With the rapid adoption of innovative technologies, cybersecurity has become more imperative than ever. From data breaches and ransomware to web application exploits, businesses today are constantly under attack.
Not only is the number of cyberattacks increasing, but the cost of each breach is also on the rise: According to a recent report (IBM, 2021), the rapid adoption of remote work during the COVID-19 pandemic has led to data breaches that cost an average of $1,000,000 more than data breaches not involving remote work. This is an alarming number, given that it is projected that over 40 million Americans will work remotely by the year 2026 (Tanzi, 2021).
Organizations need a comprehensive cybersecurity plan that includes defense against web application attacks. This article discusses some of the most common types of application security threats, how organizations can defend against them, and how to kickstart a career in application security by becoming an EC-Council Certified Application Security Engineer (C|ASE).
SQL Injection
One of the most common web application attacks is SQL injection (Towson University, n.d.): a type of attack that takes place when a web application does not validate values provided by a web form, cookie, input parameter, or another source before forwarding them to SQL queries on a database server. This allows attackers to insert malicious code by manipulating the input variables. Hackers can then use that code to extract data from a database or execute malicious commands on the server.
There are several ways to defend against SQL injection attacks, but one of the most reliable is to use a web application firewall (WAF) to detect and block malicious SQL code. Input validation can also be used to check for invalid or malformed input data, and parameterized queries can be used rather than dynamic queries to prevent attackers from executing commands on the database.
Cross-Site Scripting
Another common attack vector is cross-site scripting (XSS). XSS attacks occur when an attacker takes advantage of vulnerabilities in a web application to inject malicious code that enables them to access a target end user’s data. The code can be embedded in a script tag, iframe, or hyperlink. These attacks are typically launched using a client-side script and can occur whenever a web application uses input data from a user without validation or encryption.
There are several ways to protect against XSS attacks, including using a WAF to identify and block malicious code and input validation to identify unsafe or invalid input data. A content security policy can also be used to prevent attackers from injecting code into a webpage.
Cross-Site Request Forgery
Cross-site request forgery (CSRF) allows an attacker to execute unauthorized requests on behalf of another user (OWASP Foundation, 2021). This can be done by embedding the target’s session ID in a malicious payload.
There are several ways to protect against CSRF attacks. The first is to use a WAF to detect and block unauthorized requests. A second approach to defending against CSRF attacks is to use authentication tokens: unique identifiers used to verify the legitimacy of a request.
Insecure Direct Object References
Insecure direct object references (IDOR) are another common web application vulnerability (OWASP Foundation, 2020). IDOR-based attacks occur when a malicious hacker accesses sensitive data by manipulating the URLs used to reference objects in an application.
There are several ways to protect against IDOR and associated attacks. One technique is to use input validation to check that input values are safe and valid. Additionally, obfuscation techniques like URL rewriting and encoding can make it more difficult for attackers to exploit vulnerable URLs.
Opportunities for Career Growth in Application Security
As the world embraces new technologies faster than ever before and remote work increases, the threat of cybersecurity breaches looms large. To keep their data safe and ensure the security of their infrastructures and operations, organizations need cybersecurity professionals who understand the types of web application cyberattacks and how to defend against them.
While there are multiple threats to web applications, some sectors are more vulnerable to cyberattacks than others. One prominent industry is the blockchain and cryptocurrency space. For example, in 2017, a vulnerability was disclosed in the Parity Wallet, which stores cryptocurrencies like Bitcoin and Ethereum, that allowed attackers to steal over USD 30 million worth of digital currency (Zhao, 2017).
Get Certified as an Application Security Expert
Innovative technologies like blockchain are still in their infancy and are constantly changing, so professionals must be up to date on the latest security vulnerabilities and know how to address them. One of the most effective ways to prepare for this evolving technology landscape is to enroll in the C|ASE certification program at EC-Council, which covers the latest technologies and emerging attack vectors. If you’re ready to take your cybersecurity skills to the next level, sign up for one of EC-Council’s in-depth, hands-on application security courses today.
References
IBM. (2021, July 28). IBM report: Cost of a data breach hits record high during pandemic [Press release]. PRNewswire. https://newsroom.ibm.com/2021-07-28-IBM-Report-Cost-of-a-Data-Breach-Hits-Record-High-During-Pandemic
OWASP Foundation. (2020). Testing for insecure direct object references. In Web security testing guide (4th ed.). https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References
OWASP Foundation. (2021). Cross site request forgery (CSRF). https://owasp.org/www-community/attacks/csrf
Tanzi, A. (2021, September 29). Remote work projections are on the rise in U.S. managers survey. Bloomberg. https://www.bloomberg.com/news/articles/2021-09-29/remote-work-projections-are-on-the-rise-in-u-s-managers-survey
Towson University. (n.d.). SQL injections–Introduction. Cybersecurity Modules: Security Injections. https://cisserv1.towson.edu/~cssecinj/modules/other-modules/database/sql-injection-introduction/
Zhao, W. (2017, July 19). $30 million: Ether reported stolen due to parity wallet breach. CoinDesk. https://www.coindesk.com/markets/2017/07/19/30-million-ether-reported-stolen-due-to-parity-wallet-breach/
