Abstract:Over the past decade, e-commerce creates exciting new opportunities for business but also brings new web application vulnerabilities and transaction security risks. A stream of news of phishing attacks, website spoofing, payment card skimming (credit /debit cards), fraud in online transactions, malware attack (malicious code attack of viruses, worms, Trojans, and bots), hacker/cracker infiltration, vandalism, identity theft and data breaches of payment card or bank details are increasingly reported. Web application security risk management, therefore, is essential for secure e-commerce online transactions, including order processing, payment transaction, banking and clearing processing. Therefore, the main purpose of this study was to propose a web application security risk management methodology to perform e-commerce web application security risk management, helping organizations understand and improve their e-commerce web application security risks. In order to achieve this purpose, the goal of this study has been two-fold: (1) How will organizations measure threat likelihood, impact consequence and severity of their e-commerce web application security risk? (2) What management methodology is required to prompt the e-commerce web application security vulnerabilities measurement and improvement? Using OWASP Top Ten Vulnerabilities as target items, the proposed management methodology is disciplined in a PDCA based ISO/IEC 27005 iterative process activities, integrating Common Criteria attack potential ratings as threat likelihood scales and the FIPS 199 impact categories as impact consequence scales to categorize severity of every e-commerce web application vulnerabilities. Following the proposed management procedure, all the critical e-commerce web application vulnerabilities can be reviewed, analyzed, prioritized and remedied effectively and efficiently, moving on again in a continuous cycle.

Understanding The Top 10 OWASP Vulnerabilities

Is the OWASP Top 10 list comprehensive enough for writing secure code?

Design and implementation of a web application vulnerability detection system

Vulnerabilities Mapping based on OWASP-SANS: a Survey for Static Application Security Testing (SAST)

Rethinking IoT Security: Understanding and Mitigating Out-of-Band Vulnerabilities

A Survey of Prevent and Detect Access Control Vulnerabilities

Automating the Detection of Access Control Vulnerabilities in Web Applications

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Web Vulnerability Scanning Software

Unveiling the Landscape of Operating System Vulnerabilities

Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications

A Novel VAPT Algorithm: Enhancing Web Application Security Trough OWASP top 10 Optimization

Static analysis for discovering IoT vulnerabilities

Web Security 2016

XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

How to build a vulnerability benchmark to overcome cyber security attacks

Insecure by Design in the Backbone of Critical Infrastructure

D-WAV: A Web Application Vulnerabilities Detection Tool Using Characteristics of Web Forms

A Historical and Statistical Studyof the Software Vulnerability Landscape

Online Transaction Security Risk Management for E-commerce Web Applications