Prevention Techniques In Web Service Applications

Defenses against Injection Attacks

There are a number of injection attacks that may take place and impact the privacy and security of the data sets. SQL injection attacks can be prevented with the avoidance of the use of dynamic SQL. Parameterized queries shall be used so that the attackers do not succeed in launch and utilizing malicious queries to give shape to the attacks. There are patch management solutions that are available and shall be used to prevent the attack. Web Application Firewall (WAF) shall also be used for attack prevention. There are certain database functionalities that are not needed. The attack surface shall be minimized by removing these functionalities (Balasundaram & Ramaraj, 2012).

XML injection attacks can be prevented by ensuring that the user input is validated, verified, and adequately managed before it reaches the program code. It can be done with the removal of single as well as double quotes from the XLM code that is developed. There shall be use of functions from the XML library that shall be done to prevent the attacks. The ability to ensure that unwanted inputs are avoided will assist in the process of attack prevention.

The similar approach shall be followed to prevent the XSS attacks. The paths through which the web sites and web applications accept the input data shall be determined by the site owners. The validation and verification of the input paths and the user inputs will ensure that the attacks are prevented. Browser cookie credentials may also be linked with the IP address of the user to assist in the prevention of the attacks (Bherde & Pund, 2016).

The sanitization of the inputs can be done with the process of code audits along with the validation checks. The implementation of the prevention measures is not difficult. It only requires the management and administration to be aware of the possibilities of the attacks and to be diligent enough to implement the measures.

The prevention measures also do not come with huge costs that may prove to be hindrance in the implementation.

In spite of easy implementation and lower costs associated with implementation, it has been observed that defenses against the injection attacks are not extensively used. This is because there is a lot of reliance on the logical and technical controls with the development of the technology. The organizations prefer to make use of firewalls for the preventing the attacks. The measures, such as code audits and validation of the inputs are the administrative control measures that need to be executed by the auditors and management. There is not enough diligence observed from the administrative side to make use of such measures.

Difficulties in Implementation

There are a number of Data Loss Prevention (DLP) products that are available in the market. Three such products are Symantec Data Loss Prevention, Check Point Data Loss Prevention, and Trustwave Data Loss Prevention.

Symantec DLP is a product that ensures that the information and data sets of the organization are protected from the security attacks. It is scalable in nature and targets the data stored across multiple locations, such as cloud-based data, mobile data, and so on (Symantec, 2018). The product also makes use of safeguards to ensure that the data is not lost. Trustwave DLP is another product that may be used for data loss prevention. It is a product that allows the business organizations to comply with the internal and external regulations and policies. There are tools that are offered as a part of this product for discovering, monitoring, and securing the data sets. Check Point is one of the widely used products for data loss prevention. It ensures that the data is kept secured and is not transferred to the unauthorized entities.

The architecture of the DLP product discussed above has been shown in the image below.

Symantec DLP Architecture

The three DLP products that have been discussed above can be used and implemented in the organization to detect and prevent the vulnerabilities for enhanced data protection. Symantec DLP is a product that ensures that the information and data sets of the organization are protected from the security attacks. It is scalable in nature and targets the data stored across multiple locations, such as cloud-based data, mobile data, and so on. The product also makes use of safeguards to ensure that the data is not lost. Trustwave DLP is another product that may be used for data loss prevention. It is a product that allows the business organizations to comply with the internal and external regulations and policies. There are tools that are offered as a part of this product for discovering, monitoring, and securing the data sets. Check Point is one of the widely used products for data loss prevention. It ensures that the data is kept secured and is not transferred to the unauthorized entities (Checkpoint, 2018).

The feature set of the three products will make sure that the endpoint and enterprise security is enhanced and is maintained. It will also make sure that the cloud security and the security of the mobile devices is ensured for overall security of the enterprise. The data sets will be protected with the identification and prevention of the vulnerabilities.

Reasons for Non-Extensive Usage

• Identity verification is ensured with the use of certificates to avoid the impersonation security attacks
• Man in the middle attacks are avoided and prevented with the use of HTTPS
• Sense of trust and security is provided to the users
• SSL is used as a ranking signal for the sites by search engines such as Google

• There is a price associated with the certificate
• In case of incorrect implementation, there may be vulnerabilities that may emerge
• Proxy caching problems (Ipa, 2009)

HTTPS makes use of Secure Socket Layer (SSL) for enhanced security which is absent from HTTP. The URL for the sites and applications using http begins from https:// whereas the ones that use https start with https://. The primary difference lies in security as http is less secure as compared to https. The port number used in http is 80 while it is 443 in the case of https. HTTP is a protocol that is used at the application layer of OSI and TCP/IP models while https in used in the transport layer. SSL certificates and encryption are involved with HTTPS which are missing from HTTP.

The server setup for HTTPS is done by hosting with a dedicated IP address. A certificate is purchased for HTTPS which is then activated. Installation of the certification is done followed by the update of the web site to make use of HTTPS.

There are enhanced security options that come along with HTTPS that are not present in HTTP. There are security certificates that are included with HTTPS and the web browser determines the security of the site using these certificates. When a user connections to a public Wi-Fi connection in a local coffee shop, there is a determination of the security status that is done by the browsers with the aid of HTTPS. It helps in making sure that the impersonation attacks are avoided and only the real site owners are provided the access.   

There are various security attacks that take place on the web sites, such as man in the middle attacks and eavesdropping attacks. With the use of HTTPS, secure transactions and activities are made possible on the Internet. Additional privacy and security is provided for usual web browsing as well. This is the reason that the search engines are also switching to HTTPS. For instances, Google now makes default search using HTTPS as the protocol in place of HTTP connections. This exempts the other users from viewing the search history of the user on the same network.

All the web traffic must make use of HTTPS because it adds another layer of security to keep the data and information protected at all times. Encryption is a feature that comes along with HTTPS to make sure that the data sets are protected and secured.

The use of HTTP adds trust to the web site or the web application and makes sue that the security and privacy attacks are prevented and avoided.  

Data Loss Prevention (DLP)

Virtual Private Cloud, also referred as VPC is an on-demand configurable pool of shared computing resources that can be used and implemented in a public cloud infrastructure.

Amazon Web Services (AWS) VPC is one such product that allows the launch of AWS resources in a virtual network. The network resembles the traditional data centre that is normally used in the business organizations. However, it comes with the ability to scale the infrastructure up or down as per the requirements.

Amazon VPC may be used in the business organizations and enterprises as it will support a variety of different platforms. The organization will gain the ability to assign multiple IP addresses to various instances. The ability to define the network interfaces and assign more than one interfaces to the instances will also be made possible. The security group membership will also be allowed to be altered or modified as per the requirement (Aws, 2018). The AWS VPC will also include internet gateway which will allow the instances to communicate with each other. Corporate or home network will also be accessible with the use and implementation of the AWS VPC.

It is recommended for the organization to consider the use and implementation of Virtual private cloud such as the one offered by AWS. Amazon VPC may be used in the business organizations and enterprises as it will support a variety of different platforms. The organization will gain the ability to assign multiple IP addresses to various instances. The ability to define the network interfaces and assign more than one interfaces to the instances will also be made possible. The security group membership will also be allowed to be altered or modified as per the requirement. The AWS VPC will also include internet gateway which will allow the instances to communicate with each other. Corporate or home network will also be accessible with the use and implementation of the AWS VPC.

This will bring down the overall implementation costs and will also provide an integrated network.

There is a default limit that is applied on the critical set of resources that the users and buyers must be aware of. For instance, the default limit of AWS VPC is 5. Teleporting technology has not been developed and implemented yet. As a result, there may be issues of portability that may come along with AWS VPC. There is a technical support fee that comes along with the use and implementation of AWS VPC. There may also be issues of cloud security and privacy that may come up (Lewis, 2017).

There are various risks and attacks that may take place with the emergence of e-services and e-applications. One of the attack agents involved is the network that is used to access the services and applications. The network-based security risks and attacks are carried out, such as malware attacks, denial of service attacks, man in the middle attacks, eavesdropping attacks, distributed denial of service attacks, data breaches, integrity attacks, and data leakage.

There are control measures that can be used to prevent and avoid the e-security risks and attacks. These measures may be put across three different categories. The first category is the administrative set of controls. There shall be security audits and reviews that shall be done to detect and prevent the attacks. The organizations shall also develop and implement strong disaster recovery plans and information security policies to prevent the security attacks. The second category is the use and implementation of technical controls. There are network-based technical security controls such as intrusion detection and prevention systems that have been developed and must be implemented. Encryption, ant-denial tools, firewalls, and anti-malware tools shall also be deployed. Physical security is the third category that must be used to prevent and detect the security risks and attacks.

References

Aws. (2018). What Is Amazon VPC? – Amazon Virtual Private Cloud. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html

Balasundaram, I., & Ramaraj, E. (2012). An Efficient Technique for Detection and Prevention of SQL Injection Attack using ASCII Based String Matching. Procedia Engineering, 30, 183-190. doi: 10.1016/j.proeng.2012.01.850

Bherde, G., & Pund, M. (2016). Recent attack prevention techniques in web service applications. 2016 International Conference On Automatic Control And Dynamic Optimization Techniques (ICACDOT). doi: 10.1109/icacdot.2016.7877771

Checkpoint. (2018). Data Loss Prevention Software Blade | Check Point Software. Retrieved from https://www.checkpoint.com/products/dlp-software-blade/

Ipa. (2009). The Secure HyperText Transfer Protocol. Retrieved from https://www.ipa.go.jp/security/rfc/RFC2660EN.html

Lewis, K. (2017). Virtual Private Cloud Security. Computer And Information Security Handbook, 937-942. doi: 10.1016/b978-0-12-803843-7.00066-1

Symantec. (2018). Data Loss Prevention & Protection | Symantec. Retrieved from https://www.symantec.com/products/data-loss-prevention

Trustwavecompliance. (2018). Data Loss Prevention. Retrieved from https://www.trustwavecompliance.com/solutions/compliance-technologies/data-loss-prevention/

Order an Essay Now & Get These Features For Free:

Turnitin Report

Formatting

Title Page

Citation

Outline

Place an Order