Runtime Agent Detects Weak Server-Side Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional web application security testing struggles to detect insecure storage of sensitive information on servers, as automated scanners can identify client-side leaks but find it challenging to detect weak protection methods on the server-side, leading to potential data breaches.
Innovation Solution
A dynamic scanner and runtime agent combination is used to track sensitive information, where the scanner acts as a client and submits values to the server, while the runtime agent on the server monitors and looks for cryptographic function calls, flagging potential vulnerabilities if weak or inadequate protection is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional black-box security testing is used, then the scanner can identify client-side data leaks, but it cannot detect weak protection methods on the server-side
Solution Approach 1:
The patent introduces a runtime agent as an intermediary component installed on the server-side to assist the external scanner. This agent monitors cryptographic function calls and protective measures internally, bridging the gap between external scanning capabilities and internal server-side security assessments, thereby enabling detection of weak protection methods without significantly increasing overall system complexity
Solution Approach 2:
The testing system is segmented into two distinct components: an external scanner that performs traditional black-box testing and an internal runtime agent that monitors server-side operations. This segmentation allows each component to specialize in specific detection tasks, improving overall measurement precision while maintaining manageable complexity through clear division of responsibilities
2Reliability
If a runtime agent is installed on the application server to track sensitive information, then comprehensive security testing is achieved, but system complexity increases
Solution Approach 1:
The runtime agent serves as an intermediary that selectively monitors only cryptographic function calls and sensitive data handling operations rather than all system activities. This targeted monitoring approach enhances security testing reliability by focusing on critical security-relevant operations while minimizing the agent's complexity and overhead
Solution Approach 2:
The runtime agent is designed to autonomously monitor and report security-related operations without requiring constant external control or configuration. It self-manages its monitoring functions, tracks sensitive information flows, and communicates findings back to the scanner, thereby improving reliability through autonomous operation while keeping the system relatively simple
Data Source
AI summary
Example embodiments disclosed herein relate to determining whether a protective measure meeting criteria has been performed on data. Execution of an application under test (AUT) is monitored. A message that a field of the AUT should be considered sensitive is received. Data is determined to be entered into the field. The data is monitored during execution of the AUT to determine whether the protective measure that meets the criteria has been performed on the data.