Cybersecurity Domain 3

Application Security (AppSec) Engineering

Hardening web, API, and mobile applications against OWASP Top 10 vulnerabilities, code exploits, and supply chain threats.

1. Secure Software Development Lifecycle (SSDLC)

Application Security involves embedding security mechanisms into every phase of the software engineering pipeline rather than treating security as a final post-deployment check.

Requirements Phase -> Privacy & Compliance Specs (GDPR, PCI-DSS)
Design Phase       -> Threat Modeling (STRIDE: Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege)
Coding Phase       -> SAST Code Linting, IDE Security Plugins, Parameterized Queries
Build Phase        -> Software Composition Analysis (SCA) for vulnerable npm/PyPI dependencies
Test Phase         -> DAST Vulnerability Scanning & Dynamic Fuzzing
Deploy Phase       -> WAF Enforcement, Container Image Scanning, CSP Headers
Maintenance Phase  -> Bug Bounty Program & Continuous Logging/Monitoring
      

2. OWASP Top 10 Technical Breakdown & Mitigation

A01: Broken Access Control (IDOR)

Occurs when an application fails to check user permissions before serving data or executing state-changing operations.

// VULNERABLE: Direct object reference without ownership check
app.get('/user/invoice', (req, res) => {
  const invoice = db.query(`SELECT * FROM invoices WHERE id = ${req.query.id}`);
  res.send(invoice);
});

// SECURE: Strict session-bound ownership validation
app.get('/user/invoice', authMiddleware, (req, res) => {
  const invoice = db.query('SELECT * FROM invoices WHERE id = ? AND owner_id = ?', 
    [req.query.id, req.user.id]);
  res.send(invoice);
});
      

A03: Injection (SQLi, Command Injection)

Attacker-supplied untrusted data is interpreted as part of a database query or system command execution.

// SECURE: Parameterized Queries / Prepared Statements
const stmt = db.prepare('SELECT id, password_hash FROM users WHERE username = ?');
const user = stmt.get(userInputUsername);
      

A10: Server-Side Request Forgery (SSRF)

Occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to access internal metadata services (e.g., 169.254.169.254) or internal networks.

3. Security Testing Methodologies

SAST (Static Testing)

Analyzes application source code at rest for security defects (e.g., Semgrep, SonarQube, Checkmarx).

DAST (Dynamic Testing)

Scans running HTTP/HTTPS endpoints from an outside-in perspective (e.g., OWASP ZAP, Burp Suite Pro).

SCA (Supply Chain Scanning)

Audits third-party packages, libraries, and Docker base images for known CVEs (e.g., Snyk, Trivy, Dependabot).

IAST (Interactive Testing)

Combines SAST and DAST agents inside the runtime environment to achieve higher precision and lower false positives.

4. Hardening Web Headers & WAF Configuration

Enforce strict security response headers across all HTTP responses:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; object-src 'none';
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()
      