Issue No.04 - July/August (2003 vol.15)
<p><b>Abstract</b>—Application-level Web security refers to vulnerabilities inherent in the code of a Web-application itself (irrespective of the technologies in which it is implemented or the security of the Web-server/back-end database on which it is built). In the last few months, application-level vulnerabilities have been exploited with serious consequences: Hackers have tricked e-commerce sites into shipping goods for no charge, usernames and passwords have been harvested, and confidential information (such as addresses and credit-card numbers) has been leaked. In this paper, we investigate new tools and techniques which address the problem of application-level Web security. We 1) describe a scalable structuring mechanism facilitating the abstraction of security policies from large Web-applications developed in heterogeneous multiplatform environments; 2) present a set of tools which assist programmers in developing secure applications which are resilient to a wide range of common attacks; and 3) report results and experience arising from our implementation of these techniques.</p>
Application-level Web security, security policy description languages, component-based design.
David Scott, Richard Sharp, "Specifying and Enforcing Application-Level Web Security Policies", IEEE Transactions on Knowledge & Data Engineering, vol.15, no. 4, pp. 771-783, July/August 2003, doi:10.1109/TKDE.2003.1208998