ENISA Threat Landscape 2020 - Web application attacks

ENEN From January 2019 to April 2020

Web application attacks

ENISA Threat Landscape

Overview

Web applications and technologies have become a core part of the internet by adopting different uses and functionalities. The increase in the complexity of web application and their widespread services creates challenges in securing them against threats with diverse motivations from financial or reputational damage to the theft of critical or personal information. Web services and applications depend mostly on databases to store or deliver the required information. SQL Injection (SQLi) type of attacks are a well-known example and the most common threats against to such services. Cross-site scripting (XSS) attacks are another example. In this type of attack, the malicious actor misuses weaknesses in forms or other input functionalities of web applications that leads to other malicious features such as being redirected to a malicious website.

While organisations are becoming proficient and developing more consistent automation in their web application lifecycle, they are demanding security as the most crucial part of their offering and prioritisation. This introduction of complex environments drives the adoption of new services such as Application Programming Interfaces (APIs). APIs, which create new challenges for web application security the organisations involved to consider more prevention and detection measures. For instance, roughly 80% of organisations adopting APIs deployed controls on their ingress traffic. In this section, we review the threat landscape of web applications during 2019.

__Trends

20%_of companies and organisations reported DDoS attacks on their application services on a daily basis

Buffer overflow was the most common technique used (24%). HTTP flood (23%), resource reduction (23%), HTTPS flood (21%) and Low Slow 21% were other commonly used techniques.

63%_of respondents to CyberEdge survey are using a web application firewall (WAF)

27,5% have plans to deploy this technology and 9,5% do not have any such plans.

52%_increase in the number of web application attacks in 2019 compared with 2018

According to a security researcher, the amount of web application attacks were almost flat compared with 2018 and rose sharply later in the year.

84%_of observed vulnerabilities in web applications were security misconfigurations

This was followed by cross-site scripting (53%) and broken authentication interestingly (45%).

Kill chain

Web application attacks

Reconnaissance Weaponisation Delivery Exploitation

Command & Actions on Installation Control Objectives

Description

_Improved collaboration between application security and application development

According to the survey conducted by a security researcher , one of the factors contributing to such ineffective security could be the decisionmaking about ownership of security tools. The survey presented the views of top influencers in this area naming IT leadership and business owners and not the chief information security officer (CISO).

_Growing importance of Application Programming Interfaces (APIs)

APIs are not new in web application architecture, and their widely accepted usage reintroduces existing risks and their likelihood of exploitation as a result of the widening of the threat landscape. Accordingly, the Open Web Application Security Project (OWASP) published a top 10 list of API security measures 6 providing a prioritised way to secure such capability in web application architecture. One instance of such a threat is the PHP API attacks: according to another security researcher, 87% of the scanning of API traffic was searching for available PHP APIs.

_Authorisation and authentication failures

These are usually the leading cause of malicious actors gaining access to critical information (i.e. fast retailing breach ). According to a security researcher, the breaches of critical data are the second most pressing threat to web application security.

_Growing trend with SQL injection (SQLi)

A recent security research identified that, two-thirds of web application attacks include SQLi attacks. While other web application attack vectors either remained steady or are growing, SQLi attacks continued to grow sharply, and particularly specially escalated during the holiday season of 2019. The findings from this research also identified that the finance industry faces more local file inclusion (LFi) attacks compared with other sectors.

292 200 168 147 92

Attack vectors

_Web application attack vectors

There is general perception that web application attacks are quite diverse. However, data from security research suggests that the majority of web 11,13,14 application attacks are limited to SQLi or LFi. Another report suggests that SQLi, directory traversal, XSS, broken authentication and session management are on the top of the attack vectors used in this type of attacks. SONICWALL also reported a similar trend for the top web application attacks for 2019. On the list SQLi, directory traversal, XSS, broken authentication and session management were on the top.

_Web application attacks

6 2018 2019 5

4 )

2

1

0 JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC

Mitigation

_Proposed actions

 Use input validation and isolation techniques for injection type attacks (i.e. parameterised statements, escape user input, input validation, etc.) .  Implement web application firewalls for preventive and defensive measures17 (also known as virtual patching ).  For web application APIs :  implementing and maintaining an inventory of APIs and validating them against perimeter scans and internal discovery through development and operational teams;  encrypting API communication and connection;  providing the right authentication mechanisms and authorisation levels.  Incorporate application security processes into the application development and maintenance life-cycle.  Restrict access to inbound traffic for required services only.  Deploy traffic and bandwidth management capabilities.  Enforce web application server hardening and maintain a good patch management and testing processes.  Perform vulnerability and risk assessments before and during the web application development.  Conduct regular penetration testing during implementation and after deployment.

_Web applications by maximum severity of vulnerabilities found

100% 90% 80% 70% 60% High 50% Medium 40% Low 30% 20% 10% 0%

2015 2016 2017 2018 2019

References

“The increase in the complexity of web application and their widespread services creates challenges in securing them against threats with diverse motivations from financial or reputational damage to the theft of critical or personal information.”

Related

ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

About

_ The agency

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contributors

Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

Editors

Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

Contact

For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

Legal notice

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice

© European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-354-4 DOI: 10.2824/552242