Vulnerabilities mapping based on OWASP-SANS: A survey for static application security testing (SAST)

被引：0

作者：

Li J. ^{[1
]}

机构：

[1] Department of Electrical and Electronic Engineering, Imperial College London, London

来源：

Annals of Emerging Technologies in Computing | 2020年 / 4卷 / 03期

关键词：

Application Security; Checkmarx; Malware Detection; OWASP Top 10; SANS Top 25; Static Application Security Testing; Vulnerability Mapping;

D O I：

10.33166/AETiC.2020.03.001

中图分类号：

学科分类号：

摘要：

The delivery of a framework in place for secure application development is of real value for application development teams to integrate security into their development life cycle, especially when a mobile or web application moves past the scanning stage and focuses increasingly on the remediation or mitigation phase based on static application security testing (SAST). For the first time, to the author’s knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings. A case study is conducted for vulnerabilities scanning of a proof-of-concept mobile malware detection app. Mapping the OWASP/SANS with Checkmarx vulnerabilities queries, flaws and vulnerabilities are demonstrated to be mitigated with improved efficiency. © 2020 by the author.

引用

页码：1 / 8

页数：7

共 21 条

[11]

Rafique S., Humayun M., Gul Z., Abbas A., Javed H, Systematic Review of Web Application Security Vulnerabilities Detection Methods, Journal of Computer and Communications, (2015)

[12]

Yang J., Tan L., Peyton J., Duer K.A., Towards Better Utilizing Static Application Security Testing, 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pp. 51-60, (2019)

[13]

Petukhov A., Kozlov D., Detecting Security Vulnerabilities in Web Applications Using Dynamic Analysis with Penetration Testing, Proceedings of the Application Security Conference, (2008)

[14]

OWASP Top 10-2017 The Ten Most Critical Web Application Security Risks, Open Web Application Security Project

[15]

Howard M., Improving Software Security by Eliminating the CWE Top 25 Vulnerabilities, IEEE Security & Privacy, 7, 3, pp. 68-71, (2009)

[16]

CWE/SANS TOP 25 Most Dangerous Software Errors, (2019)

[17]

Wang Y., Alshboul Y., Mobile security testing approaches and challenges, 2015 First Conference on Mobile and Secure Services (MOBISECSERV), pp. 1-5, (2015)

[18]

Rafique S., Humayun M., Hamid B., Abbas A., Akhtar M., Iqbal K., Web application security vulnerabilities detection approaches: A systematic mapping study, 2015 IEEE/ACIS 16th International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD), pp. 1-6, (2015)

[19]

Ramadlan M.F., Introduction and implementation OWASP Risk Rating Management, Open Web Application Security Project, (2019)

[20]

Ndichu S., Ozawa S., Misu T., Okada K., A Machine Learning Approach to Malicious JavaScript Detection using Fixed Length Vector Representation, 2018 International Joint Conference on Neural Networks (IJCNN), pp. 1-8, (2018)

← 1 2 3 →