Some standards can surprise you, even positively. The Austrian ÖNORM A7700 defines security requirements for web applications. Although the A7700 is largely unknown in Germany, it is still worth taking a look at the standard of the Republic of Austria.
The predecessor of the ÖNORM A 7700 was developed as ONR 17700 between 2004 and 2005. Since 2008, it has been the defined state of the art as an ÖNORM for procuring and developing secure web applications in Austria. In 2019 the standard was fundamentally revised and is published in 4 parts:
- ÖNORM A 7700-1: Web applications - Terms
- ÖNORM A 7700-2: Web applications - Data protection requirements
- ÖNORM A 7700-3: Web applications - Technical security requirements
- ÖNORM A 7700-4: Web applications - Requirements for secure operation
The astute reader can skip the first part with its definitions right away, and the second part is mostly about typical data protection topics. Parts 3 and 4 are more interesting.
ÖNORM A 7700-3: Web applications Technical security requirements
The A 7700-3 is refreshingly technically concrete, as far as a standard can be:
The security requirements for web applications are generally addressed from a generic and technology-independent perspective. The individual requirements are therefore not mapped onto specific technological solutions in this ÖNORM, which is why a correspondingly high level of knowledge is expected from users of this ÖNORM. Supplementary information can be obtained from the relevant specialist literature, e.g. the OWASP Testing Guide in its current
ÖNORM A 7700-3:2019-10, page 5
The A7700-3 covers the following topics:
- Web application architecture
- Data storage and data transmission
- Configuration data
- Authentication, authorization and sessions
- Session riding
- Click-jacking
- Input handling
- Data processing (incl. injections)
- Output handling
- File handling
- System and error messages
- Cryptography
- Logging
- Replay attacks
- Documentation
ÖNORM A 7700-4: Web applications Requirements for secure operation
The A7700-4 defines requirements for the operation of a secure web application, with an ISMS being demanded right at the start of the standard. That is relatively generic, and true as it is, it is not very helpful. The following points can instead serve as a basic checklist:
- Information security management system
- Adherence to the minimal principle
- Software components used
- Configuration of the components
- Data handling (incl. encryption)
- HTTP header configuration
- Logging