Certifying server side web applications against security vulnerabilities
Methods for server security verification include acquiring a public key associated with a received report that includes an indication regarding the presence of a vulnerability for each vulnerability, the report having been generated at a server; decrypting the received report using the public key; determining a level of server-side security based on the decrypted report using a processor; and reconfiguring a browser at the client responsive to the determined level of server-side security.
1. A method for server security verification, comprising:
acquiring a public key associated with a received report that includes an indication regarding the presence of a vulnerability, said report having been generated by a security scan by a server;
decrypting the received report using the public key;
determining a level of server-side security based on the decrypted report using a processor;
scanning the server for vulnerabilities using a scanning module located at the client based on the decrypted report; and
reconfiguring a browser at the client responsive to the determined level of server-side security.
2. The method of claim 1 , further comprising configuring the scanning module to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security.
3. The method of claim 2 , further comprising configuring the scanning module to skip scanning of vulnerabilities indicated in the report as not being present at the sever.
4. The method of claim 2 , further comprising configuring the scanning module to increase scanning of vulnerabilities indicated in the report as being present at the server.
5. The method of claim 1 , determining a level of server-side security further comprises:
summing severity scores associated with any vulnerabilities disclosed in the decrypted report;
comparing the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
6. The method of claim 5 , further comprising alerting a user if comparison indicates a severity of vulnerabilities greater than the threshold.
7. The method of claim 1 , determining a level of server-side security further comprises:
counting a number of vulnerabilities disclosed in the decrypted report; comparing the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
8. A method for server security verification, comprising:
acquiring a public key at a client associated with a received report that includes an indication regarding the presence of a vulnerability, said report having been generated by a security scan by a server;
decrypting the received report using the public key;
determining a level of server-side security based on the decrypted report using a processor;
scanning the server for vulnerabilities using a scanning module located at the client, the scanning module being configured to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security; and
reconfiguring a browser at the client responsive to the determined level of server-side security.
9. The method of claim 8 , further comprising configuring the scanning module to skip scanning of vulnerabilities indicated in the report as not being present at the sever.
10. The method of claim 8 , further comprising configuring the scanning module to increase scanning of vulnerabilities indicated in the report as being present at the server.
11. The method of claim 8 , determining a level of server-side security further comprises:
summing severity scores associated with any vulnerabilities disclosed in the decrypted report;
comparing the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
12. The method of claim 11 , further comprising alerting a user if comparison indicates a severity of vulnerabilities greater than the threshold.
13. The method of claim 8 , determining a level of server-side security further comprises:
counting a number of vulnerabilities disclosed in the decrypted report;
comparing the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
14. A method for server security verification, comprising: scanning a server for one or more vulnerabilities using a scanning module located at the server;
generating an encrypted report of server-side security by a security scan by the server that includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities based on the results of said scanning, said encryption being performed using a private key;
decrypting a copy of the encrypted report at a requesting client using a public key;
determining a level of server-side security based on the decrypted report using a processor; and
scanning the server for vulnerabilities using a scanning module located at the client based on the copy of the decrypted report.
15. The method of claim 14 , further comprising configuring the scanning module located at the client to increase or diminish scanning of specific vulnerabilities based on the determined level of server-side security.
16. The method of claim 15 , further comprising configuring the scanning module to skip scanning of vulnerabilities indicated in the report as not being present at the sever.
17. The method of claim 15 , further comprising configuring the scanning module to increase scanning of vulnerabilities indicated in the report as being present at the server.
18. The method of claim 14 , determining a level of server-side security further comprises:
summing severity scores associated with any vulnerabilities disclosed in the decrypted report;
comparing the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
19. The method of claim 18 , further comprising alerting a user if comparison indicates a severity of vulnerabilities greater than the threshold.
20. The method of claim 14 , determining a level of server-side security further comprises:
counting a number of vulnerabilities disclosed in the decrypted report;
comparing the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
21. A method for server security verification, comprising:
scanning a server for one or more vulnerabilities using a scanning module located at the server;
generating an encrypted report of server-side security that includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities based on the results of said scanning, said encryption being performed using a private key;
transmitting the encrypted report to a requesting client;
decrypting the encrypted report using a public key;
determining a level of server-side security based on the decrypted report using a processor;
configuring a scanning module located at the client to increase or diminish scanning of specific vulnerabilities based on the determined level of server-side security; and
scanning the server for vulnerabilities using a scanning module located at the client.
22. The method of claim 21 , determining a level of server-side security further comprises:
summing severity scores associated with any vulnerabilities disclosed in the decrypted report;
comparing the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
23. The method of claim 21 , determining a level of server-side security further comprises:
counting a number of vulnerabilities disclosed in the decrypted report;
comparing the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.