Mostrar el registro sencillo del ítem

dc.contributor.authorCorrea, Roddy A.
dc.contributor.authorBermejo Higuera, Juan Ramón
dc.contributor.authorBermejo-Higuera, Javier
dc.contributor.authorSicilia, Juan Antonio
dc.contributor.authorSánchez Rubio, Manuel
dc.contributor.authorMagreñán, Á. Alberto
dc.date2021
dc.date.accessioned2021-04-22T14:05:52Z
dc.date.available2021-04-22T14:05:52Z
dc.identifier.issn1526-1506
dc.identifier.urihttps://reunir.unir.net/handle/123456789/11242
dc.description.abstractThis study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications. The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box, to carry out the security validation of a web application in an agile and precise way. The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks. Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage, so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result. The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle (SSDLC). A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics. Dynamic analysis with manual checking is used to audit the results, 24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally. This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally. Dynamic analysis finds six (6) additional critical vulnerabilities. Access control analysis finds other five (5) important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks, two vulnerabilities that permit brute force attacks.es_ES
dc.language.isoenges_ES
dc.publisherCMES-Computer Modeling in Engineering & Scienceses_ES
dc.relation.ispartofseries;vol. 126, nº 1
dc.relation.urihttps://www.techscience.com/CMES/v126n1/40863es_ES
dc.rightsopenAccesses_ES
dc.subjectweb applicationses_ES
dc.subjectsecurity vulnerabilityes_ES
dc.subjectweaknesses_ES
dc.subjectsecurity analysises_ES
dc.subjectwhite boxes_ES
dc.subjectblack boxes_ES
dc.subjectinteractive application security testinges_ES
dc.subjectstatic application security testinges_ES
dc.subjectdynamic application security testinges_ES
dc.subjectJCRes_ES
dc.subjectScopuses_ES
dc.titleHybrid Security Assessment Methodology for Web Applicationses_ES
dc.typeArticulo Revista Indexadaes_ES
reunir.tag~ARIes_ES
dc.identifier.doihttps://doi.org/10.32604/cmes.2021.010700


Ficheros en el ítem

FicherosTamañoFormatoVer

No hay ficheros asociados a este ítem.

Este ítem aparece en la(s) siguiente(s) colección(ones)

Mostrar el registro sencillo del ítem