OWASP Top 10 2017 – Ten Most Critical Web Application Security Risks

The Open Web Application Security Project (OWASP) is an online community that provides free articles, methodologies, documentation, tools and technologies in the field of web application security.

The ten most critical security risks in web applications, popularly known as OWASP Top 10, is a powerful awareness document for web application security. OWASP Top 10 represents a broad consensus on what the most important web application security flaws are.

OWASP plans officially launch OWASP Top 10 2017 in October 2017 after a public comment period ending June 30, 2017. See the chart below for the main vulnerabilities:

OWASP Top 10 2017.png

A1 - Injection
Injection flaws, such as SQL, OS, XXE, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. Injected data from the attacker can trick the interpreter into executing unintentional commands or accessing data without proper authorization.

A2 - Broken Authentication and Session Management
The application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys or session tokens, or exploit other implementation flaws to assume the identities of other users (temporarily or permanently).

A3 - Cross-Site Scripting (XSS)
XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. XSS vulnerabilities occur whenever an application allows you to include untrusted scripts on a web page without proper validation.

A4 - Broken Access Control
Restrictions on what authenticated users can do are not properly enforced. Attackers can exploit these vulnerabilities to access unauthorized data and features, such as other users 'accounts, view sensitive files, modify other users' data, change access rights, and so on.

A5 - Security Misconfiguration
Good security requires having a secure configuration defined and implemented for the application, frameworks, application server, web server, database server, platform, etc. Secure configurations must be defined, implemented, and maintained, since standards are often unsafe. In addition, the software must be kept up to date.

A6 - Sensitive Data Exposure
Many web applications and APIs do not adequately protect confidential / sensitive data. Attackers may steal or modify such weakly protected data to perform credit card fraud, identity theft, or other crimes. Sensitive data deserves additional protection, such as strong encryption whether at rest or in transit, as well as special precautions when exchanged with the browser.

A7 Insufficient Attack Protection
Most applications and APIs do not have the basic ability to detect, prevent and respond to manual and automated attacks. Attack protection goes far beyond basic input validation and involves detection, logging / logging, response, and even blocking of intrusion attempts. Application owners also need to be able to quickly deploy patches / patches to protect against attacks.

Cross-Site Request Forgery (CSRF)
A CSRF attack forces the logged-in victim's browser to send a forged / spoofed HTTP request, including the victim's session cookie and any other automatically-entered authentication information for a vulnerable web application. Such an attack allows the attacker to force the victim's browser to generate requests that the vulnerable application believes are legitimate requests.

A9 - Using Components with Known Vulnerabilities
Components such as libraries, frameworks and other software modules run with the same privileges as the application. If a vulnerable component is exploited, such an attack can cause data loss or server acquisition by the attackers. Applications and APIs that use components with known vulnerabilities can undermine application defenses and allow for multiple attacks and impacts.

A10 - Underprotected APIs
Modern applications generally encompass applications client and APIs, such as JavaScript in the browser and mobile applications, which connect to an API of some kind (SOAP / XML, JSON / REST, RPC, GWT, etc.). These APIs are often unprotected and contain numerous vulnerabilities.

For more information and references, see: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Rafael Fontes Souza is a member of the CIPHER Intelligence LAB offensive security team, recognized at the Apple Security Hall of Fame and Microsoft Security Researchers Award.

Did you enjoy this blog article? Share it with your friends or comment below.
 
.

 

About CIPHER

Founded in 2000, CIPHER is a global cybersecurity company that delivers highly accredited SOC I and SOC II Type 2 certified Managed Security Services and Security Consulting Services with expertise across ISO 20000 and ISO 27001, and PCI DSS holding the QSA and PCI ASV certifications. We have received many awards including Best MSSP from Frost & Sullivan for the past five years. These services are supported by the best-in-class security intelligence lab: CIPHER Intelligence. Our offices are located in North America, Europe, and Latin America with 24×7×365 Security Operations Centers and R&D laboratories, complemented by strategic partners around the globe. 

Our clients consist of Fortune 500 companies, world-renowned enterprises, and government agencies with countless success stories. CIPHER provides organizations with proprietary technologies and specialized services to defend against advanced threats while managing risk and ensuring compliance through innovative solutions. 

Subscribe to Us!

Maeasure Your Information Security Maturity Self-Assessment Survey
Measure Your Information Security Maturity Self-Assessment Survey

Recent Security Posts

security consulting services

Twitter Feed