THE IMPACT OF HUMAN FACTORS ON WEB APPLICATION SECURITY DURING DEVELOPMENT AND TESTING

The article investigates the impact of human factors on web application security at different stages of the software life cycle, including design, development, testing, and configuration. The relevance of the study is determined by the fact that errors made by developers, testers, and administrators may be associated with vulnerabilities, improper system configuration, and increased cybersecurity risks. Typical human errors related to insufficient input validation, improper access control, errors in software implementation, incomplete testing, and incorrect configuration of web application components are considered. A comprehensive model for assessing the impact of human factors is proposed. The model establishes a relationship between human error, potential vulnerability, potential threat, possible consequences, and the associated risk. The assessment takes into account the conditional probability of threat realization and its potential impact on the confidentiality, integrity, and availability of information. A conditional quantitative risk assessment is applied to compare the initial and residual calculated risk values after the conditional application of risk mitigation measures, including code review, automated and manual testing, access control, input validation, and configuration control. The practical application of the proposed model is demonstrated using OWASP Juice Shop, an intentionally vulnerable web application designed for security training and testing. Four modeled scenarios involving developer, tester, and administrator errors are analyzed. For each scenario, the initial calculated risk value is determined, appropriate risk mitigation measures are identified, and the residual calculated risk value is obtained. The results demonstrate the applicability of the proposed model for structured comparison of calculated risk levels associated with human factors before and after the conditional application of security measures.