Taxonomy of Cyber Threats to Application Security and Applicable Defenses

Introduction

Cyberspace represents the virtual environment that allows interaction of people, devices, software, networks, information, applications, critical information infrastructures, and services on the Internet using computing devices and telecommunication networks (ISO/IEC 27032, 2012). It is a complex environment of diverse entities and resources, comprising of stakeholders and their roles, cyberspace assets, threat agents and threats, vulnerabilities, and cybersecurity controls. Cyber threats are emerging risks posing a range of challenges to users of cyberspace (Marotta & McShane, 2018). Cybercriminals use cyberspace to launch attacks on information assets and critical information infrastructures. In 2018, it was estimated that cyberattacks cost the world economy some $45 billion (SecurityMagazine, 2019). The main medium by which cyber-attacks are carried out is via vulnerabilities in software applications and operating systems over communications networks. Thus, information technology (IT) security professionals are most concerned about threats to software systems, such as phishing and ransomware (Kerner, 2017). Though cyber-attacks may be detected, it often takes much time to recover from them (Kerner, 2017). According to a recent report, ransomware alone costs businesses more than $75 million per year (Oberly, 2019). It is suggested that cybersecurity threats will grow in importance, in particular, as the Internet-of-Things (IoT) becomes widespread (Rash, 2015).

With the aim of mitigating cyber-attacks, ISO/IEC 27032:2012 Guidelines for Cybersecurity provides guidance for reducing cyber risks. The standard describes cybersecurity practices and the roles of stakeholders in cyberspace, outlines guidelines for resolving common cybersecurity issues, and provide a framework for stakeholders to collaborate to resolve cybersecurity issues (ISO/IEC 27032, 2012). The standard identifies the following four major areas; a) information security, b) network security, c) Internet security, and d) critical information infrastructure protection (CIIP) (ISO/IEC 27032, 2012). According to Kerner (2017), though cybersecurity standards and practices have helped in the decline of network and client vulnerabilities, server vulnerabilities have increased by 34 percent. Apparently, organizations are losing the cyber-war due to overdependence on humans to protect computer systems (Needle, 2017). A recent studies and report note that human failure to comply with security policies (Yaokumah, Walker, Kumah, 2019), such as updating security patches, has led to the theft of 145.5 million credit cards and personal information (Anwar, 2019). Also, data breaches of 450 million records in 2018 and nearly 773 million passwords and email addresses were stolen in 2019 (Anwar, 2019).

Data breaches are carried out through software systems running on networks. Software systems security, often referred to as application security, is among the most important aspect of cyberspace security (McGraw, 2013). The International Information System Security Certification Consortium (ISC)² Common Body of Knowledge (CBK) defines the key areas of knowledge for application security as:

Application security is one of the most important means of securing the cyberspace (McGraw, 2013). Threats to software systems can be malicious (such as distributed denial-of-service [DDoS] and injection attacks) or non-malicious (such as system crashes and Internet connection failures) (Refsdal et al., 2015). Malicious attacks are designed to steal information, deny access to, degrade, or destroy critical information systems (DHS, 2017). Therefore, software systems should be engineered so that they can continue to function correctly under malicious attacks (McGraw, 2013).