DZone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
Refcards Trend Reports Events Over 2 million developers have joined DZone. Join Today! Thanks for visiting DZone today,
Edit Profile Manage Email Subscriptions Moderation Admin Console How to Post to DZone Article Submission Guidelines
View Profile
Sign Out
Refcards
Trend Reports
Events
Zones
Culture and Methodologies Agile Career Development Methodologies Team Management
Data Engineering AI/ML Big Data Data Databases IoT
Software Design and Architecture Cloud Architecture Containers Integration Microservices Performance Security
Coding Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Partner Zones AWS Cloud
by AWS Developer Relations
Culture and Methodologies
Agile Career Development Methodologies Team Management
Data Engineering
AI/ML Big Data Data Databases IoT
Software Design and Architecture
Cloud Architecture Containers Integration Microservices Performance Security
Coding
Frameworks Java JavaScript Languages Tools
Testing, Deployment, and Maintenance
Deployment DevOps and CI/CD Maintenance Monitoring and Observability Testing, Tools, and Frameworks
Partner Zones
AWS Cloud
by AWS Developer Relations
  1. DZone
  2. Software Design and Architecture
  3. Security
  4. You’ve Been Hacked: Why Web Application Security Programs Should Start With RASP

You’ve Been Hacked: Why Web Application Security Programs Should Start With RASP

If your web applications aren’t secure, neither are you. As hackers begin to realize this, attacks on web applications are increasing.

Goran Begic user avatar by
Goran Begic
·
Oct. 24, 16 · Opinion
Like (3)
Save
Tweet
Share
3.97K Views

Join the DZone community and get the full member experience.

Join For Free

Web applications help trusted users navigate your site and your content. They also provide direct entrée into your system for those who wish to harm your organization. If your web applications aren’t secure, neither are you. As hackers begin to realize this, attacks on web applications are increasing. These attacks were the top attack vector in 2015, representing 40 percent of all breaches, up from just 10 percent the year before.

The primary motive for hackers is financial gain. The secondary motive is gaining information that can be used to help in a different attack. So, no industry is safe from the attention of these criminals.

You’ve Been Hacked. Now What?

When you get hacked, much of the focus for your organization will be on remediation and recovery. What does that look like?

  • Average cost: $4 million
  • Time to fix the vulnerability once you find it: at least 90 days
  • Loss of critical information, equipment, or other assets
  • Time for mitigation and recovery of lost assets
  • Time to restore operations and services
  • Loss of customer confidence
  • Loss of business due to business interruption or damaged reputation
  • Legal issues
  • Direct costs like extortion, data destruction, or repairing physical damage to the system
  • Associated costs such as crisis management or legal claims regarding fraud or privacy breaches

Unfortunately, the traditional security techniques in place in most organizations today will not protect you as well as you think they will. Identifying vulnerabilities is critical, but it’s just the first step. And it can take a long time for some of these legacy techniques to reveal a vulnerability. Which means your system might be at risk for a long time before you can even identify critical flaws, let alone fix them--and many of these techniques can take months to implement.

Incomplete Approaches to Web App Security 

These five common web app security measures are important, but incomplete solutions: 

1. SAST (Static Analysis)
Detailed analysis of data and control flow done by processing source code, or binaries without running the application.
2. DAST (Dynamic Analysis)
Discovery of application interfaces and injection of vulnerable traffic with the aim of discovering security weaknesses; performed while the application is running.
3. Developer education
Secure coding guidelines, online and in-person training courses, capture the flag competitions, etc.
4. IAST (Interactive Application Security Testing)
Analysis of application execution performed during runtime, and utilizing access and insights into application code.
5. Manual Penetration Testing
Internal penetration testing identifies how much damage someone can do from inside the trust barrier. External penetration testing identifies access points and how far a hacker can get into a system.

What Does Keep You Safe?

There is a new approach to application security that does a better job at safeguarding apps: Runtime Application Self-Protection (RASP). Because it works inside the application, monitoring how the app interacts with users, RASP knows the behaviors of authorized users, and will immediately take action when a behavior is malicious.

There is no one technique that will protect against every possible threat. But RASP comes the closest to providing complete protection for your web applications, and for protecting your organization and its assets from hackers.

Application security Web Service Web application

Published at DZone with permission of Goran Begic, DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

Popular on DZone

  • Java REST API Frameworks
  • How To Select Multiple Checkboxes in Selenium WebDriver Using Java
  • Top 5 Data Streaming Trends for 2023
  • 5 Best Python Testing Frameworks

Comments

Partner Resources

X

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • Become a Contributor
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 600 Park Offices Drive
  • Suite 300
  • Durham, NC 27709
  • support@dzone.com
  • +1 (919) 678-0300

Let's be friends: