Browse > Article
http://dx.doi.org/10.9708/jksci.2012.17.2.127

Vulnerability Analysis and Threat Mitigation for Secure Web Application Development  

Moon, Jae-Chan (Dept. of Computer Science, Dankook University)
Cho, Seong-Je (Dept. of Software Science, Dankook University)
Publication Information
Journal of the Korea Society of Computer and Information / v.17, no.2, 2012 , pp. 127-137 More about this Journal
Abstract
Recently, as modern Internet uses mashups, Web 3.0, JavaScript/AJAX widely, the rate at which new vulnerabilities are being discovered is increasing rapidly. It can subsequently introduce big security threats. In order to efficiently mitigate these web application vulnerabilities and security threats, it is needed to rank vulnerabilities based on severity and consider the severe vulnerabilities during a specific phase of software development lifecycle (SDLC) for web applications. In this paper, we have first verified whether the risk rating methodology of OWASP Top 10 vulnerabilities is a reasonable one or not by analyzing the vulnerability data of web applications in the US National Vulnerability Database (NVD). Then, by inspecting the vulnerability information of web applications based on OWASP Top-10 2010 list and CWE (Common Weakness Enumeration) directory, we have mapped the web-related entries of CWE onto the entries of OWASP Top-10 2010 and prioritized them. We have also presented which phase of SDLC is associated with each vulnerability entry. Using this approach, we can prevent or mitigate web application vulnerabilities and security threats efficiently.
Keywords
Web application; OWASP Top 10; Vulnerability analysis; Threat mitigation; Software development lifecycle (SDLC);
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 The Open Web Application Security Project (OWA SP), Available Online at http://www.owasp.org. Accessed in Sep. 2011
2 Homeland Security: Common Weakness Enumeration (CWE), Available Online at http://cwe.mitre.org. Accessed in Sep. 2011
3 M. Howard, D. LeBlanc, and J. Viega, 19 Deadly Sins of Software Security - Programming Flaws and How to Fix Them, McGraw-Hill, 2005
4 S. Wagner, D. M. Fernandez, S. Islam, and K. Lochmann, "A Security Requirements Approach for Web Systems", Proc. of Quality Assessment in Web (QAW2009), CEUR, 2009.
5 P. Mell, K. Scarfone and S. Romanosky, "Common Vulnerability Scoring System", IEEE Security & Privacy, pp. 85-89, Nov./Dec. 2006.
6 Kukinews, "[Financial hacking is an Emergency] Hacking Method Viewed by Experts", Apr. 11, 2011. Available Online at http://news.kukinews.com/article/view.asp?page=1&gCode=kmi&arcid=0004844041&cp=du Accessed in Oct. 2011
7 WhiteHat Security, Inc., "Measuring Website Security: Windows of Exposure", WhiteHat Website Security Statistics Report, 11th Edition, Winter 2011,http://img.en25.com/Web/WhiteHatSecurityInc/WPstats_winter11_11th.pdf
8 National Institute of Standards and Technology. National Vulnerability Database (NVD). Available at: http://nvd.nist.gov, 2011.
9 Y. Kim, S. Shin, J. Ahn, O. Lee, E. Lee and H. Han, "Analysis and Documentation of Korean Common Weakness Enumeration for Software Security", Communications of the Korean Institute of Information Scientists and Engineers, Vol. 28, No. 2, pp. 20-31, Feb. 2010.
10 CWE-79 Improper Neutralization of Input During Web Page Generation('Cross-site Scripting'), Available Online at http://cwe.mitre.org/data/definitions/79.html, Accessed in Oct. 2011
11 R. A. Martin, S. M. Christey and J. Jarzombek, "The Case for Common Flaw Enumeration", NIST Workshop on Software Security Assurance Tools, Techniques and Metrics, November, 2005.
12 R. A. Martin and S. Barnum, "A Status Update: The Common Weaknesses Enumeration", Proc. of the Static Analysis Summit (NIST Special Publication 500-262), pp. 62-64, July 2006.
13 A. Tripathi and U.K. Singh, "Towards Standardization of Vulnerability Taxonomy", Proc. of the 2nd International Conference on Computer Technology and Development (ICCTD), pp. 379-384, Nov. 2010.
14 K. Tsipenyuk, B. Chess and G. McGraw, "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors", IEEE Security & Privacy, pp. 81-84, Nov./Dec. 2005.
15 J. A. Wang, H. Wang, M. Guo and M. Xia, "Security metrics for software systems", Proc. of the 47th Annual Southeast Regional Conference (ACM-SE-47), 2009.
16 A. Wiesmann, A. van der Stock, M. Curphey, R. Stirbei, A Guide to Building Secure Web Applicat ions and Web Services, OWASP, 2005.