+APP.3.1 Web Applications and Web Services
---+APP.3.1.G1. Insufficient Logging of Security-Relevant events
---+APP.3.1.G2. Disclosure of Security-Relevant Information in Web Applications and Web Services
---+APP.3.1.G3. Misuse of a Web Application Due to Automated Use
---+APP.3.1.G4. Insufficient Authentication
---+APP.3.1.A1 Authentication (B)
---+APP.3.1.A4 Controlled Integration of Files and Content (B)
---+APP.3.1.A7 Protection Against Unauthorised Automated Use (B)
---+APP.3.1.A14 Protection of Confidential Data (B)
---+APP.3.1.A8 System Architecture [Procurement Department] (S)
---+APP.3.1.A9 Web Application and Web Service Procurement (S)
---+APP.3.1.A11 Secure Integration of Background Systems (S)
---+APP.3.1.A12 Secure Configuration (S)
---+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)
---+APP.3.1.A22 Penetration Testing and Auditing (S)
---+APP.3.1.A20 Use of Web Application Firewalls (H)

APP.3.1 Web Applications and Web Services

Introduction

Web applications provide users with particular functions and dynamic (changing) content. For this purpose, such applications use the Internet protocols HTTP (Hypertext Transfer Protocol) or HTTPS. With HTTPS, connections are cryptographically secured by the TLS (Transport Layer Security) protocol. Web applications make documents and user interfaces available on a server (in the form of input masks, for example) and deliver them on request to corresponding programs on clients such as web browsers.

Web services are applications that use the HTTP(S) protocol to provide data to other applications. As a rule, they are not directly controlled by users.

Several components are usually required to operate a web application or web service. Web servers are usually required to deliver data, as are application servers to run the actual application or service. Additional background systems are also needed, which are often connected as data sources via different interfaces (e.g. databases or directory services).

Web applications and web services are used in both public data networks and organisations' local networks (intranets) to provide data and further applications. As a rule, users must authenticate themselves in order to access a web application or a web service.

Objective

The aim of this module is to ensure the secure use of web applications and web services and to protect the information they process.

Scoping and Modelling

This module must be applied to every web application and web service that is used in the information domain in question.

It does not cover requirements for web servers or the editorial planning of a web presence. These can be found in module APP.3.2 Web Servers. The development of web applications is covered in module CON.10 Development of Web Applications.

Web service interfaces are often created using Representational State Transfer (REST) or Simple Object Access Protocol (SOAP). This module only considers REST-based web services. It focuses on the operational phase of the lifecycle. Security requirements resulting from planning and design or from decommissioning and business continuity planning are not considered in this module; these must be included in a separate risk analysis.

Finally, general requirements for the selection of software are covered in module APP.6 General Software.

Useful Resources

On its website, the Open Web Application Security Project (OWASP) provides guidance on securing web applications and web services.

The Federal Office for Information Security (BSI) provides guidance on the use of cryptographic procedures in the document “Cryptographic Mechanisms: Recommendations and Key Lengths: BSI TR-02102”.

1. Panoramica

APP.3.1.A1 Authentication (B)

The IT Operation Department MUST configure web applications and web services in such a way that users have to authenticate themselves to access protected resources. An appropriate authentication method MUST be selected for this purpose. The selection process SHOULD be documented.

The IT Operation Department MUST define appropriate thresholds for failed login attempts.
APP.3.1.A4 Controlled Integration of Files and Content (B)

If a web application or web service offers an upload function for files, this function MUST be restricted as far as possible by the IT Operation Department. In particular, the allowed file size, file types, and storage locations MUST be defined. The users allowed to use the upload function MUST be defined. Access and execution rights MUST also be set restrictively. Furthermore, it MUST be ensured that a user can save files only in the specified storage location.
APP.3.1.A7 Protection Against Unauthorised Automated Use (B)

The IT Operation Department MUST ensure that web applications and web services are protected against unauthorised automated use. However, these efforts MUST take into account the impact that the protection mechanisms will have on the ability of authorised users to use each application and service. If a web application contains RSS feeds or other functions explicitly intended for automated use, this MUST also be taken into account when configuring the protection mechanisms.
APP.3.1.A14 Protection of Confidential Data (B)

The IT Operation Department MUST ensure that access data for a web application or service is protected from unauthorised access on the server side using secure cryptographic algorithms. Salted hash methods MUST be used for this purpose.

The files containing the source code of a web application or service MUST be protected against unauthorised retrieval.
APP.3.1.A8 System Architecture [Procurement Department] (S)

Security aspects SHOULD be considered early on in the planning of web applications and web services. It SHOULD also be ensured that the architecture of a web application or service maps the exact business logic of the relevant organisation and implements it correctly.
APP.3.1.A9 Web Application and Web Service Procurement (S)

In addition to the general aspects of software procurement, an organisation SHOULD, at minimum, consider the following when procuring web applications and web services:

  • Secure input validation and output encoding
  • Secure session management
  • Secure cryptographic procedures
  • Secure authentication procedures
  • Secure procedures for server-side storage of credentials
  • Appropriate access management
  • Sufficient logging capabilities
  • Regular security updates from the software developer
  • Protection mechanisms against widespread attacks on web applications and web services
  • Access to the source code of the web application or web service
APP.3.1.A11 Secure Integration of Background Systems (S)

Access to background systems to which functions and data are outsourced SHOULD only be possible from defined IT systems via defined interfaces. When communicating across network and site boundaries, data traffic SHOULD be authenticated and encrypted.
APP.3.1.A12 Secure Configuration (S)

Web applications and web services SHOULD be configured in such a way that their resources and functions can only be accessed using the secured communication paths specified for this purpose. Access to resources and functions that are not required SHOULD be disabled. If this is not possible, such access SHOULD be restricted as far as possible. The following actions SHOULD be taken when configuring web applications and web services:

  • Disabling unnecessary HTTP methods
  • Configuring character encoding
  • Removing security-related information from error messages and responses
  • Storing configuration files outside of the web root directory
  • Defining thresholds for access attempts
APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.
APP.3.1.A22 Penetration Testing and Auditing (S)

Web applications and web services SHOULD be checked for security issues at regular intervals. In particular, audits SHOULD be performed regularly. The results SHOULD be documented transparently, protected adequately, and handled confidentially. Deviations SHOULD be investigated. The results SHOULD be presented to the CISO.
APP.3.1.A20 Use of Web Application Firewalls (H)

Organisations SHOULD use web application firewalls (WAF). The configuration of a given WAF should be adapted to the web application or service it is meant to protect. The WAF's configuration SHOULD be checked after each web application or web service update.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
includes APP.3.1.G1. Insufficient Logging of Security-Relevant events
includes APP.3.1.G2. Disclosure of Security-Relevant Information in Web Applications and Web Services
includes APP.3.1.G3. Misuse of a Web Application Due to Automated Use
includes APP.3.1.G4. Insufficient Authentication