General HTML5/CSS3
The web application is developed with minimalist attend to security risk, resulting in a surprising number of corporate sites that are vulnerable to hackers. Prominent sites from regulated industries like financial services, government, retail, and healthcare are probed daily. Needless to say, the consequences of the security breach are devastating: loss of revenues, damage to credibility, legal liabilities as well as loss of customer loyalty. web applications are used to perform most major tasks or website functions and is collecting personal, classified and confidential information such as feedback. Web application security is a significant privacy and risk compliance concern that risk of being found guilty of non-compliance.
Why web application security should be part of your web risk management program:-
Reduce cost of recovery and fixes.
Ensure customer trust.
Encourage website adoption.
Maintain competitive advantage.
Reduce cost of manual and outsourced security testing.
There are six important security concepts that should be considered web application development.
Confidentiality:- Vital data should be accessible only to authorized users he/she Authentication: it helps to establish the identity of the users he/she
Authorisation: to authorize the user, he /she need to receive a service or perform an action
Integrity:- the security measure allows the receiver to determine that data is correct Availability: it's required the information and communication availability
Non-repudiation:- -it helps to prevent later denial of an action that happened
1. Understanding
2. Communicate
3. Measure
* understanding:- Performing security testing during the application development during the various stages of development to QA staging will reduce the online risk and reduce costs and significantly. Production application is the first place to implement regular audits and analysis the organisation need to secure and compliance the risk to their organisation.
*communication:- There are several good sources both online in security testing tools for developers QA performs delta, trend, and regression analysis on the security defects to performance and functionality flaws. after risks and security defects have been identified, it is very important to give the stockholder the right information.
The increasing number and scope of government and internal regulations and policies, team's form security, risk, R&D, and compliance need to communicate and validate application risks against the business drivers.
*Measure:- For any process to be successful, there need to be criteria by which to measure the successes or failures of the procedures implemented. An organization use trending and defect remediation analysis metrics to identify areas and issues to focus on. there may be certain security defect type that keeps cropping up which can be identified with targeted, education and training is to recognize repeated risks with a particular infrastructure product, measuring and analyzing scan results will contribute to a reduction in liability and risk brought implementing a web application security plan.