How to start web application security assessment

Web application security forms the backbone of many business as it represents the web form of business review and conduct day to day business.

In today's scenario, many web forms and business sites, perform major transactions on websites and moving to mobile applications.

While security standards should be followed during coding phases, still there are major challenges when the application goes live.

The reason for vulnerable application can vary depending on business needs as business wants the production to go at a rapid pace and still working on budgets to propose the security requirements, old/legacy codes with reusable components are used to rush the code to production.

We will list down certain points which can be helpful to understand while starting web application security assessment.

1. Understand the business applications 

    

  Before starting any assessment, it is very important to understand the business needs of the                 application. 

• Start with interview and normal browsing of the application
• Identify the entry points of the applications
• Find the technologies used to develop the applications

2. Understand the api's used to develop applications

    

    It is important to understand the api's used to develop the applications. There may be third party         api's which are available on web and they can be used to develop different analytics and business       data. These api's on one hand provide flexibility and easy to use, but at the same time creates               different vulnerabilities in applications.

3. Infrastructure used to host applications

    

    Web servers used to host applications are the most important infrastructures. Vulnerable web               servers or outdated web servers pose a significant risks for the applications to be hacked. Technical     testing for these web servers is important as if these gets compromised, then entire application             security is finished.

4. Decide what type of assessment is required

   It is important to understand what type of application testing is required.  Grey Box, White Box,        Black Box testing all 3 types of testing should be performed at one go as it is important to                    understand how an attacker views your applications.

5. GO with Manual and Automated Security Testing

  It is important to go with at-least 3 different automated tools as Qualys, Accunetix, Netsparker, IBM   Appscan, HP Webinspect or any other tools of your choice or open source should also be used as    there are possibilities that open source gives some varying information's. While performing  automated testing, it is important to analyse the raw reports and check for any "errors" or "no  service" messages as that will help what points in applications are creating challenges.

 Manual testing should always be done along with automated testing as it can reveal major challenges  in identifying vulnerable areas.

 All the above mentioned steps will help create a vulnerability map which can help understand how  threats will be coming to applications and what can create challenges in applications. This in turn  creates parameters for closure of vulnerabilities across applications and infrastructures hosting the      apps.

Always good to follow OWASP top 10 standards for mapping application vulnerabilities however it is also a good practice to map SANS Top 25 errors that can lead to serious security vulnerabilities.