Framework for security assessments in web applications

• Autor(a) principal: Cruz, Dinis Barroqueiro
• Data de Publicação: 2023
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10773/41043
• topic: Application security; Vulnerability assesment; Static analysis results interchange format; Continuous integration and contnuous delivery; Docker

Web applications are widely used today, and as a result, the security of those solutions is essential to their smooth operation. Although application security practices and tools used to detect and mitigate vulnerabilities were initially manual, automation developments in the software development lifecycle have paved the way for the integration of security concerns and testing within this cycle. By examining the current solutions and concepts connected with these practices and merging various components to create a more rich analysis of web applications, this thesis concentrates its effort on the problems and opportunities of this integration. Different solutions exist for different problems, and the combination of results is imperative to produce a homogenous look inside the security problems of a web application. This combination is not always trivial, as even with the same structured languages providing a comprehensive output, the transformation of these results is still dependent on a specific understanding of who produced them. This issue is addressed by standards like the Static Analysis Results Interchange Format (SARIF), which aim to generate a comprehensive and repeatable result regardless of the analysis instrument used. In order to produce vulnerability insights into web applications, the work produced by this thesis will orchestrate a variety of tools. This orchestrator will be designed with the understanding that it must be easy to use, adaptable to a variety of environments, and provide a clear interface for the addition of new application security solutions. The EHDEN portal serves as a validation point for the work developed as a web application with an extensive development history and few security considerations, making it possible to evaluate the performance of the work developed and discuss the virtues and shortcomings of this integrated approach.