Hardening web applications using a least privilege DBMS access model

Steiner, Stuart; Leon, Daniel Conte de; Jillepalli, Ananth A.

doi:10.1145/3212687.3212863

Cited by 4 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The principle of least privilege (PoLP) (Steiner et al, 2018) is a fundamental tenet in access control within the Metaverse. Its essence lies in granting users only the minimal privileges required to fulfill their authorized tasks.…”

Section: Principle Of Least Privilegementioning

confidence: 99%

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

Upadhyay,

Kumar,

Sharma

et al. 2023

International Journal of Cloud Applications and Computing

View full text Add to dashboard Cite

The advent of the metaverse has revolutionized virtual interactions and navigation, introducing intricate access control challenges. This paper addresses the need for effective access control models in the cloud-based metaverse. It explores its distinct characteristics, including its dynamic nature, diverse user base, and shared spaces, highlighting privacy concerns and legal implications. The paper analyzes access control principles specific to the cloud-based metaverse, emphasizing least privilege, separation of duties, RBAC, defense-in-depth, and auditability/accountability. It delves into identity verification and authorization methods, such as biometrics, multi-factor authentication, and role-based/attribute-based authorization. Advanced access control technologies for the cloud-based metaverse are examined, including SSO solutions, blockchain-based access control, ABAC, adaptive access control, and VMI for isolation. Risk mitigation strategies encompass IDS/IPS, SIEM, and user education programs.

show abstract

Section: Principle Of Least Privilegementioning

confidence: 99%

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

Upadhyay,

Kumar,

Sharma

et al. 2023

International Journal of Cloud Applications and Computing

View full text Add to dashboard Cite

show abstract

“…In classifying the model, the dataset used is a server access log file consisting of normal access logs, SQL injection attack logs, XSS attack logs, and Denial of Service (DOS) attack logs against DVWA applications. Steiner S, de Leon D, and Jillepalli A [19] use Multillidae vulnerable web application as a study case for developing a non-least privilege security model for its DBMS database permissions. Alazmi S and De Leon D [20] benchmarked 30 web vulnerability scanners towards OWASP Web Security 2010, 2013, 2017, and 2021.…”

Section: Related Workmentioning

confidence: 99%

Web Application Security Education Platform Based on OWASP API Security Project

Idris

Syarif

Winarno

2022

EMITTER Int'l J. of Engin. Technol.

View full text Add to dashboard Cite

The trend of API-based systems in web applications in the last few years keeps steadily growing. API allows web applications to interact with external systems to enable business-to-business or system-to-system integration which leads to multiple application innovations. However, this trend also comes with a different surface of security problems that can harm not only web applications, but also mobile and IoT applications. This research proposed a web application security education platform which is focused on the OWASP API security project. This platform provides different security risks such as excessive data exposure, lack of resources and rate-limiting, mass assignment, and improper asset management which cannot be found in monolithic security learning application like DVWA, WebGoat, and Multillidae II. The development also applies several methodologies such as Capture-The-Flag (CTF) learning model, vulnerability assessment, and container virtualization. Based on our experiment, we are successfully providing 10 API vulnerability challenges to the platform with 3 different levels of severity risk rating which can be exploited using tools like Burp Suite, SQLMap, and JWTCat. In the end, based on our performance experiment, all of the containers on the platform can be deployed in approximately 16 seconds with minimum storage resource and able to serve up to 1000 concurrent users with the average throughput of 50.58 requests per second, 96.35% successful requests, and 15.94s response time.

show abstract

Automated Enforcement of the Principle of Least Privilege over Data Source Access

Huang

et al. 2020

2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)

View full text Add to dashboard Cite

Hardening web applications using a least privilege DBMS access model

Cited by 4 publications

References 12 publications

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

Web Application Security Education Platform Based on OWASP API Security Project

Automated Enforcement of the Principle of Least Privilege over Data Source Access

Contact Info

Product

Resources

About