Framework to Secure Browser Using Configuration Analysis

Framework to Secure Browser Using Configuration Analysis

Harshad Suryakant Wadkar, Arun Mishra, Arati M. Dixit
Copyright: © 2017 |Pages: 15
DOI: 10.4018/IJISP.2017040105
OnDemand:
(Individual Articles)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

In last few decades, web browser has become one of the most used computer applications. The web browser is available on many devices such as desktops, laptops, palm devices and even in cars. According to recent research reports, the browser is targeted most by exploits in attacks on both home and corporate users. The default browser security configuration may leak user's sensitive information. It may also give remote code execution facility to attacker. In this paper, a framework to detect web browser security misconfiguration is proposed. The misconfiguration leads to data sharing to third party and insecure data transfer. The system scans browser configuration and determine deviation of configuration from secure settings. In addition, the system provides facility to achieve the level of security configuration with respect to recommended settings.
Article Preview
Top

Introduction

The availability of high speed internet connections at low cost has made people performing their financial transactions, shopping, gaming services using online systems rather than conventional approaches.

Earlier attackers used to exploit server side services to gain control over the server system. The Open Web Application Security Project (OWASP) 2013, top 10 vulnerability report lists SQL injection, command injection, cross site scripting, security misconfiguration as key security vulnerabilities causing server side attacks (“Top 10 2013-Top 10,” 2013). Table 1, shows the top 10 vulnerability list and where their impact is observed (server and / or client).

Table 1.
OWASP 2013 top 10 vulnerabilities
Sr. No.Web Application AttackServer Side AttackClient Side (Browser) Attack
1.InjectionYesYes
2.Broken authentication & session managementYesNo
3.Cross site scriptingYesYes
4.Insecure data object referencesYesNo
5.Security misconfigurationYesYes
6.Sensitive data exposureYesYes
7.Missing function level access controlYesNo
8.Cross site request forgeryNoYes
9.Using known vulnerability componentsYesNo
10.Unvalidated redirects and forwardsYesYes

Complete Article List

Search this Journal:
Reset
Volume 18: 1 Issue (2024)
Volume 17: 1 Issue (2023)
Volume 16: 4 Issues (2022): 2 Released, 2 Forthcoming
Volume 15: 4 Issues (2021)
Volume 14: 4 Issues (2020)
Volume 13: 4 Issues (2019)
Volume 12: 4 Issues (2018)
Volume 11: 4 Issues (2017)
Volume 10: 4 Issues (2016)
Volume 9: 4 Issues (2015)
Volume 8: 4 Issues (2014)
Volume 7: 4 Issues (2013)
Volume 6: 4 Issues (2012)
Volume 5: 4 Issues (2011)
Volume 4: 4 Issues (2010)
Volume 3: 4 Issues (2009)
Volume 2: 4 Issues (2008)
Volume 1: 4 Issues (2007)
View Complete Journal Contents Listing