The Web hosts a large set of applications all aimed at enhancing the productivity of userss such as Google Docs, calculators, email, storage, maps, weather and news — everything that is needed daily by the users. Application attacks are usually the hardest to defend. The vulnerabilities encountered within the application layer often rely on complex user input scenarios that are hard to define with an intrusion detection signature. This layer is also the most accessible and the most exposed to the outside world. For the application to function, it must be accessible over Port 80 (HTTP) or Port 443 (HTTPS).

In 2014, SQL injections, a type of application attack, were responsible for 8.1 percent of all data breaches. That makes it the third most used type of attack, behind malware and distributed denial-of-service attacks. There are also other common application attacks such as security misconfiguration, using components with known vulnerabilities and cross-site scripting. Attackers are able to manipulate application input and obtain confidential data without being detected by network defense systems.

Most vulnerabilities found in Web applications are unknown to security defense systems; these are called zero-day vulnerabilities. This is because these vulnerabilities are specific to each application and have never been known before. A skilled attacker can easily find these vulnerabilities and exploit the issue without being detected.

The best defense against these attacks is to develop secure applications. Developers must be aware of how application attacks work and build software defenses right into their applications.

Educating and informing developers about application vulnerabilities is the goal of the Open Web Application Security Project (OWASP). The organization has put together a list of the 10 most common application attacks. This list is renewed every three years, with the latest refresh in 2013.

The IBM Security Ethical Hacking Team shares this goal. With this in mind. So let’s take some brief look at the 10 most common application attacks.

To read the full blog post, visit: https://www.todhost.com/blog/how-to-prevent-the-most-common-application-attacks-against-websites.html