Issues of Web security.
So I'll tell you, applications run the world right?
They are at the center of the information technology system from where we sit in the network at least.
Today, the World Wide Web is almost unrecognizable when you compare it with its earlier concept form.
So I don't have the intention to tell you about the history of the Internet and the Web and all that,
but I do want to tell you, in the last decade, we have seen how webdesign moved away from simple Web
sites to interactive Web applications.
So not only are there, you know, design elements, but the technology stack behind the Web and the
Web applications will have improved dramatically.
So when you look into your pockets or onto your screens, you're going to see the result that this improvement
is pretty obvious.
So think of your everyday life use, I don't know how many apps during the day.
I don't mean only Web apps either, but the biggest portion of your time belongs to apps from social
media to business applications.
Almost every organization has a Web application and does business online.
So in other words, we see a wide range of applications being delivered every day.
Even my little cousin started his own personal Web application just a few days ago.
Of course, it must be great having me as an uncle, but that's beside the point.
So Web applications are everywhere across public and private networks, right, you get the point.
They bring as many services, such as financial transactions, searching, shopping and a host of others.
They have the capability to register and authenticate us, so you see where I'm going with this.
The content is generated dynamically and it's mostly specific to users.
Even today, Web applications can reach your geolocation information to send you notifications.
I know you know this already, but what I mean is that much of the information that they process is
highly sensitive and actually private.
So that's why this makes security a big issue.
If an attacker can compromise a Web application, then you may be able to steal personal information
and carry out financial fraud and perform malicious actions against other users.
So these data breaches makes me think that there might be a clue in how the Web applications have actually
become a precious source for hacking.
So there are many resources on the web right.
To search for data breaches and hacking news.
What I do is I'm going to use have I been owned dotcom to show you how versatile data breaches are.
So here there's a list of hacked organizations and companies, and if you scroll down, you're going
to see the list is not very short at all.
And this is only a portion of what we already know.
You can get some quick info about the breaches on this list here, see, and there are links to public
announcements.
So let me click on here to see if it fit data breach announcement.
And it's a notice about the breach and it tells us how it happened and how to protect the users from
the consequences.
OK, so let's return to the list.
As you can see, it goes on and on and it goes way down below.
OK, so another option, if you want to see some fancy graphics and animation, then you can visit information
is beautiful dot net.
And this Web site visualises the information.
So just by glancing over some of this right, we can observe how serious the amount of breaches are,
right.
This is the only ones that have been reported and we know about.
So, again, by clicking on any of the circles, you can get the notice or the news about the breach.
And as you can see, Web applications make an attractive option for attackers.
It only requires a Web browser to interact with a Web application.
Now, comparing it to the skills required to attack operating system based vulnerabilities, hacking
Web applications, it's pretty easy to start with.
And what about statistics?
So I know you hear lots and lots of statistics and you actually need statistics to reinforce your knowledge
when you learn about a topic and for an instructor, you've got to stick in some really good statistics.
Otherwise, the instructor must not know what he's talking about.
Right.
OK, so that means I want to share with you some numbers about application security.
So these numbers will give you a pretty good idea, but I'm not real confident about these numbers because
I don't have much of an opportunity to test their validity.
Can't believe everything you read, write critical thinking.
I advise it.
Anyway, so I read some reports from some reliable sources, and that's where I got these numbers,
so they're pretty reliable.
So let's have a look at the first one.
Sixteen percent.
So this is the percentage of it decision makers whose organizations don't even conduct any penetration
tests, I guess they don't even believe in security.
So the second one is 70 percent.
This is the percentage of organizations that will primarily do pen tests in order to test effectiveness
of their security controls.
And that, my friends, is a good number.
A third one, 84 percent.
This is the percentage of organizations that use red and blue team security testing, good for them,
highly effective.
What about the fourth one, 16 percent?
This is the percentage of security vulnerabilities in tested applications that are medium high or critical
risk.
Therefore, the first point of data breaches start with Web applications.
And the last number, seven billion dollars.
You're wondering what that is, that's the estimated size of the application security market by 2023.
So this might give you an idea for a career, huh?
Uh.
So after this long introduction.
To the current situation and Web application security, some of you may confuse the word website, Web
page, web application.
That's understandable.
And of course, there are differences between these terms.
They're not completely the same, but they are related to each other and it only matters if you do anything
that's related to development at all.
So the term Web site, it's what you display in the Web browser on a user's computer, right?
And a website can have Web pages.
Website can even consist of just one single page.
And the term Web application, it's sometimes used instead of website.
But today, by increasing mobility, this term is now used for the websites that are displayed in mobile
browsers and they seem more like mobile applications.
So using these terms in the right place is very important to a developer, it doesn't necessarily matter
to a user.
However, for a weapon tester, I don't think that's going to cut it.
Why?
Because a weapon tester deals with the basics and this means that you can use both.
Now, from the very first day that I started testing, I got used to saying Web application.
So that's what you're going to hear a lot from me.
But then again, you're here to learn for me.
So this is the beginning of a very beautiful relationship.
That was from Casablanca, by the way.