1. Introduction

There have been reports such as ‘there is high rate of web application vulnerability’ as well as a range of

ways in which web hackers attack web applications. Since the discovery that web applications convey

the best content to users, there have been attempts to determine ways in which these systems can be

hacked into through defacing, damage and defrauding. As the culture of conveying information across

the internet continues to gain ground, there are increasing cases of vulnerabilities of these sites to cyber

criminals.

It has also been found that a large number of businesses use web sites to deliver messages to their

customers , communicate with their customers as well as sell products to them. They may also need to

sell certain technologies that are designed to handle various types of functions of a web site. The use of

content management systems such as Joomla and Drupal may find itself helpful in building strong web

sites with products or services and related content. When businesses want to process blogs, applications

such as Word press or forums functioning on the principle of phpBB that utilizes user generated

information from the web assessors to allow customers communicate through comments and

discussions. Other web applications such as magneto are frequently used in e-commerce by both large

and small scale businesses that carry out their transactions directly on the web. There are also a number

of proprietary applications that are used by web sites and this calls for making web applications a top

priority for both small site as well as big site owners.

There is also need to analyze the competence of web application software by carrying an online test

development, administration and grading process which enables web site to carry out online tests of

their web application software so that its functionality and reliability can be known. It also involves

development of websites to incorporate more information such as news, papers and interface that

allows adding and deletion of papers. It can also be use to know the competencies that exist in a web

application. It is also used to show the mastery of the web site owner of some of the competencies in

the domains of leadership, communication strength and reasoning and the ability to solve problems

effectively. On the basis of Information technology IT, the domains in which competencies may be

determined include software, networks, IT Management, security or databases.

This paper explains the procedure of using capstone matrix to determine the competency of a web

application and also recommend the precautions that are need to ensure that a web application is not

hacked into by authorized users.

This paper also tries to explain on how hack-resilient applications can be built. This is an application that

meets certain requirements of the capstone matrix by reducing the possibility of attack and ensures that

damage does not occur. This is an application that is found in the host server in a network that has been

developed using design and procedures that cannot be hacked as well. This paper explains that there is

need to secure an application by making sure that input is validated, authenticated, authorized and data

is made sensitive. By using capstone competency matrix, it shows the competency of the application and

the likelihood of its being hacked into by unauthorized users. This allows for remedial actions such as

securing the network, securing the host and also securing the application.

The results of the capstone matrix are also important in determining the level of security in the threes

physical tiers i.e. web server, remote application server and database server. The use of competence

matrix gives the information regarding security information that that are found in the host network and

the level of application vulnerabilities that can be used to structure application arrangements for

security purposes.

I. Literature review

As the number of web applications used increases, so are the number of security risks associated with

them. Currently web application security is a concern everywhere and there is need to determine how

competent a web application is towards certain threats such as hacking and security of information.

There are a number of technical and business applications of web applications

a. Areas of application of web applications

a) Network and application levels merging

In the older days, vulnerability detection was mainly focused on network or operating system of a

hardware component. These involved the use of traditional manual hacking testing and also automatic

testing using security tools. The trends have currently focused on the need to scan for the competency

of a network as well as the vulnerability of an application. Presently, interest has been focused on

combining the ability of network scanners with tool kits used in web application security space. The

purpose of merging network and application competency analysis is to locate the information found in

one level and use the same approach towards determining the competency of the next level. Another

area that has attracted interest in vulnerability testing is the network management consoles. The

present consoles are geared towards finding network device data such as firewall. Focus is made on

incorporating applications from a number of tools such as firewalls. However, there is no likelihood of

integration taking place in patch management methods. Furthermore, consoles have the ability to

attach patch management solutions to data conveying information regarding the existence of problems.

The challenge is that a number of web applications are proprietary and therefore recognized by only

certain customers and departments within a large organization.

b) QA testing and Developer Awareness

In the olden days, quality assurance teams were not working in partnership with information security

work force, however, there are trends towards a change in this culture. For instance, mercury

interactive, an entity involved in automated testing tools, proposed that they would enter into

partnership with some of the most successful application security testing companies that provide a

reliable solution to mercury’s testing goods and the applications used by to determine vulnerability of

tools.

QA testing is also expected to move from basic testing of functions to compliance testing. These include

compliance with certain federal laws concerning privacy. They could also be used to determine the types

of web pages that are not likely to refer to web page privacy information or the web pages that are like

to result into leakage of information in the site of form information. It is also speculated that the

developers are also likely to benefit from the wide range of a web application vulnerability detection

tools that are currently being developed. The purpose of detection tools is to track defective or insecure

lines of information that might be the sources of vulnerabilities. This is speculated to take place during

development tool process such as a writing of a code. A number of vendors have developed tools that

improve code security despite the fact that up to date there have been low sales of these tools.

Furthermore, number of these code scanning tools is not able to provide complete awareness of an

application and focuses on only specific modules of code. This is likely to result into more complex

problems such as between a UI module and database module, scanners have been successful in their

use in the same purpose. It is also speculated that there might be integration with bug detecting

systems to allow developers to only follow the present defect detecting process and make the

corrections regarding vulnerability as a simple defect of function in their code.

c) Attack detection Sophistication Increases

There have been tremendous improvements in development of web application vulnerability detection

technology. Tools have gone beyond the normal buffer overflow attacks and have the detection abilities

that can only be attained by few strings. These tools are mainly geared towards online detection. The

use XSS attack detection methods are currently shifting from the conventional inline string injection

method to a multi-faceted attack and detection process that needs persistence of state. Other areas

that have not been tackled include performance of a large form of information from the web application

and user information that needs to be kept and referenced with accuracy without false information.

For instance, a number of large financial institutions had problems with cross-frame scripting (XSS), and

example of a phishing attack that affects a frame in a web page.

There has also been increasing focus on web services. Despite the slow rates of their adoption by the

masses, a number of users own sites and web applications that are dependent on web services and

require knowing how competent those web services are. For instance, vendors involved in this area used

simple detection methods such as XML based detection and applying common web competency in a non

–xml applications.

b. Some of the threats and counter measures

This part of the article explains some of the treats that are likely to be faced by a network, host or

application layers. It determines how a web application can be regarded as competent enough to

withstand threats that hinder its application

When security features have been incorporated into application design, implementation is helpful in

understanding the manner in which attackers would like to hack into the application.

Designing a secure web application

c. Building secure web applications

d. Assessing your security

II. Rationale and systems Analysis for the Project

In this stage of assessing the competency of web application software, a number of considerations have

been identified. They are explained in this section.

a. Access control

The paper explains that there is need to determine a criterion for mandatory data access control and

understanding different factors that can be helpful in implementation of access control and coming up

with a better access control plan. The paper also explains that there is need to implement and manage

access control plan in compliance with principles that control access control systems that are supposed

to be known. It is also important to identify other access control plans such as ID cards and getting

proper knowledge concerning warning banners that are used in implementing access rules.

b. Social engineering, phishing and identity theft

There is also need to understand a number of social engineering concepts and their function in insider

attacks and coming up with better practices that can hinder social engineering. There is also need to

develop plans that prevent phishing attacks.

c. Physical security

It has also been found that there is need to determine the standards, directives, processes and policies

that guarantee the physical safety of web application software. There is also need to value the

importance of the web application software and the impact it is likely to bring.

This paper also indicates that we need to design, apply and manage an organized and coordinated

physical security measures that ensures total safety of web application software. We also need to

determine the objectives that ensure that the personnel in charge of the web applications are also

secure to attain the overall objective of making the entire organization secure. There is also need to

determine a method of determining physical security level so that corrective measures can be put in

place.

d. Risk management

There is need to determine risks and risk management processes and understands the level of allowable

risk to ensure the hacking into the web application system lies within a level that cannot be harmful to

the web site owner. We also need to identify resource requirement for risk management to ensure that

the web application is well managed and the problem of lack of resources is dealt with.

There is also need to determine a systematic risk measuring process on the based on consultation with

IT experts and IT risk management processes that comply with the standards and procedures to ensure

the organizational goals and objectives are pursued. In order to ensure total avoidance of risks, we need

to know the level of relationship between incidence response group and other groups both within the

organization and outside the organization such as between the legal department and law enforcement

agencies as well as public relations officers.

We also need to identify the areas where risks to our web application system are likely to come from

and continuously update our web application security settings. We also need to determine policies that

guide risk management and update risk management programs according to the likelihood of threats in

the environment and also according to the goals and objectives of the organization.