Investigating security vulnerabilities in E-Commerce web applications and designing countermeasures to improve their security

Prashant Ghanshyambhai Gadhiya

Diplomová práce

Abstract:

The ease of e-commerce is indisputable in the ever changing world of online commerce, but it comes with a worrying weakness: the security of e-commerce websites. In order to fortify the resilience of online shopping platforms, this thesis sets out to conduct a thorough investigation of the security issues that are common in these platforms. The first few chapters expose the common security vulnerabilities that e-commerce websites face and highlight the possible threats listed in the OWASP Top Ten. The research looks over several online purchasing platforms to find flaws and vulnerabilities, much like a detective investigating a crime scene. The main goal is to strengthen the digital fortifications of e-commerce and prevent sensitive data from being stolen, rather than just identifying these problems and moving on with them. The thesis introduces a complex technique as we delve further. It introduces the strategic use of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) as tools for examining code vulnerabilities and simulating real-world assaults, therefore improving the security of e-commerce websites. The goals go beyond simple identification; they include a continuous commitment to defense and monitoring. The deployment of Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) systems functions as a constant watchdog, quickly identifying and addressing any cyberthreats from both a macro and micro viewpoint. It provides a strong protection against ever-evolving cyber dangers and is akin to a watchful security guard and a complex network of security cameras. This thesis acknowledges the significance of choosing suitable security tools and suppliers. Making your way through this complex procedure is similar to carefully choosing the right tools for a certain task, it's like trying to find your way through a labyrinth while keeping your budget in mind. The study actively develops countermeasures in addition to identifying vulnerabilities as the chapters go. It introduces a process for designing customized protections, ranking their implementation according to the seriousness of vulnerabilities, and thoroughly testing each defense's effectiveness. The research findings include the challenges encountered and opportunities identified over the course of this study excursion. This thesis contributes to the ongoing discourse around the protection of e-commerce platforms by analyzing the OWASP Top Ten vulnerabilities and effectively using security tools like as SAST, DAST, SIEM, and EDR. In order to enhance their digital presence, safeguard customer information, and cultivate trust in the online realm, it provides valuable insights for organizations. The objective of this thesis is to enhance the safety of the digital realm by focusing on the establishment of secure e-commerce websites. This is particularly significant in the current era when digital platforms play a crucial role in facilitating trade.

Keywords

E-commerce Security, Cybersecurity, OWASP Top Ten, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Vulnerability Assessment, Digital Resilience, Risk Mitigation, Security Tools, Vendor Selection, Security Best Practices

Jazyk práce: angličtina

Datum vytvoření / odevzdání či podání práce: 23. 3. 2024

Obhajoba závěrečné práce

• Vedoucí: Ing. Petr Benda, Ph.D.
• Oponent: Roman Havránek, externi

Česká zemědělská univerzita v Praze

Provozně ekonomická fakulta

Magisterský studijní program:
Informatics