Web Application Security Policy
1.0 Purpose
Web application vulnerabilities accountrepresent fora the largest portion ofprimary attack vectorsvector outsideand ofpose malware.significant Itrisks to organizational security. Identifying and remediating vulnerabilities resulting from misconfigurations, coding errors, weak authentication, improper error handling, or information leakage is crucial thatbefore anyapplications webare applicationdeployed beor assessedupdated. for vulnerabilities and any vulnerabilities be remediated prior to production deployment.
The purpose of this policy is to define the mandatory requirements for conducting web application security assessments within <Companythe Name>.organization. WebThis applicationpolicy assessmentsaims to ensure that potential weaknesses are performed to identify potential or realized weaknesses as a result of inadvertent mis-configuration, weak authentication, insufficient error handling, sensitive information leakage, etc. Discoveryidentified and subsequentmitigated, mitigation of these issues will limitlimiting the attack surface of <Companyweb Name> services available both internallyapplications and externallyservices, asprotecting wellorganizational asdata, satisfyand ensuring compliance with any relevant policiessecurity instandards place.and change control processes.
2.0 Scope
This policy coversapplies to all web applications developed, deployed, hosted, or managed by the organization, whether internal or external-facing. It applies to all individuals, groups, departments, and third-party vendors involved in the development, deployment, management, or assessment of these web applications. All web application security assessments requested by any individual, group or departmentperformed forwithin the purposesorganization fall under the scope of maintainingthis policy.
3.0 Policy Statements
3.1 Assessment Requirement and Authority
* All web applications within the security posture, compliance, risk management, and change controlscope of technologiesthis inpolicy useare atsubject <Companyto Name>.
assessments
asAlldefined webherein.
* Web application security assessments willmust be performed only by delegateddesignated and qualified security personnelpersonnel, either employed or contracted by <Companythe Name>organization (hereafter referred to as the "Assessment Team").
* AllAssessment findings are considered confidential organizational information and are tomust be distributed to personsstrictly on a “need"need-to-know" basis to know”personnel basis.involved in Distributionthe ofapplication's anydevelopment, findingsmanagement, outsideor ofremediation <Companyefforts. Name>External distribution is strictly prohibited unlesswithout approvedexplicit byexecutive theapproval (e.g., Chief Information Officer.Officer).
3.2 Assessment Triggers and Scope
Any relationships within multi-tiered applications found during the scoping phase will be included in the assessment unless explicitly limited. Limitations and subsequent justification will be documented prior to the start of the assessment.
4.1 Web applications aremust subject toundergo security assessments based on the following criteria:
*
**New or Major Application ReleaseRelease:** –A will**Full beAssessment** subjectis torequired a*before* full assessment prior tofinal approval ofin the change control documentationprocess and/orand releasedeployment into the liveproduction environment.
*
Third **Third-Party or Acquired Web ApplicationApplication:** –A will**Full beAssessment** is required before integration into the organization's environment or network. Post-assessment, the application is subject to fullall assessmentrequirements afterof whichthis itpolicy.
* will be bound to policy requirements.
**Point Releases –(Minor willFunctional beChanges):** subject to anAn appropriate assessment level (**Targeted** or **Quick**, potentially **Full** depending on risk) is required, determined by the Assessment Team based on the scope and potential security impact of the changes.
* **Patch Releases (Bug Fixes, Minor Updates):** An appropriate assessment level (**Targeted** or **Quick**) is required, determined by the Assessment Team based on the risk ofassociated with the changespatches in the application functionality and/or architecture.
PatchSecurity Releasespatches –addressing willknown vulnerabilities require **Targeted** validation testing.
* **Emergency Releases:** In documented emergency situations requiring immediate deployment, a security assessment may be subjecttemporarily tobypassed anwith appropriateexplicit assessmentapproval level based on the risk of the changes to the application functionality and/or architecture.
Emergency Releases – An emergency release will be allowed to forgo security assessments and carry the assumed risk until such time that a proper assessment can be carried out. Emergency releases will befrom designated asexecutive suchleadership by the(e.g., Chief Information Officer or an appropriate manager who has been delegated thisauthority). authority.However, the application carries assumed risk, and a **Full Assessment** must be scheduled and performed as soon as practicably possible post-deployment (e.g., within 30 days).
* **Scoping:** Assessments will include all components and tiers of the application identified during scoping unless explicitly limited with documented justification approved before the assessment begins.
4.23.3 AllRisk securityRating issuesand thatRemediation
Security discoveredvulnerabilities identified during assessments mustwill be mitigated based upon the following risk levels. The Risk Levels arerisk-rated based on thea standard methodology (e.g., OWASP Risk Rating Methodology.Methodology). Remediation must occur according to the following requirements:
* **High Risk:** Vulnerabilities rated as High must be remediated, or effective compensating controls must be implemented and approved by the Assessment Team/Information Security, **before** the application is deployed or allowed to remain in production. Failure to address High-risk issues may result in the application being denied deployment or taken offline immediately. Remediation validation testing willis bemandatory.
* required**Medium toRisk:** validateVulnerabilities fixrated and/or mitigation strategies for any discovered issues ofas Medium risk level or greater.
High – Any high risk issue must be fixedreviewed, immediatelyand ora otherremediation mitigationplan strategieswith timelines must be putdeveloped inand placeapproved. toRemediation limitshould exposuretypically beforeoccur deployment.within the Applicationsnext withplanned highrelease riskcycle issues(e.g., arepoint/patch subject to being taken off-linerelease) or deniedwithin releasea intodefined thetimeframe live(e.g., environment.
Mediumdays). – Medium risk issues should be reviewed to determine what is required to mitigate and scheduled accordingly. Applications with medium risk issues may be taken off-line or denied release into the live environment basedDepending on the number and nature of issuesMedium-risk and if multiple issues increasefindings, the riskAssessment toTeam/Information anSecurity unacceptablemay level.require mitigation Issuesor delayed deployment. Remediation validation testing is mandatory.
* **Low Risk:** Vulnerabilities rated as Low should be fixedreviewed, in a patch/point release unless other mitigation strategies will limit exposure.
Low – Issue should be reviewed to determine what is required to correct the issuedocumented, and scheduled accordingly.for remediation as part of regular maintenance cycles or future releases based on available resources.
3.4 Assessment Levels
4.3The TheAssessment Team will perform assessments at the following securitylevels, assessmentas levels shall be established by the Precision Computer organization or other designated organization that will be performing the assessments. appropriate:
* **Full –Assessment:** AComprehensive full assessment is comprised of teststesting for alla wide range of known web application vulnerabilities using both automated and manual tools(e.g., based on the OWASP Testing Guide.Guide, OWASP ATop fullTen, assessmentSANS willTop use25) using a combination of automated scanning tools and in-depth manual penetration testing techniques to validate discoveredfindings and assess actual risk.
* **Quick Assessment:** Primarily automated vulnerability scanning focused on common high-impact vulnerabilities to determine the overall risk of any and all discovered.
Quick – A quick assessment will consist of a (typically) automated scan of an application for thee.g., OWASP Top TenTen) webto provide a rapid risk overview. Manual validation may be limited.
* **Targeted Assessment:** Focused testing on specific vulnerabilities (e.g., for remediation validation) or specific new/changed application functionality.
3.5 Approved Tools and Techniques
* The Assessment Team will utilize a set of approved automated scanning tools and manual testing methodologies. *(The specific list of approved tools should be maintained internally by the Assessment Team).*
* The Assessment Team reserves the right to use additional tools or techniques as necessary to investigate potential vulnerabilities, validate findings, and determine overall risk.
4.0 Integration with Change Control
* Web application security risksassessments atare aan minimum.
Targetedpart –of Athe targetedorganization's change control process.
* Relevant assessment isresults performedand remediation status must be documented within the change control records before deployment approval for applicable releases (New, Major, Point, Patch).
* Applications deployed without adhering to verify vulnerability remediation changes or new application functionality.
4.4 The current approved web application securitythe assessment toolsrequirements inof usethis which will be used for testing are:
• <Tool/Application 1>
• <Tool/Application 2>
• …
Other tools and/or techniquespolicy may be usedsubject dependingto uponimmediate whatremoval is found infrom the defaultproduction assessmentenvironment and the need to determine validity and risk are subject toat the discretion of theInformation Security Engineeringor team.executive leadership.
5.0 Compliance
5.1 Compliance Measurement
The designated IT authority (e.g., Precision Computer teamteam, Information Security, Internal Audit) will verify compliance towith this policy through various methods, including butreview notof limitedchange to,control periodicrecords, walk-thrus,audit videoof monitoring,assessment business tool reports, internalreports and remediation tracking, penetration testing, internal/external audits, and feedbackreview toof theapplication policysecurity owner.program documentation.
5.2 Exceptions
Any exception to thethis policy must(e.g., bedelaying approvedan assessment beyond standard triggers) requires formal, documented justification, risk acceptance by appropriate business and IT leadership, and advance approval from the designated Information Security authority (e.g., Precision Computer team in advance. Team).
An5.3 employeeEnforcement
Failure to havecomply violatedwith this policy may beresult subjectin deployment delays, applications being taken offline, or other corrective actions. Non-compliance by personnel may lead to disciplinary action, up to and including termination of employment.employment or contract.
6.0 Definitions
* **Web applicationApplication:** assessmentsA areclient-server computer program where the client (including the user interface and client-side logic) runs in a requirementweb ofbrowser.
* **Vulnerability:** A weakness in a system, application, or process that could be exploited by a threat actor.
* **OWASP (Open Web Application Security Project):** A non-profit foundation focused on improving software security. Known for resources like the change control process and are required to adhere to this policy unless found to be exempt. All application releases must pass through the change control process. Any web applications that do not adhere to this policy may be taken offline until such time that a formal assessment can be performed at the discretion of the Chief Information Officer.
OWASP Top Ten Project
OWASPof critical web application security risks), Testing GuideGuide,
OWASPand Risk Rating MethodologyMethodology.
* **Penetration Testing:** A simulated cyber attack against a computer system to check for exploitable vulnerabilities.
* **Remediation:** The process of fixing or mitigating identified vulnerabilities.
* **Compensating Control:** An alternative security measure put in place when it is not feasible or practical to directly remediate a vulnerability according to standard requirements.
* Change Management Policy
* Secure Development Lifecycle (SDL) Policy / Standards
* Vulnerability Management Policy
* Risk Management Framework / Policy
* Information Security Policy (Overall)
* Third-Party Risk Management Policy