Category: Web application security testing

Understanding WASA Audits: ABDM Compliance Simplified

Posted on by admin
In today’s digitally driven world, web applications play a pivotal role in business operations and customer interactions. However, this increased reliance on web applications also makes them prime targets for cyber threats. Conducting a Web Application Security Audit (WASA) is essential for identifying, assessing, and mitigating these risks, ensuring that web applications remain secure and reliable. This blog delves into the significance of WASA, its comprehensive process, and the benefits it offers to organizations, particularly in the context of integrating with initiatives like Ayushman Bharat Digital Mission (ABDM).
What is WASA?
A Web Application Security Audit (WASA) is a thorough examination of a web application’s security posture. The primary objective is to identify vulnerabilities that could be exploited by attackers, compromising the application’s integrity, confidentiality, and availability. By adhering to industry best practices and guidelines, such as those outlined by the Open Web Application Security Project (OWASP), a WASA provides organizations with a detailed understanding of their security weaknesses and actionable recommendations for improvement.
The Relevance of ABDM
ABDM stands for Ayushman Bharat Digital Mission, an initiative by the Government of India aimed at creating a digital health ecosystem in the country. The mission’s goal is to develop the necessary infrastructure to support the integration of digital health services, ensuring that healthcare is accessible, affordable, and of high quality for all citizens. Web applications used by healthcare providers must integrate seamlessly with the digital building blocks of ABDM and comply with its guidelines.
Milestones in ABDM Integration
  1. ABHA Number Creation and Capture & Verification  : This milestone focuses on the seamless registration of patients using the Ayushman Bharat Health Account (ABHA) number.
  2. Building Health Information Provider (HIP) Services  : This involves sharing digital records via the Personal Health Records (ABHA) app.
  3. Developing Health Information User (HIU) Services  : This milestone ensures that authorized healthcare workers can access a patient’s medical history with complete consent, providing a comprehensive view of the patient’s health.
Why You Need WASA
Conducting a WASA is crucial for organizations aiming to secure their web applications against potential threats. Here are key reasons why WASA is indispensable:
  • Security Posture Assessment  : Through thorough testing, analysis, and reporting, WASA helps determine an application’s security posture.
  • Comprehensive Reporting  : Detailed reports are provided for the technical team, alongside executive summaries for management.
  • Industry Best Practices  : The audit follows OWASP guidelines, ensuring adherence to industry best practices.
  • ABDM Integration  : Completing a WASA is essential for the exit process of ABDM integration, ensuring compliance with its stringent security requirements.
Highlights of WASA
Testing Scope  :
  • With and/or Without Credentials  : Testing scenarios include both authenticated and unauthenticated users to uncover a wide range of vulnerabilities.
Tools and Techniques  :
  • Best-of-Breed Tools  : A combination of industry-leading tools is utilized for comprehensive security assessments.
  • Manual Validation and Penetration Testing  : Expert manual testing using state-of-the-art techniques and methodologies identifies and validates vulnerabilities.
Vulnerability Targets  :
  •   Privilege Escalation  : Including lateral and vertical privilege escalation.
  •   Injection Attacks  : Such as SQL, LDAP, and URL injection.
  •   Authentication Vulnerabilities  : Covering session management and session hijacking.
  •   Cross-Site Scripting (XSS)  : Detecting and mitigating XSS vulnerabilities.
  •   Misconfigurations  : Addressing security misconfigurations in server and application settings.
  •   Vulnerable Components  : Identifying outdated or insecure components in the application stack.
  •   Unvalidated Redirects and Forwards  : Preventing unvalidated redirects and forwards.
  •   Malware Injection  : Detecting and mitigating malware injection.
  •   Buffer Overflow Vulnerabilities  : Addressing buffer overflow vulnerabilities.
  •   Logic Flaws  : Identifying business logic vulnerabilities that compromise the application’s integrity.
Testing Standards  : 
  • OWASP Top 10  : Testing against the latest OWASP Top 10 vulnerabilities to ensure coverage of the most critical security risks.
Remediation Recommendations
After the audit, detailed remediation recommendations are provided for identified vulnerabilities. These recommendations include best practices for securing applications and mitigating identified risks. The goal is to equip organizations with the knowledge and tools needed to enhance their security posture effectively.
Deliverables After WASA
Upon completion of the WASA, organizations receive a detailed report and a WASA certificate. The report outlines the milestones covered and ensures compliance with CERT-In guidelines. This certification not only validates the security of the web application but also instills confidence in stakeholders and customers regarding the organization’s commitment to cybersecurity.
In an era where cyber threats are constantly evolving, conducting a Web Application Security Audit is not just a best practice but a necessity. By identifying and addressing vulnerabilities proactively, organizations can safeguard their digital assets, ensure compliance with regulatory requirements, and build trust with their customers.
Secure your web applications today and ensure compliance with industry standards. Contact us to schedule your comprehensive Web Application Security Audit and protect your digital assets from potential threats.

Web skimmer on the rise amidst the Covid-19 crisis

Posted on by admin

Consumers today have ramped up their online usage and with brick and mortar stores out of reach temporarily, ecommerce has become more of a lifeline. These shifts to digital platforms for payment have widened the playfield for cyber criminals and digital skimming of credit cards is on the rise.

In times of this pandemic, PCI SSC and the US Chamber of Commerce shared guidance and information on protection against digital skimmers. Understanding the evolved threatscape, PCI SSC council shared guidance and information for protecting against the rising online skimming attacks. The following segments outline the key points :

COVID-19 Crisis : Newly evolved threats online

We have seen a drastic rise in the online activity due to the lockdown. With people spending hours on social and ecommerce sites, it has provided widened access for cybercriminals.  There has been an increase in the number of online phishing and scamming incidents with evolved sophistication and volume.

What and Why’s of Digital Skimming

Digital skimmers are online threat players, involved in injecting malicious code (JS sniffers) into legitimate websites to grab payment data. Once the website is infected, the payment card information is skimmed during the transaction without the merchant or consumer being aware.

It is being counted as under the  Magecart  Umberlla, a term popular with cyber professionals and researchers to summarise all the threat groups responsible for online skimming.

“Ecommerce crime spikes whenever there is an event that forces or entices people to perform more online transactions,” Yonathan Klijnsma, Head of Threat Research, RiskIQ

How does Digital Skimming Attacks work ?

Hackers exploit the vulnerable plugins, credential stuffing and undertake phishing and other social engineering techniques to gain access to third party softwares libraries or ecommerce websites to inject the malicious code. Service providers are not aware of the risk they create if they don’t focus on the security and potential threats.

Third party applications and services that are used involve : Live chat function, advertising scripts, customer rating features etc. Since third party functions are more widely used by ecommerce websites, exploit of one function opens doors for multiple websites through mass distribution of malicious Javascript.

Code is executed when a victim submits his payment details during checkout. Cybercriminals involved gather different details as per their target like billing address, names, email, phone number, credit card details, username and password.  The code running logs the data either locally or remotely to a computer controlled by the threat agent.

How severely does this affect small merchants and business ?

Small merchants and service providers do not have sufficient security controls in place and hence at the most risk of these attaches. In times of these crises, small businesses have hassly moved online to remain operational relying on attimes unevaluated technologies. With reduced staff at work and unavailability of large IT infrastructure, they are more susceptible to suck attacks.

It’s evident  from previous Data breach reports that small businesses are  a major chunk of organizations affected by cyber attacks, In the dire time of this pandemic, the sales of COVID-19 domains have increased dramatically which are also used as platforms to launch phishing campaigns and spread malware.

Digital Skimming : Who’s most vulnerable ?

Any e commerce service provider or implementation that doesn’t have sufficient controls in place, provides their platforms as a playfield for digital skimmers. The insecure third party service providers,  and API developers to be used with the website are at a major risk. The hackers keep evolving their attacks and customize their code based on the susceptibility of their target.

The security checks and controls needs to be persistent as the threats are. The Magecard infected stores have been reported to be re-infected in a short while after being assessed. Hence, it is essential that the systems are cleaned and the vulnerabilities are patched or mitigated.

Best practices : How can we remain secure ?

Detection and prevention of these threats are the only ways to remain secure . Few detection methods are as listed below :

Prevention of Digital Skimming :

  • Implement malware protection and keep up to date
  • Restrict access to payment data and supporting environments to only what is necessary and deny all other access by default
  • Ensure responsibilities with third-parties are well understood
  • Use strong authentication for all access to system components