Finding security bugs in web applications using a catalog of access control patterns

Near, Joseph P.; Jackson, Daniel

doi:10.1145/2884781.2884836

Cited by 17 publications

(5 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As we confirmed "vulnerability" and "unauthorized access" achieved relatively high attention from the developers, security bugs are also considered high impact by researchers and have been well studied [6] [12] [16][17] [19][29] [35]. "Lower performance" in "Effect" category is also well studied [20][21] [22][35] as performance bugs.…”

Section: Developer Demography (Q1)supporting

confidence: 58%

What Are the Perception Gaps Between FLOSS Developers and SE Researchers?

Kashiwa

Ihara

Ohira

2019

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

In recent years, many researchers in the SE community have been devoting considerable efforts to provide FLOSS developers with a means to quickly find and fix various kinds of bugs in FLOSS products such as security and performance bugs. However, it is not exactly sure how FLOSS developers think about bugs to be removed preferentially. Without a full understanding of FLOSS developers' perceptions of bug finding and fixing, researchers' efforts might remain far away from FLOSS developers' needs. In this study, we interview 322 notable GitHub developers about high impact bugs to understand FLOSS developers' needs for bug finding and fixing, and we manually inspect and classify developers' answers (bugs) by symptoms and root causes of bugs. As a result, we show that security and breakage bugs are highly crucial for FLOSS developers. We also identify what kinds of high impact bugs should be studied newly by the SE community to help FLOSS developers.

show abstract

Section: Developer Demography (Q1)supporting

confidence: 58%

What Are the Perception Gaps Between FLOSS Developers and SE Researchers?

Kashiwa

Ihara

Ohira

2019

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…Lie et al [24] inspected the presence of a state where a processor loses its tamper resistance and discovered the condition falling into the state. Near and Jackson [25] discovered access patterns that satisfy the security in the web application including some specific elements. These works are different from our work because we abstract specifications of the web as a platform and not individual techniques.…”

Section: ) Formal Methods In Alloymentioning

confidence: 99%

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

et al. 2019

View full text Add to dashboard Cite

Security analysis of a web system is complicated, and thus analysis using formal methods to describe system specification mathematically has attracted attention. Some previous studies have adopted formal methods, but their models cannot express parallel communication completely. This limitation gives rise to problems where web functions, such as a cache that stores contents, cannot be defined and attacks that forge contents cannot be analyzed. These problems are present in the Alloy-based implementations of current models that do not have the ability to express temporal logic. Therefore, we design implementation and evaluation of temporal logic in Alloy to express time series and parallel computation for web security analysis. In doing so, state transitions in the web can be expressed by fitting them in our proposed syntax. As concrete applications, we describe a web security model that includes caches and show that our proposed syntax can analyze state-of-the-art attacks, such as unauthorized access to users' account pages via caches. The source code of our proposed model in Alloy is publicly available.INDEX TERMS Alloy, cache, formal methods, security model, temporal logic, web security. I. INTRODUCTION A. BACKGROUND

show abstract

“…He and Fu [22] used high-level petri nets to ensure the correct implementation of these six security patterns. Near and Jackson [23] showed that previously unknown security bugs could be easily identified using their proposed formal approach SPACE (Security Pattern Checker), which finds implementation bugs in access control security patterns. In an approach to improve security pattern definition, Beherens [24] provided abstractions and their implementations using formalised notation.…”

Section: Related Workmentioning

confidence: 99%

An Approach for Verification of Secure Access Control Using Security Pattern

Gupta

Singh

Mohapatra

2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

According to OWASP-2021, more than 3,00,000 web applications have been detected for unauthenticated and unauthorised access leading to a breach of security trust. Security patterns are commonly used in web applications to address the problem of broken access. Web developers are not experts in implementing security patterns. Therefore, it is necessary to verify that the security pattern has been applied, specifying the original intent of the security pattern. In this paper, an approach has been proposed that analyses the behavioural aspect of security patterns to verify that it meets the security requirement of the web application. The proposed approach extracts the class diagram’s structural properties, relations, associations, and security-related constraints and verifies it using the first-order predicate logic. Experiments have been conducted using class diagrams of security patterns to detect instances of broken access control early in the design phase. The proposed approach will help minimise the risk of unauthenticated and unauthorised access to a web application.

show abstract

Finding security bugs in web applications using a catalog of access control patterns

Cited by 17 publications

References 29 publications

What Are the Perception Gaps Between FLOSS Developers and SE Researchers?

What Are the Perception Gaps Between FLOSS Developers and SE Researchers?

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

An Approach for Verification of Secure Access Control Using Security Pattern

Contact Info

Product

Resources

About