Skip to Main Content
Application Security in the ISO27001 Environment (Download)

Application Security in the ISO 27001 2013 Environment - Second edition

SKU: 4714
Authors: Vinod Vasudevan et al
Publishers: IT Governance Publishing
Format: PDF
ISBN13: 9781849287685
Pages: 224
Published: 15 Oct 2015
Availability: Available
  • A comprehensive guide to web application security, from development to deployment, as part of a wider ISO 27001 information security management system.
  • Full discussion of the ISO 27001 controls that apply to web applications and how they address common types of attack.
  • Second edition, updated to reflect ISO 27001:2013 and the latest cryptography best practices.

Pay by purchase order | Buy now, pay later! Enjoy the benefits of paying by purchase order with an IT Governance corporate account.  Apply online today or call our service centre team on 00 800 48 484 484.

Precio 34,95 €

Web application security as part of an ISO 27001-compliant information security management system

Web application vulnerabilities are a common point of intrusion for cyber criminals. As cyber security threats proliferate and attacks escalate, and as applications play an increasingly critical role in business, organisations urgently need to focus on web application security to protect their customers, their interests and their assets.

Although awareness of the need for web application security is increasing, security levels are nowhere near enough: according to the 2015 Trustwave Global Security Report, 98% of tested web applications were vulnerable to attack.

SMEs in particular should be very concerned about web application security: many use common, off-the-shelf applications and plugins – such as Internet Explorer, Java, Silverlight, and Adobe Reader and Flash Player – which often contain exploitable vulnerabilities.

Application Security in the ISO 27001:2013 Environment explains how organisations can implement and maintain effective security practices to protect their web applications – and the servers on which they reside – as part of a wider information security management system by following the guidance set out in the international standard for information security management, ISO 27001.

The book describes the methods used by criminal hackers to attack organisations via their web applications and provides a detailed explanation of how you can combat such attacks by employing the guidance and controls set out in ISO 27001.

Product overview

  • Second edition, updated to reflect ISO 27001:2013 as well as best practices relating to cryptography, including the PCI SSC’s denigration of SSL in favour of TLS.
  • Provides a full introduction to ISO 27001 and information security management systems, including implementation guidance.
  • Describes risk assessment, management and treatment approaches.
  • Examines common types of web app security attack, including injection attacks, cross-site scripting, and attacks on authentication and session management, explaining how each can compromise ISO 27001 control objectives and showing how to test for each attack type.
  • Discusses the ISO 27001 controls relevant to application security.
  • Lists useful web app security metrics and their relevance to ISO 27001 controls.
  • Provides a four-step approach to threat profiling, and describes application security review and testing approaches.
  • Sets out guidelines and the ISO 27001 controls relevant to them, covering:
    • input validation
    • authentication
    • authorisation
    • sensitive data handling and the use of TLS rather than SSL
    • session management
    • error handling and logging
  • Describes the importance of security as part of the web app development process
About the author

Vinod Vasudevan

Vinod Vasudevan, CISSP, is the chief technology officer (CTO) at Paladion. Before co-founding Paladion, Vinod worked with Microsoft. He wrote the chapter ‘Application Security and ISO27001’.

Anoop Mangla

Anoop Mangla is a risk specialist in banking and finance, and an expert on the effectiveness of security technologies in organisations’ security. He wrote the chapter ‘Introduction to Application Security Threats’.

Firosh Ummer

Firosh Ummer, CISA, ISO27001 LA, CBCP, BS15000 LA, is co-founder of Paladion and head of the ISO 27001 consulting practice. Firosh wrote the chapter ‘Threat Profiling and Security Testing’.

Sachin Shetty

Sachin Shetty, CISSP, is a senior application security engineer with Paladion. He wrote the chapter ‘Attacks on Applications’.

Sangita Pakala

Sangita Pakala, GCIH, is Head of Application Security Projects at Paladion. She wrote the chapter ‘Secure Development Lifecycle’.

Siddharth Anbalahan

Siddharth Anbalahan is a senior application security engineer. He has developed anti-phishing toolkits to enable banks to detect phishing attacks in real time. Siddharth wrote the chapter ‘Secure Coding Guidelines’.

Opiniones de clientes