What is OWASP?<\/h2>\n\n\n\n
Before we get to the OWASP Top 10, let\u2019s talk about OWASP themselves. The OWASP foundation was founded on December 1, 2001, and they were incorporated as a non-profit organization in the United States on April 21, 2004. In the nearly two decades since their launch, they\u2019ve grown to consist of nearly 32,000 volunteers worldwide. They\u2019re a well-recognized and trusted name in the industry, with over 275 local chapters around the globe.<\/p>\n\n\n
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/owasplogo.png\")
<\/figure>\n<\/div>\n\n\nOWASP\u2019s mission since launch has been to improve the security of software. They use an \u201copen community\u201d model, which means that anyone can contribute to their projects, events, webinars, and more. They provide materials and information free of charge, which can be accessed via their website. They produce a wide array of media, including videos, software tools, forums, live and virtual events, and learning resources.<\/p>\n\n\n\n
Basically, OWASP is a repository for anything related to web application security, powered by the diverse knowledge and experience of their open community membership. The group is committed to helping organizations create, develop, deploy, operate, and maintain websites and applications that are safe. In addition to providing an array of articles, methodologies, documentation, and technologies, OWASP\u2019s membership also performs security assessments and research.<\/p>\n\n\n\n
What they\u2019re best known for, however, is the OWASP Top 10 list.<\/p>\n\n\n\n
What is the OWASP Top 10?<\/h2>\n\n\n\n
The OWASP Top 10 list outlines security concerns for websites and web applications. It was first published in 2003 and is usually revised every three to four years as the AppSec market changes and evolves. The list has seen updates in 2004, 2007, 2010, 2013, 2017.<\/p>\n\n\n\n
The focus of the OWASP Top 10 list is on the most critical vulnerabilities, examining their risks, impacts, and the best countermeasures to combat them. Compiled by a team of security experts from around the world, the list aims to create awareness of the biggest threats facing organizations. OWASP recommends that all companies incorporate the findings of the report into their security processes and practices so they can minimize the presence of these vulnerabilities in their products.<\/p>\n\n\n\n
As for the vulnerabilities themselves, they are judged based on four different criteria:<\/p>\n\n\n\n
- \n
- Prevalence \u2013 how well known is this vulnerability to threat agents (eg. hackers)?<\/li>\n\n\n\n
- Detectability \u2013 how easy is it for threat agents to discover the vulnerability within an application?<\/li>\n\n\n\n
- Ease of exploitation \u2013 how easy is it for threat agents to actually exploit the vulnerability once they\u2019ve found it?<\/li>\n\n\n\n
- Business impact \u2013 how severely will the company operating the application be affected by the exploitation?<\/li>\n<\/ul>\n\n\n\n
When the list was originally created, vulnerabilities were grouped by type so that the authors could cover the most ground. However, that made it more difficult for readers to determine which vulnerabilities were actually the highest priorities since there weren\u2019t any statistics included to quantify them. It thus became a subjective task for the audience since there\u2019s wide variation in application types and threat models depending on the organization. Ultimately, after much debate, OWASP decided to offer a more straightforward top 10 list that they believed was relevant to the widest set of companies (although it\u2019s important to note that the entries are in no particular order).<\/p>\n\n\n\n
The Importance of the OWASP Top 10<\/h2>\n\n\n\n
The most useful aspect of the OWASP Top 10 list lies in the actionable information given within, which helps company focus their security efforts on the most important and effective areas. This has led to the list being adopted as a standard requirement by many of the world\u2019s largest companies (including the PCI-DSS payment processing standards). The failure of an organization to address the items within the OWASP Top 10 is a strong indicator to auditors that they are falling short when it comes to compliance standards.<\/p>\n\n\n\n
Web application attacks have become the most common cause of confirmed data breaches, per the 2018 Verizon Data Breach Investigations Report. Unfortunately, many organizations still struggle when it comes to creating and maintaining an effective application security program because they just don\u2019t know where to begin. The OWASP Top 10 list can help fill that void, acting as a great starting point since it covers the vulnerabilities that are the most likely to be exploited (and potentially creating data breaches that will be very unpleasant for both your business and customers). By remediating them, you\u2019ll greatly decrease your risk of a costly breach.<\/p>\n\n\n\n
And research shows that sort of action is desperately needed. As you can see below, the passing rate of applications when it comes to OWASP Top 10 policy is still alarmingly low. Perhaps even more worrying is the fact that there is only a slight increase in compliance after an initial OWASP Top 10 vulnerability scan occurs, indicating that most companies aren\u2019t taking the scan results seriously.<\/p>\n\n\n
\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/scanpercent.png\")
Image Source: Veracode<\/figcaption><\/figure>\n<\/div>\n\n\n Most of the items on the OWASP Top 10 list aren\u2019t super complicated to find and fix, but a disconnect often occurs within organizations because developers are often not well trained in cybersecurity or secure coding practices. Conversely, security teams don\u2019t always have the most accurate idea of what application security actually entails. A one-time scan or pen test of a few critical apps is just not good enough. There must be continuous assessments in place of everything an organization develops or buys, and it must occur in all stages of the lifecycle for it to be effective. Running scans to cover the OWASP Top 10 list is important, but it\u2019s not a magic bullet either. It needs to be an element of a greater company-wide security strategy.<\/p>\n\n\n\n
Now that we\u2019ve covered what the list is and how it should be used, let\u2019s take a closer look at those pesky vulnerabilities!<\/p>\n\n\n<\/span><\/span>\n\n\n
<\/p>\n\n\n\n
The OWASP Top 10 Vulnerabilities<\/h2>\n\n\n\n
#1 \u2013 Injection<\/h3>\n\n\n\n
What is it?<\/h4>\n\n\n\n
Injection attacks can happen on things such as databases (SQL, noSQL), operating systems, or servers (via protocols like LDAP). They occur when hostile data is sent to an interpreter as part of a query or command. This data then tricks the interpreter into executing commands that would otherwise be off-limits to an outsider. It can also be used to access private data without proper authentication.<\/p>\n\n\n\n
Example<\/h4>\n\n\n\n
Say you run an ecommerce store, and the way to access a particular item is by entering the following into your browser\u2019s address bar:<\/p>\n\n\n\n
- \n
- http:\/\/www.yourstore.com\/catalog\/item.asp?itemid=999<\/li>\n<\/ul>\n\n\n\n
Where \u201c999\u201d generates an SQL query to display whatever item \u201c999\u201d corresponds to. An attacker could manipulate this by entering something like this:<\/p>\n\n\n\n
- \n
- http:\/\/www.yourstore.com\/items\/item.asp?itemid=999 or 1=1<\/li>\n<\/ul>\n\n\n\n
The SQL query generated would be:<\/p>\n\n\n
\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/injection1.png\")
Image Source: Imperva<\/figcaption><\/figure>\n<\/div>\n\n\n But since 1 always equals 1, every product name and description will be returned (even ones that the owner may not want you to see).<\/p>\n\n\n\n
You could go a step further by entering:<\/p>\n\n\n\n
- \n
- http:\/\/www.estore.com\/items\/iteam.asp?itemid=999; DROP TABLE<\/li>\n<\/ul>\n\n\n\n
The SQL query would now be:<\/p>\n\n\n
\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/injection2.png\")
Image Source: Imperva<\/figcaption><\/figure>\n<\/div>\n\n\n The end result? The deletion of your table!<\/p>\n\n\n\n
How to Protect Yourself<\/h4>\n\n\n\n
- \n
- Validate and\/or sanitize user-submitted data (validation rejects suspicious entries, and sanitization cleans up the suspicious parts of it)<\/li>\n\n\n\n
- Set controls to minimize the amount of information that is exposed<\/li>\n\n\n\n
- Use a safe API that avoids the use of an interpreter<\/li>\n\n\n\n
- Use SQL controls like LIMIT and others to prevent mass disclosure of records<\/li>\n<\/ul>\n\n\n\n
#2 \u2013 Broken Authentication<\/h3>\n\n\n\n
What is it?<\/h4>\n\n\n\n
Broken authentication refers to instances when authentication and session management functions are implemented incorrectly. Credentials like passwords, keys, or session tokens can be compromised, and flaws can also be used to assume the identities of other users. Attacks can even gain access to an admin account that could compromise the entire system.<\/p>\n\n\n\n
Example<\/h4>\n\n\n\n
Credential stuffing is an example of a broken authentication attack. This is when attackers use lists of known passwords (like those obtained in data breaches) to try and gain access, with the application acting as a validation mechanism for each password attempt<\/a>.<\/p>\n\n\n\n
How to Protect Yourself<\/h4>\n\n\n\n
- \n
- Use multi-factor authentication<\/li>\n\n\n\n
- Implement rate limiting to restrict the number of failed login attempts<\/li>\n\n\n\n
- Don\u2019t use system default credentials<\/li>\n\n\n\n
- Choose passwords based on the NIST 800-63B<\/a> section 5.1.1 standard<\/li>\n\n\n\n
- Use a built-in server-side session manager<\/li>\n<\/ul>\n\n\n\n
#3 \u2013 Sensitive Data Exposure<\/h3>\n\n\n\n
What is it?<\/h4>\n\n\n\n
Sensitive data exposure occurs when web applications and APIs fail to properly protect sensitive data like financial or healthcare information. This weakly protected data can be easily stolen by attackers to conduct fraud, identity theft, and other crimes.<\/p>\n\n\n\n
Example<\/h4>\n\n\n\n
If a website doesn\u2019t use SSL\/TLS for all pages, then an attacker could monitor traffic, change connections from HTTPS to HTTP, and then steal the session cookie to gain access.<\/p>\n\n\n\n
Another example is unsalted hashes. If simple hashes are used to store passwords and an attacker gains access to the database, the hashes can be easily cracked.<\/p>\n\n\n\n
How to Protect Yourself<\/h4>\n\n\n\n
- Use a built-in server-side session manager<\/li>\n<\/ul>\n\n\n\n
- http:\/\/www.estore.com\/items\/iteam.asp?itemid=999; DROP TABLE<\/li>\n<\/ul>\n\n\n\n
- http:\/\/www.yourstore.com\/items\/item.asp?itemid=999 or 1=1<\/li>\n<\/ul>\n\n\n\n
- http:\/\/www.yourstore.com\/catalog\/item.asp?itemid=999<\/li>\n<\/ul>\n\n\n\n
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/xml1.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/xml2.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/brokencred1.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/brokencred2.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/error.png\")
<\/figure>\n<\/div>\n\n\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/ser1.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/ser2.png\")
![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/cg1.png\")
<\/figure>\n<\/div>\n\n\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/cg2.png\")
<\/figure>\n<\/div>\n\n\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/cg3.png\")
<\/figure>\n<\/div>\n\n\n![\"OWASP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/11\/cg4.png\")
<\/figure>\n<\/div>\n\n\n![\"CodeGuard](\"\/content\/images\/cg-vertical-logo.svg\"){kind=logo}
\n<\/div>\n\n\n\n