What is Application security?

Application security is the security measures one implement at the development stage of a application.

Why do we need Application security at the application level when we have other security measures such as firewall?

Firstly, With the increase of IoT devices nowadays, these IoT devices deals with sensitive data such as user's heartbeat,their location, their medical records. These IoT devices don't transmit the data directly to the database. First the IoT device share this data to the mobile app which the user implemented in his smartphone. When the app get hacked by a person, it can cause serious damage to the user. So at the application level we should have extra measures to safeguard our data.

Secondly, Applications not only include Mobile and desktop applications. It also includes Web applications which are the hot topic today. Web applications are applications which we access through our web browser. There are hundreds of web applications which provide services directly to us without asking for any software to install. With the increase of usage, the risk of breaching and hacking the data in those is also increasing.

Measures involved in Application security

*Authentication

*Authorization

*Encryption

*Logging

*Application security testing

Generally speaking, Application security includes both hardware and software measures. A router is a example of hardware security measure for a application. It blockes malicious IPs and data packets entering into a network and application. Let's see in more detail about the each aspects of application security

Authentication

when software developers incorporate security measures into a programme to guarantee that only authorised users can access it. A user's identity is verified through authentication processes. This can be achieved by asking the user to provide their user name and password in order to access a particular programme. In some applications you are asked to provide more than one component like a OTP, your biometrics etc…

Authorization

After authentication, the application matches the user credentials with the list of authorized users. Only the user with right authentication can get into this level. Cause the database can't afford to search data whom are not users in the first place

Encryption

Encryption is nothing but sending data over the network in unreadable format.That is when we send data, the data get converted to a unreadable format (cipher text). Only the user whom we are sending the data can read or modify it by accessing it with a key. Without this key the data can't be compromised. So an application must have strong encryption algorithms.

Logging

Incase if the data get hacked or hijacked, logging keeps a record on how the data got breached. More like a registry. It keeps the record of processes in the application.

Application security Testing

To ensure there are no security flaws in a new or updated version of a software programme, application developers conduct application security testing as part of the software development process. A security audit can verify that the application complies with a certain set of protection requirements. Developers need to make sure that only authorised users may access the programme after it passes the audit. When conducting penetration testing, a developer adopts the mindset of a cybercriminal and searches for openings into the application. Social engineering or attempting to trick users into granting unwanted access are both possible components of penetration testing. To find security flaws that might not be visible in both states, testers frequently run both authenticated security scans and unauthenticated security scans (as logged-in users).

Implementing security measures at the development stage of a application proves to be more effective in both ways productivity and cost effective . Because instead of developing security measures after the deployment of an app which is very hard and can cause leakage of data of the users. Lets see about what are the security frameworks used in Application security Testing .Security Frameworks are sets of instructions or guidelines to follow regarding cyber security .The main frameworks are

*NIST (National

*OWASP

NIST(National institute of Standards and Technology)

Additionally, the NIST published security measures that would improve any American company's cybersecurity posture. It incorporates a five-step procedure that includes identification, protection, detection, reaction, and recovery to assist firms manage risks and maintain security systems. The Core, Profiles, and Implementation Tiers make up this hierarchy.

The Core Tier provides fundamental recommendations for safeguarding information systems. On the other hand, profiles cover organisational goals for cybersecurity, such as the assessment of fundamental controls for the IT division. The Implementation Tier's last focus is estimating the amount of cybersecurity funding needed to implement the selected security measures.

OWASP(Open Web Application security)

In many programming languages, the OWASP Security Knowledge Framework is an open source online application that outlines secure coding concepts. OWASP-mission SKF's is to assist you in learning security by design, incorporating it into your software development, and creating secure by design applications. Manageable software development projects with checklists (using OWASP-ASVS/OWASP-MASVS or bespoke security checklists) and labs to practise security verification are how OWASP-SKF accomplishes this (using SKF-Labs, OWASP Juice-shop, and best practise code examples from SKF and the OWASP-Cheatsheets).

Attacks Reported at Applications

*DoS attacks

*SQL Injection

*Data Breach

DoS Attacks

This is called Denial of service attacks .These are targeted to get down the server. This is caused by flooding of servers by sending thousands of requests at a single instance. These attacks are most prominent in todays internet scenario and its easy to do comparing to other cyber security attacks.These attacks which can be rectified but can cause serious damage to the reputation and financial loss of big organisations such as banking,transportation etc..

SQL injection attacks.

SQL is Structured query language used to fetch data from back-end databases.Manipulating this SQL can result in fetching important data such as userID,Password and much more.So SQL injection is changing the valid entries to malicious ones.With SQL injection the database can possibly get deleted .

Data breaches

Despite being a common terminology ,data breaches means a vast range of comprising data .These can happen due to many reasons for example social engineering by manipulating the user and getting their credentials.Data breaches comes with many consequences like bulk release of private data into public space .