can Take Place against Web Applications How to Protect Web Applications from DDoS Attacks Defending against Buffer Overflow Attacks Defending against IP Spoofing Attacks Defending against Session Hijacking Defending Virus and Trojan Horse Attacks Viruses How a Virus Spreads Itself The Different Types of Viruses Defending Web Applications at a Deeper Level The Firewall Types of Firewalls Blacklisting and Whitelisting How to Properly Implement a Firewall to Safeguard the Web Application The Use of Intrusion Detection Systems Understanding What a Network Intrusion Detection System Is Preemptive Blocking Anomaly Detection Important NIDS Processes and Subcomponents The Use of VPNs to Protect a Web Application Server The Basics of VPN Technology The Virtual Private Network Protocols that are Used to Secure a Web Application Server How PPTP Sessions are Authenticated How Layer 2 Tunneling Protocol (L2TP) Sessions are Authenticated How Password Authentication Protocol (PAP) Sessions are Authenticated How Shiva Password Authentication Protocol (SPAP)Sessions are Authenticated How Kerberos Protocol Sessions are Authenticated How IPSec Protocol Sessions are Authenticated How SSL Protocol Sessions are Authenticated How to Assess the Current State of Security of a Web Application Server Important Risk Assessment Methodologies and How They Relate to Web Application Security Single Loss Expectancy (SLE) The Annualized Loss Expectancy (ALE) The Residual Risk How to Evaluate the Security Risk that is Posed to the Web Application and its Server How to Conduct the Initial Security Assessment on the Web Application Techniques Used by Cyberattackers against the Web Application and Web Application Server The Techniques Used by the Cyberhacker Techniques Used by the Cyberattacker Network Security and Its Relevance for Web Apps Data Confidentiality Common Technical Layouts for Modern Web App Infrastructure Encrypting Data in Flight TLS Certificate Setting Up the Session Finishing the Handshake Site Validity Proving Your Web App Is What It Says It Is Testing Your Web App’s Confidentiality and Trust What Kind of Trust? Spoofing and Related Concerns Conclusion Resources References 2. Cryptography An Introduction to Cryptography Message Scrambling and Descrambling Encryption and Decryption Ciphertexts Symmetric Key Systems and Asymmetric Key Systems The Caesar Methodology Types of Cryptographic Attacks Polyalphabetic Encryption Block Ciphers Initialization Vectors Cipher Block Chaining Disadvantages of Symmetric Key Cryptography The Key Distribution Center Mathematical Algorithms with Symmetric Cryptography The Hashing Function Asymmetric Key Cryptography Public Keys and Public Private Keys The Differences Between Asymmetric and Symmetric Cryptography The Disadvantages of Asymmetric Cryptography The Mathematical Algorithms of Asymmetric Cryptography The Public Key Infrastructure The Digital Certificates How the Public Key Infrastructure Works Public Key Infrastructure Policies and Rules The LDAP Protocol The Public Cryptography Standards Parameters of Public Keys and Private Keys How Many Servers? Security Policies Securing the Public Keys and the Private Keys Message Digests and Hashes Security Vulnerabilities of Hashes A Technical Review of Cryptography The Digital Encryption Standard The Internal Structure of the DES The Initial and Final Permutations The f-Function The Key Schedule The Decryption Process of the DES Algorithm The Reversed Key Schedule The Decryption in the Feistel Network The Security of the DES The Advanced Encryption Standard The Mathematics behind the DES Algorithm The Internal Structure of the AES Algorithm Decryption of the AES Algorithm Asymmetric and Public Key Cryptography The Mathematics behind Asymmetric Cryptography The RSA Algorithm The Use of Fast Exponentiation in the RSA Algorithm The Use of Fast Encryption with Shorter Public Key Exponentiation The Chinese Remainder Theorem (CRT) How to Find Large Prime Integers for the RSA Algorithm The Use of Padding in the RSA Algorithm Specific Cyberattacks on the RSA Algorithm The Digital Signature Algorithm Digital Signature Computation and Verification Process for the DSA The Prime Number Generation Process in the DSA Security Issues with the DSA The Elliptic Curve Digital Signature Algorithm The Generation of the Public Key and the Private Key Using the ECDSA Algorithm The Signature and the Verification Process of the ECDSA Algorithm The Use of Hash Functions The Security Requirements of Hash Functions A Technical Overview of Hash Function Algorithms Block Cipher–Based Hash Functions Technical Details of the Secure Hash Algorithm SHA-1 Key Distribution Centers The Public Key Infrastructure and Certificate Authority Resources 3. Penetration Testing Introduction Peeling the Onion True Stories External Testing: Auxiliary System Vulnerabilities Internal Testing Report Narrative Report Narrative Web Application Testing SSID Testing Types of Penetration Tests Definitions of Low, Medium, High, and Critical Findings in Penetration Testing Compliances and Frameworks: Pen Testing Required OWASP and OWASP Top Ten OWASP Top Ten with Commentary Tools of the Trade Pen Test Methodology Penetration Test Checklist for External IPs and Web Applications Chapter Takeaways Resources 4. Threat Hunting Not-So-Tall Tales Nation-State Bad Actors: China and Iran Threat Hunting Methods MITRE ATT&CK Technology Tools The SIEM EDR EDR + SIEM IDS When 1 + 1 + 1 = 1: The Visibility Window Threat Hunting Process or Model On Becoming a Threat Hunter Threat Hunting Conclusions Resources 5. Conclusions Index