Search for a command to run...
I am Murali Doss, a Sr DevOps Advocate and Cloud Consultant. I am a long time open source contributor who cares deeply for open communities. Currently supporting CloudnLoud community for a good cause. Love to learn and share new technologies, especially with Cloud and DevOps. You can reach me on Twitter via @muralidoss5588
super
API (Application Programming Interface) security is critical for protecting sensitive data and maintaining the integrity of systems and applications. APIs are used to connect different systems and applications, and as a result, they can provide a gat...
Well after months of deep slumber, away from social media networks, I had to return to Pune and adapt to hybrid working. I was browsing through meetup.com and was intrigued by one event from AWS user group Pune. It is AWS Reinvent 2022 -Recap on 21st...
Episode 2
Simplify Access Control and Enhance Transparency Over Your ML Projects
Episode 1
OWASP stands for Open Web Application Security Project. It is a non-profit foundation that works towards improving the security of the Application or the Software. OWASP foundation is supported by the community that involves open-source projects led by tech volunteers, contributors, and developers. They often conduct educational and training conferences that are helpful for technologists and developers in securing the web and their applications.
OWASP top 10 is the list of top 10 web/software security vulnerabilities that the community of developers agrees in common as per the severities. The list can be referred to take proactive actions against the dangerous exploitations and provides for the appropriate remediations to be followed to deal with them. OWASP has the compilations of all the data about the common vulnerabilities and the surveys from the developers on the same. The top 10 OWASP list was first published in the year 2003. And the updates were followed in the years 2004, 2007, 2010, 2013 and 2017. The most recent OWASP top 10 list was published in 2021.
Image Source: www.owasp.org
The below list is the latest consolidation of the OWASP top 10 2021 list straight away from the owasp.org foundation.
• A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category.
• A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was a broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
• A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.
• A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modelling, secure design patterns and principles, and reference architectures.
• A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.
• A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
• A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardised frameworks seems to be helping.
• A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.
• A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
• A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
Therefore, being an open source security community, OWASP provides enormous knowledge, tools, and best practices to help developers and security engineers in making their web applications as secure as possible. It is recommended to have a complete understanding of the OWASP vulnerabilities list to take proper proactive measures if you want to strengthen the security of your application or software.
I hope this blog post is very useful to understand OWASP. Please do follow me on below social forums for more such technical posts.
