A Metamodel for Web Application Injection Attacks and Countermeasures

Abstract

Abstract. Web application injection attacks such as cross site scripting and SQL injection are common and problematic for enterprises. In order to defend against them, practitioners with large heterogeneous system architectures and limited resources struggle to understand the effectiveness of different countermeasures under various conditions. This paper presents an enterprise architecture metamodel that can be used by enterprise decision makers when deciding between different countermeasures for web application injection attacks. The scope of the model is to provide low-effort guidance on an abstraction level of use for an enterprise decision maker. This metamodel is based on a literature review and revised according to the judgment by six domain experts identified through peer-review.

Effort Estimates on Web Application Vulnerability Discovery

“…A number of such countermeasures were identified during the pre-study [9], and we plan to study them utilizing the same approach as is presented in this paper.…”

“…Technical measures, process measures and organizational measures are all of relevance [8]. This study uses variables identified through a previous research [9] involving a literature review and expert judgment. This previous study is summarized in this section -the reader is referred to [9] for more comprehensive details.…”

“…Regarding (ii), the choice of variables and their assumptions was made based on a pre-study involving both literature review and domain experts [9]. Concerning data collection methodology, Cooke [7] suggests that seven guidelines should be followed when data is elicited from experts.…”

P<inline-formula><tex-math>$^{2}$</tex-math><alternatives> <inline-graphic xlink:type="simple" xlink:href="holm-ieq1-2382574.gif"/></alternatives></inline-formula>CySeMoL: Predictive, Probabilistic Cyber Security Modeling Language

“…P 2 CySeMoL adds four important assets to the scope of Cy-SeMoL: SocialZone, NetworkVulnerabilityScanner [32], We-bApplication [33], [34] and WebApplicationFirewall [33], [35].…”

“…A WebApplication [33], [34] is a software written in a script language that is published by an HTTP server (an ApplicationServer). It is typically a combination of both server-side scripts (e.g., PHP) and client-side scripts (e.g., JavaScript).…”