Web Application Security Threats and Mitigation Strategies when Using Cloud Computing as Backend

Cloud computing plays an important role in businesses' digital transformation as they offer easy-to-use services that save time and effort. Despite incredible features that are provided by cloud computing platforms, these platforms become the desirable target of attackers. This study aims to survey the literature for security threats related to web applications that have been developed using cloud computing services and then provide a set of recommendations to mitigate these threats. In this study, we first surveyed the literature for documented cases of threats faced while relying on cloud computing, then an online survey was sent to Computer Science students and web developers. The survey's questions were related to web threats whether they are aware of these threats or not and whether they have already applied any prevention measures for these threats. Then, a set of recommendations were provided that can help them to mitigate these threats. Finally, a tool was designed for generating security policies for the Broken Access Control threat for Firebase. Eighty-five responses were considered for this study. The average participants' awareness of all threats is 61 % despite 92% of participants having taken at least one security course. The main causes for neglecting to implement mitigation techniques was the lack of training and that developers are relying on the web services to provide security measures, then comes the process being time-consuming. The designed tool for mitigating Broken Access control showed promising results to ease the implementation of mitigation techniques. We conclude that due to the lack of awareness and negligence in implementing mitigation techniques, many present web apps may be compromised. Developing security tools for novice users, whenever possible, provides a solution for the main causes of the neglect to implement such measures and should be investigated further.

I. Introduction

Since the early 2000s, cloud computing has played a cru-cial role in businesses' digital transformation. This trend has increased further with the popularity of remote work during the COVID-19 crisis [1]. According to Cisco statistics in 2021, 94% of all enterprises around the world rely on cloud computing services for their businesses [2], as they provide very easy-to-use and well-prepared services that help in saving their time and energy. Despite different security measures and features in place with cloud services, these platforms are subject to cyber-attacks that target both individual and corporate data. Multiple incidents have been reported recently such as in 2018 when millions of user app data were leaked due to Firebase database misconfigurations [3]. In a close-in-time incident, dating app information was leaked containing sensitive information [4]. Unfortunately, college undergrads have little awareness of all these threats that they may face while using these services [5].