Zabezpečení webových aplikací

This bachelor thesis deals with security of web sites and includes a practical part about security of cloud services. There are described techniques of web sites security at this paper. Web sites use for its operation the HTTP protocol and more secure web pages use the HTTPS protocol, which also includes a security layer called SSL or TLS. Since the web application can never be safer than the protocol that is used, all the protocols and layers are further discussed in this thesis. Especially their characteristics from the perspective of safety, principles of their functioning, their security weaknesses and recommendations in order to reduce risks and increase their safety are closer clarified. The theoretical part continues in disquisition of encryption, related to security layers. Then in the same context, it describes the major certification authorities. The next section analyzes the security of cloud computing. The reader learns about the security risks in connection with the use of the cloud, about standards and legislation. At the end of the theoretical part, trends in the security of cloud computing that we can expect in the coming years are discussed. In the practical part, there could be found attacks against web applications that use both HTTP and HTTPS. Each attack is described in terms of principle and defense techniques against it. This thesis also includes recommendations for proper use of safety layers SSL and TLS which are used on secure web applications. The largest and best known providers of cloud computing from the perspective of securing their services are compared. In this area of IT, there are no borders, so that the world's biggest players are also the biggest in the Czech Republic. Both corporate and private cloud services are explained. For each service, there is a technical description of its security and a preview of safety policy of the organization that operates this service.