The use of information systems and technologies comes with a set of
risks. It is crucial to assess risks as part of information security activities
and take appropriate protection measures.
External intruders are the main threat to the web application. External
intruders are individuals motivated by commercial interest, capable of
gaining access to a company's website, knowledgeable in network
security matters, and experienced in exploiting various information
systems. Those individuals can perform SQL injection or Cross-site
scripting on the web application. Also, web applications and some internal
vulnerabilities can cause sensitive data exposure, broken authentication
and session management, and broken access control can give external
intruders access to the web application and company’s network.
This means that a company should identify as many vulnerabilities as
possible to reduce the attack surface area. As a first step, it is necessary
to identify technical vulnerabilities. There can be both one-time and
routine vulnerabilities that affect different infrastructures. Technical
