Web application security frame

• US 7,818,788 B2
• Filed: 02/14/2006
• Issued: 10/19/2010
• Est. Priority Date: 02/14/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Meier, John D.
• Primary Examiner(s): Bui; Kieu Oanh
• Assistant Examiner(s): ANDERSON, MICHAEL D
• Application Number:
  US11/353,821
• Publication Number:
  US 20070199050A1
• Time in Patent Office: 1,708 Days
• Field of Search: 726/18, 726/23, 726/25, 726/26
• US Class Current: 726/4
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A web application security frame (e.g., schema) that can incorporate expertise into an engineering activity, for example, a threat modeling activity, is provided. The novel web application security frame component can be applied to a threat modeling component to converge knowledge into the activity by identifying categories, vulnerabilities, threats, attacks and countermeasures. The novel schema can create a common framework that converges knowledge with respect to any application engineering activity (e.g., threat modeling, performance modeling). Additionally, a context precision mechanism can be employed to automatically and/or dynamically determine a context of a web application environment. This context can be used to automatically generate an appropriate web application security frame component.

Claims

1. A method implemented with a computing system that includes a processor and memory storing instructions which, when executed by the processor, implement the method for incorporating security engineering expertise into one or more development engineering activities related to a development life cycle of a web-based application, by generating a web application security frame that identifies and categorizes security expertise specific to a context of the web-based application, the security expertise for use in the one or more development engineering activities for development of the web-based application, the one or more development engineering activities including executing a threat modeling activity for the web-based application, the method comprising:

determining a context of the web-based application, the context identifying environment information corresponding to the web-based application, including environment information corresponding to at least one of a web-based application type, a web-based application scenario, a web-based application project type or a web-based application life cycle type;

identifying engineering expertise relevant to the one or more development engineering activities, including the threat modeling activity, for the web-based application based at least in part upon the context, the engineering expertise identifying one or more categories that identify areas where security issues arise when developing web-based applications corresponding to the context of the web-based application, each category corresponding to;

engineering expertise identifying one or more vulnerabilities corresponding to the category;

engineering expertise identifying one or more threats or attacks against the vulnerabilities; and

engineering expertise identifying one or more countermeasures against the threats or attacks;

generating, at the computing system, a web application security frame based on the identified engineering expertise that identifies and categorizes security expertise specific to the context of the web-based application, the web application security frame employing the one or more categories to organize the corresponding vulnerabilities, threats or attacks, and countermeasures;

identifying the one or more development engineering activities related to the development life cycle of the web-based application, including identifying the threat modeling activity;

executing, on the computing system, the threat modeling activity for the web-based application based at least in part upon the web application security frame, including the identified engineering expertise specific to the context of the web-based application; and

receiving results from the threat modeling activity, and incorporating the results into the one or more development engineering activities into the development life cycle of the web-based application.

2. The method of claim 1, wherein the web application security frame identifies engineering expertise related to at least one of input validation, authentication, authorization, configuration management, session management, or auditing and logging.

3. The method of claim 1, wherein the web-based application type is an e-commerce web-based application.

4. The method of claim 1, wherein the web-based application type is a digital rights management application.

5. The method of claim 1, wherein the web-based application scenario is intranet.

6. The method of claim 1, wherein the web-based application scenario is internet.

7. The method of claim 1, wherein the engineering expertise includes expertise related to at least one of spoofing, tampering, repudiation, information disclosure, denial of service, or elevation.

8. A computer readable storage medium having stored thereon computer executable instructions that, when executed by a processor, perform the method of claim 1.

9. A computer-implemented system comprising a processor and one or more physical computer readable storage media operatively coupled to the processor, the computer readable storage media having stored thereon computer executable instructions that, when executed by the processor, implement the method of claim 1.

10. The computer-implemented system of claim 9, wherein the one or more security-related category is input validation, the vulnerability is a non-validated input operation, the attack is a cross-site scripting (XSS) operation, and the countermeasure is a constrain/reject/sanitize operation.

11. The computer-implemented system of claim 9, wherein the web application type is an e-commerce web application.

12. The computer-implemented system of claim 9, further comprising identifying the engineering expertise based at least in part upon a machine learning mechanism.

13. The computer-implemented system of claim 9, wherein the one or more categories include at least one of input and data validation, authentication, authorization, configuration management, sensitive data handling, session management, cryptography, exception management, or auditing and logging.