Systematic Approach for Web Protection Runtime Tools’ Effectiveness Analysis

Web applications represent one of the principal vehicles by which attackers gain access to an organization’s network or resources. Thus, different approaches to protect web applications have been proposed to date. Of them, the two major approaches are Web Application Firewalls (WAF) and Runtime Application Self Protection (RASP). It is, thus, essential to understand the differences and relative effectiveness of both these approaches for effective decision-making regarding the security of web applications. Here we present a comparative study between WAF and RASP simulated settings, with the aim to compare their effectiveness and efficiency against different categories of attacks. For this, we used computation of different metrics and sorted their results using F-Score index. We found that RASP tools scored better than WAF tools. In this study, we also developed a new experimental methodology for the objective evaluation of web protection tools since, to the best of our knowledge, no method specifically evaluates web protection tools

A new multi-label dataset for Web attacks CAPEC classification using machine learning techniques

Context: There are many datasets for training and evaluating models to detect web attacks, labeling each request as normal or attack. Web attack protection tools must provide additional information on the type of attack detected, in a clear and simple way. Objectives: This paper presents a new multi-label dataset for classifying web attacks based on CAPEC classification, a new way of features extraction based on ASCII values, and the evaluation of several combinations of models and algorithms. Methods: Using a new way to extract features by computing the average of the sum of the ASCII values of each of the characters in each field that compose a web request, several combinations of algorithms (LightGBM and CatBoost) and multi-label classification models are evaluated, to provide a complete CAPEC classification of the web attacks that a system is suffering. The training and test data used for training and evaluating the models come from the new SR-BH 2020 multi-label dataset. Results: Calculating the average of the sum of the ASCII values of the different characters that make up a web request shows its usefulness for numeric encoding and feature extraction. The new SR-BH 2020 multi-label dataset allows the training and evaluation of multi-label classification models, also allowing the CAPEC classification of the various attacks that a web system is undergoing. The combination of the two-phase model with the MultiOutputClassifier module of the scikit-learn library, together with the CatBoost algorithm shows its superiority in classifying attacks in the different criticality scenarios. Conclusion: Experimental results indicate that the combination of machine learning algorithms and multi-phase models leads to improved prediction of web attacks. Also, the use of a multi-label dataset is suitable for training learning models that provide information about the type of attack. (c) 2022 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/

The application of blockchain algorithms to the management of education certificates

Blockchain is a new application technology in many sectors and the same is true in the world of education. Therefore, there is an increasingly emerging need to research blockchain technology, as it is still taking its first steps in different sectors, such as education. This article presents a review of the state of the art of blockchain technology in the education sector, focusing on identifying the advantages, disadvantages, and challenges associated with the introduction of blockchain technology in the education sector. In addition, the implementation of a title certificate solution through blockchain technology through the BeCertify project is presented. In this solution, the development stages of the platform, the system architecture, and the operation of the API have been carried out, resulting in a platform that constitutes the first step towards a more transparent and technologically advanced way of managing the certifications of the students’ qualifications

Application of the SAMA methodology to Ryuk malware

Malware analysis is an essential discipline for understanding the nature, attack vectors, and weaknesses of systems to combat the threats that emerge every day in the IT security world. To this end, a malware analysis methodology can facilitate and improve an otherwise complex, chaotic, and relatively inefficient process, optimising the results obtained and the productivity of the analysis. To prove the effectiveness of a malware analysis methodology, it is necessary to test it on relevant specimens. The aim of this paper is, on one hand, to test and demonstrate the value of the SAMA methodology as a systematic process for analysing malware with a real and significant use case and, on the other hand, to show, explain and put into practice several actual malware analysis techniques and tools using a real and relevant use case. The analysis process carried out with the methodology shows its ability to guide a malware analysis process as well as its flexibility to adapt the techniques according to the findings obtained during the process

New Validation of a Cybersecurity Model to Audit the Cybersecurity Program in a Canadian Higher Education Institution

This article presents the results of one empirical study that evaluated the validation of the CyberSecurity Audit Model (CSAM) for the second time in a different Canadian higher education institution. CSAM is utilized for conducting cybersecurity audits in medium or large organizations or a Nation State to evaluate and measure cybersecurity assurance, maturity, and cyber readiness. The authors review best practices and methodologies of global leaders in the cybersecurity assurance and audit arena, that puts in evidence the lack of universal guidelines to conduct extensive cybersecurity audits and the detection of existing weaknesses in general programs to deliver cybersecurity awareness training. The architecture of CSAM is described in central sections. CSAM has been tested, implemented, and validated in three research scenarios (1) a single cybersecurity domain audit (Awareness Education), (2) Cybersecurity audit of several domains (Governance and Strategy, Legal and compliance, Cyber Risks, Frameworks and Regulations, Incident Management, Cyber Insurance and Evolving Technologies) and (3) Cybersecurity audit of all model domains The study concludes by showing how the validation of the model allows to report significant information for future decision making that the target organization may correct cybersecurity weaknesses or to improve cybersecurity domains and controls

The Application of a New Secure Software Development Life Cycle (S-SDLC) with Agile Methodologies

The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in most cases, the high value offered to the projects is not taken into account. Nowadays, agile models are booming. They are defined by the way they achieve the interaction and integration of everyone involved in the software life cycle, the advantages of the quick reaction to change, and the implementation of artifacts or deliverables which display the level of progress reached at any time. In this context, it seems clearly necessary to define a new software development model, which prioritizes security aspects at any phase of the software life cycle and takes advantage of the benefits of the agile models. The proposed methodology shows that if security is considered from the beginning, vulnerabilities are easily detected and solved during the time planned for the project, with no extra time nor costs for the client and it increases the possibilities of reaching success in terms of not only functionality but also quality

Implementation and Security Test of Zero-Knowledge Protocols on SSI Blockchain

The problem of digital identity acquires more relevance every day in the eyes of a society that spends more and more time connected to the Internet. It has evolved throughout its history to reach a decentralized model known as Self-Sovereign Identity (SSI), which finds its natural tools in the blockchain technology and Zero-Knowledge Proofs (ZKPs). ZKPs, in this context, allow users to prove that their credentials are legitimate without revealing more information than is strictly necessary, and constitute one of the most promising areas of applied cryptography. In this work, an application is developed for the study of Zero-Knowledge Proof methods and, specifically, in their application for authentication in public-private key encryption systems. It focuses on the study of three ZKP protocols (Feige-Fiat-Shamir, Guillou-Quisquater, and Schnorr, which rely on the problems of large number factorizations and discrete logarithms for security) in the practical use-case where a prover wants to demonstrate knowledge of a private key for a public key without revealing the key itself. The application allows the user to modify the necessary parameters in each method to achieve a better understanding of their role in their safety and efficiency. Several types of attacks are carried out against the above-mentioned protocols to analyze their degree of security and what recommendations can be made to improve it

The application of a new secure software development life cycle (S-SDLC) with agile methodologies

The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in most cases, the high value offered to the projects is not taken into account. Nowadays, agile models are booming. They are defined by the way they achieve the interaction and integration of everyone involved in the software life cycle, the advantages of the quick reaction to change, and the implementation of artifacts or deliverables which display the level of progress reached at any time. In this context, it seems clearly necessary to define a new software development model, which prioritizes security aspects at any phase of the software life cycle and takes advantage of the benefits of the agile models. The proposed methodology shows that if security is considered from the beginning, vulnerabilities are easily detected and solved during the time planned for the project, with no extra time nor costs for the client and it increases the possibilities of reaching success in terms of not only functionality but also quality

Systematic Approach to Malware Analysis (SAMA)

Malware threats pose new challenges to analytic and reverse engineering tasks. It is needed for a systematic approach to that analysis, in an attempt to fully uncover their underlying attack vectors and techniques and find commonalities between them. In this paper, a method of malware analysis is described, together with a report of its application to the case of Flame and Red October. The method has also been used bv different analysts to analyze other malware threats like 'Stuxnet', 'Dark Comet', Toison Ivy', 'Locky', 'Careto', and 'Sofacy Carberp'. The method presented in this work is a systematic and methodological process of analysis, whose main objective is the acquisition of knowledge as well as to gain a full understanding of a particular malware. Using the proposed method to analyze two well-known malware as 'Flame' and 'Red October' will help to understand the added value of the method

On Combining Static, Dynamic and Interactive Analysis Security Testing Tools to Improve OWASP Top Ten Security Vulnerability Detection in Web Applications

The design of the techniques and algorithms used by the static, dynamic and interactive security testing tools differ. Therefore, each tool detects to a greater or lesser extent each type of vulnerability for which they are designed for. In addition, their different designs mean that they have different percentages of false positives. In order to take advantage of the possible synergies that different analysis tools types may have, this paper combines several static, dynamic and interactive analysis security testing tools—static white box security analysis (SAST), dynamic black box security analysis (DAST) and interactive white box security analysis (IAST), respectively. The aim is to investigate how to improve the effectiveness of security vulnerability detection while reducing the number of false positives. Specifically, two static, two dynamic and two interactive security analysis tools will be combined to study their behavior using a specific benchmark for OWASP Top Ten security vulnerabilities and taking into account various scenarios of different criticality in terms of the applications analyzed. Finally, this study analyzes and discuss the values of the selected metrics applied to the results for each n-tools combination