Web Uygulama Güvenliği

Hello everyone, in this article I will try to give you information on the topic of “Web Application Security”. I want to note that I am not very experienced or knowledgeable on this subject. I hope it’s useful for you, happy reading. :)

Web Application Security is the general term for programs accessed over the internet. In other words, web application security also aims to protect web services and applications against various security threats by addressing vulnerabilities in an application’s code. From a corporate perspective, web applications can be described as the face an organization presents to the outside world. In this context, web application security also covers the security of web services such as websites and web applications.

The increased use of web applications has brought with it many vulnerabilities as well. Among the biggest reasons for these vulnerabilities is that the applications being developed are built by people without security knowledge. Code written by developers who overlook security is responsible for triggering the majority of vulnerabilities in web applications.

Why Do They Attack?

At the beginning of our article, we mentioned that individuals and organizations have a face turned toward the outside world. As a result;

• Attackers plan to attack the web applications of individuals and organizations in order to infiltrate internal systems, use the information they obtain there to harm these individuals and organizations, and even go as far as making money from it.
• Corporate applications manage their security products through a web interface. As a result, web applications become a more attractive target for attacks.
• Another, and one of the most important, reasons stems from organizations failing to have security testing performed on their web applications. Since they’re unaware of the vulnerabilities present, they remain defenseless on the web application side.

How Is Web Application Security Achieved

I don’t think it would be accurate to claim that one hundred percent security and certainty can be achieved for web applications against the many possible vulnerabilities. So while we can’t achieve one hundred percent security, we can raise it to a high level. These levels can be reached through different perspectives and approaches.

Looking at the vulnerabilities found in web application flaws, it’s possible to raise the security of individuals, companies, and organizations to maximum levels by taking the precautions I mention below.

• As we know, one of the easiest ways to avoid these attacks is to pay attention to the length, complexity, and correct construction of our passwords. That’s why it’s worth changing our passwords at least twice a year. Also, making your passwords more complex and structuring them so that only you can understand them can help make you more secure.
• The “https” protocol must be used on the admin panel of websites, i.e., the section that asks for a username and password. Paying attention to this will be another secure practice for you. You can also tell whether the site you’re visiting is secure by looking at the padlock icon in the top-left corner of the site.
• The security of the application code must be ensured while developing a web application.
• Intrusion detection systems such as IDS, IPS, and SIEM should be used.
• A free and open-source security control library should be established for web applications.
• A “pentest” must be carried out on web applications. You can learn more about “pentest” by checking out my earlier article at https://www.kadircirik.com/sizma-testi-penetrasyon/.

What Is OWASP?

OWASP stands for the Open Web Application Security Project, an online community that produces articles, methodologies, documentation, tools, and technologies in the field of web application security.

All of this community’s output is free and open. Like in every country, this community also has representatives in Turkey. These representatives work with and support people in Turkey who are interested in and curious about Web Application Security.

OWASP TOP 10

The OWASP Top 10 is a list of the 10 most common application security vulnerabilities. It also shows their risks, impacts, and countermeasures. It’s updated every three to four years, identifying the 10 most common web application vulnerabilities. The most recently updated OWASP vulnerabilities are as follows:

1. Injection(Enjeksiyon)
2. Broken Authentication(Bozuk Kimlik Doğrulama)
3. Sensitive Data Exposure(Hassas Verilerin İfşası)
4. XML External Entities (XXE)
5. Broken Access Control(Bozuk Erişim Kontrolü)
6. Security Misconfiguration(Yanlış Güvenlik Yapılandırması)
7. Cross-Site Scripting (Siteler Arası Komut Dosyası)
8. Insecure Deserialization(Güvensiz Serileştirme)
9. Using Components with Known Vulnerabilities(Bilinen Güvenlik Açıklarına Sahip Bileşenleri Kullanma)
10. Insufficient Logging & Monitoring(Yetersiz Günlük Kaydı ve İzleme)

Since OWASP TOP 10 is a long and detailed topic, I plan to cover it in more detail in future articles. I hope this article has been useful for you, see you in my next articles, stay healthy. :)