12 owasp top 10 - introduction
- 1. OWASP Top-10 2013 The Top 10 Most Critical Web Application Security Risks https://www.owasp.org/index.php/Top_10_2013-Top_10
- 2. About the OWASP Top 10 • Not a standard… OWASP Top 10 is an Awareness Document • Was probably 3rd or 4th OWASP project First developed in 2003 • 2003, 2004, 2007, 2010, 2013 Released
- 3. OWASP Top Ten (2013 Edition)
- 4. What Didn’t Change • Title is: “The Top 10 Most Critical Web Application Security Risks” It’s About Risks, Not Just Vulnerabilities • Based on the OWASP Risk Rating Methodology, used to prioritize Top 10 OWASP Top 10 Risk Rating Methodology
- 5. OWASP Top 10 Risk Rating Methodology Threat Agent Attack Vector Weakness Prevalence Weakness Detectability Technical Impact Business Impact ? Easy Widespread Easy Severe ?Average Common Average Moderate Difficult Uncommon Difficult Minor 1 2 3
- 6. What’s Changed? • Reordered: 7 • Added: 1 • Merged: 2 merged into 1 • Broadened: 1 Risks Added, Risks Merged, Risks Reordered • Same as 2010, but • Used more sources of vulnerability data • All vulnerability data made public by each provider Development Methodology For 2013 • More transparency • Requested vulnerability data format • Earlier community involvement Development Methodology for Next Version?
- 7. Mapping from 2010 to 2013 Top 10 OWASP Top 10 – 2010 (old) OWASP Top 10 – 2013 (New) 2010-A1 – Injection 2013-A1 – Injection 2010-A2 – Cross Site Scripting (XSS) 2013-A2 – Broken Authentication and Session Management 2010-A3 – Broken Authentication and Session Management 2013-A3 – Cross Site Scripting (XSS) 2010-A4 – Insecure Direct Object References 2013-A4 – Insecure Direct Object References 2010-A5 – Cross Site Request Forgery (CSRF) 2013-A5 – Security Misconfiguration 2010-A6 – Security Misconfiguration 2013-A6 – Sensitive Data Exposure 2010-A7 – Insecure Cryptographic Storage 2013-A7 – Missing Function Level Access Control 2010-A8 – Failure to Restrict URL Access 2013-A8 – Cross-Site Request Forgery (CSRF) 2010-A9 – Insufficient Transport Layer Protection 2013-A9 – Using Known Vulnerable Components (NEW) 2010-A10 – Unvalidated Redirects and Forwards (NEW) 2013-A10 – Unvalidated Redirects and Forwards 3 Primary Changes: Merged: 2010-A7 and 2010-A9 -> 2013-A6 Added New 2013-A9: Using Known Vulnerable Components 2010-A8 broadened to 2013-A7