METHODOLOGY FOR QUANTITATIVE ASSESSMENT OF THE SECURITY OF A E-COMMERCE WEB-APPLICATION AT THE OPERATIONAL PHASE

Abstract

The article proposes a general approach to the quantitative assessment of e-commerce web application security based on the OWASP ASVS standard, which includes 13 sections addressing various aspects of security, such as authentication, session management, access control, data validation, file protection, and system confi-guration. The developed methodology enables obtaining quantitative indicators for the level of compliance with each requirement, making the evaluation objective and understandable for auditors and web application owners.Based on an analysis of the general list of OWASP ASVS requirements, a subset of requirements was selected for assessing the security of an operational online store, assuming that the auditor lacks technical documentation about the web application’s development. For each requirement, a structured set of criteria with clear evaluation rules was developed to derive quantitative indicators. The study utilized the “OWASP Juice Shop” test environment, allowing the methodology to be tested on a practical example containing a range of predefined built-in vulnerabilities. This web application serves as a prototype of a typical online store, making it an ideal subject for this research.As expected, the assessment results revealed a low level of implementation of security practices in areas such as session management, input data validation, and file protection, while authentication and access control demonstrated a medium level of compliance with the standards. The proposed methodology contributes to advancing practices for ensuring the security of e-commerce web applications by providing an effective tool for security assessment and vulnerability identification during the operational phase of a web application.