Search

The online presence of organizations is increasing at a rapid pace with the major adaptation of work from home. Organizations have new digital infrastructure being added to their digital portfolio on a regular basis. The threats that organizations face are also increasing at an alarming rate. It is crucial in such a scenario to safeguard and test the new and growing digital infrastructure without causing any interruption to the services provided by these organizations. Through this paper, we would like to inspect six non-intrusive detection methodologies which are useful in the identification of web application vulnerabilities without hampering the organization’s service model. The dataset that was used for real-world analysis consisted of government agencies and reputable organizations. We have assessed these vulnerabilities on the criterion of the statistical probability of finding these vulnerabilities on the dataset. We were able to identify 44 sub-domain takeover vulnerability in 1628 domains (0.02%), 263 cryptographic vulnerabilities (0.17%) and 167 open port vulnerabilities (0.10%) in 1538 domains, and 10,491 GitHub API Leaks were found within 27 organization’s GitHub repository, 3 Cross-Origin Resource Sharing (CORS) misconfigurations in 1213 domains (0.002%) and 0 Wayback machine API leaks from 800 domains.

In general, Cloud storage is considered as a distributed model. Here, the data is usually stored on remote servers to properly maintain, back up and make it accessible to clients over a network, whenever required. Cloud storage providers keep the data and processes to oversee it on capacity servers based on secure virtualization methods. A security framework is proposed for auditing the cloud data, which makes use of the proposed blockchain technology. This ensures to efficiently maintain the data integrity. The blockchain structure inspects the mutation of operational information and thereby ensures the data security. Usually, the data auditing scheme is widely used in a Third Party Auditor (TPA), which is a centralized entity that the client is forced to trust, even if the credibility is not guaranteed. To avoid the participation of TPA, a decentralised scheme is suggested, where it uses a smart contract for auditing the cloud data. The working of smart contracts is based on blockchain. Ethereum is used to deploy a smart contract thereby eliminating the need of a foreign source in the data auditing process.