Certifying server side web applications against security vulnerabilities
Systems for server security verification include a report validation module configured to acquire a public key associated with a received report, where the received report was generated at a server, to decrypt the received report using the public key, and to determine a level of server-side security based on the decrypted report; and a processor configured to reconfigure a browser responsive to the determined level of server-side security.
1. A client security module, comprising:
a report validation module configured to acquire a public key associated with a received report, said received report having been generated by a security scan by a server, to decrypt the received report using the public key, and to determine a level of server-side security based on the decrypted report;
a processor configured to reconfigure a browser responsive to the determined level of server-side security; and
a scanning module configured to scan the server for vulnerabilities based on the received report.
2. The client security module of claim 1 , wherein the received report includes an indication regarding the presence of one or more vulnerabilities at the server.
3. The client security module of claim 1 , wherein the scanning module is further configured to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security.
4. The client security module of claim 3 , wherein the scanning module is further configured to skip scanning of vulnerabilities indicated in the report as not being present at the server.
5. The client security module of claim 3 , wherein the scanning module is further configured to increase scanning of vulnerabilities indicated in the report as being present at the server.
6. The client security module of claim 1 , wherein the report validation module is further configured to sum severity scores associated with any vulnerabilities disclosed in the decrypted report and to compare the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
7. The client security module of claim 6 , wherein the report validation module is further configured to alert a user if the comparison indicates a severity of vulnerability greater than the threshold.
8. The client security module of claim 1 , wherein the report validation module is further configured to count a number of vulnerabilities disclosed in the decrypted report and to compare the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
9. A client security module, comprising:
a report validation module configured to acquire a public key associated with a received report, said received report having been generated by a security scan by a server and indicating the presence of one or more vulnerabilities at the server, to decrypt the received report using the public key, and to determine a level of server-side security based on the decrypted report;
a scanning module configured to scan the server for vulnerabilities based on the received report, wherein the scanning module enhances or diminishes scanning of specific vulnerabilities based on the determined level of server-side security; and
a processor configured to reconfigure a browser responsive to the determined level of server-side security and an outcome of the scanning module.
10. The client security module of claim 9 , wherein the report validation module is further configured to sum severity scores associated with any vulnerabilities disclosed in the decrypted report and to compare the summed severity scores to a threshold that represents a maximum tolerable venerability severity.
11. The client security module of claim 10 , wherein the report validation module is further configured to alert a user if the comparison indicates a severity of vulnerability greater than the threshold.
12. The client security module of claim 9 , wherein the report validation module is further configured to count a number of vulnerabilities disclosed in the decrypted report and to compare the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
13. A security verification system, comprising:
a server security module, comprising:
a scanner configured to scan a server for one or more vulnerabilities;
a report generator configured to generate an encrypted report of server-side security based on results provided by said scanner; and
a transmitter configured to transmit the encrypted report to a requesting client; and
a client security module, comprising:
a report validation module configured to decrypt a received report, said received report having been generated at a server, and to determine a level of server-side security based on the decrypted report using a processor; and
a scanning module configured to scan the server for vulnerabilities, said scanning being configured to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security.
14. The security verification system of claim 13 , wherein the received report includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities at the server.
15. The security verification system of claim 13 , wherein the scanning module is further configured to skip scanning of vulnerabilities indicated in the report as not being present at the server.
16. The security verification system of claim 13 , wherein the scanning module is further configured to increase scanning of vulnerabilities indicated in the report as being present at the server.
17. The security verification system of claim 13 , wherein the report validation module is further configured to sum severity scores associated with any vulnerabilities disclosed in the decrypted report and to compare the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
18. The security verification system of claim 17 , wherein the report validation module is further configured to alert a user if the comparison indicates a severity of vulnerability greater than the threshold.
19. The security verification system of claim 13 , wherein the report validation module is further configured to count a number of vulnerabilities disclosed in the decrypted report and to compare the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count.
20. The security verification system of claim 13 , wherein the report is encrypted using a private key and decrypted using a public key.
21. A security verification system, comprising:
a server security module, comprising:
a scanner configured to scan a server for one or more vulnerabilities;
a report generator configured to generate a private key encrypted report of server-side security that includes an indication regarding the presence of a vulnerability for each of said one or more vulnerabilities using a processor, and further configured to publish a public key corresponding to the private key; and
a transmitter configured to transmit the encrypted report to a requesting client, such that the client can access the encrypted report using the public key to determine a level of server-side security; and
a client security module, comprising:
a report validation module configured to acquire a public key associated with a received report, said received report having been generated at a server, to decrypt the received report using the public key, and to determine a level of server-side security based on the decrypted report using a processor; and
a scanning module configured to scan the server for vulnerabilities, said scanning being configured to enhance or diminish scanning of specific vulnerabilities based on the determined level of server-side security.
22. The security verification system of claim 21 , wherein the report validation module is further configured to sum severity scores associated with any vulnerabilities disclosed in the decrypted report and to compare the summed severity scores to a threshold that represents a maximum tolerable vulnerability severity.
23. The security verification system of claim 21 , wherein the report validation module is further configured to count a number of vulnerabilities disclosed in the decrypted report and to compare the number of vulnerabilities to a threshold that represents a maximum tolerable vulnerability count to determine a level of server-side security.
24. A non-transitory computer readable storage medium comprising a computer readable program for server security verification, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:
acquiring a public key at a client associated with a received report that includes an indication regarding the presence of a vulnerability for each of one or more vulnerabilities, said report having been generated by a security scan by a server;
decrypting the received report using the public key;
determining level of server-side security based on the decrypted report using a processor;
scanning the server for vulnerabilities using a scanning module located at the client; and
reconfiguring a browser at the client responsive to the determined level of server-side security.