The Open Web Application Security Project (owasp.org) is a worldwide free and op

Question

The Open Web Application Security Project (owasp.org) is a worldwide free and open

community focused on improving the security of application software. Their mission is “to make

the application security visible, so that people and organizations can make informed decisions

about true application security risks.” The OWASP Foundation is a non-profit organization.

OWASP periodically reports on the top risks associated with the use web applications in an

enterprise. The list of such risks includes:

1. Injection

2. Broken Authentication and Session Management

3. Cross-Site Scripting (XSS)

4. Insecure Direct Object References

5. Security Misconfiguration

6. Sensitive Data Exposure

7. Missing Function Level Access Control

8. Cross-Site Request Forgery

9. Using Known Vulnerable Components

10. Invalidated Redirects and Forwards

Your assignment is:

Read the introductory material on https://www.owasp.org/index.php/Top_10_2013.

On the main page,

(https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project) learn how

companies are using the OWASP Top 10:

How can Companies-Projects- Vendors protect their data using the OWASP Top 10 list (5

points). Choose any 5 security flaws and describe them in detail

Explanation / Answer

The mission of OWASP is to make software security visible, so that individuals and organizations are able to make informed decisions.
The OWASP Top 10 list represents a consensus among leading application security experts about the greatest software risks.
OWASP is always changing and evolving to help web security professionals protect and fortify websites and networks against possible attacks.
To protect their data using the OWASP Top 10 they handle a list of security techniques and best practices such as
Encoding data
**************
encoding is the process of applying a specific code, such as letters, symbols and numbers, to data for conversion into an equivalent cipher.
Validating Inputs before submitting
***********************************
Process of ensuring validation constraints that check for correctness, meaningfulness, and security of data that are input to the system.
Protect data and privacy
**************************
The data privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy,
and the legal and political issues surrounding them.
Implementing appropriate access control
****************************************
Implementing appropriate access control is nothing but the act of ensuring that an authenticated user accesses only what they are
authorized to and no more.
Implement logging, error handling and intrusion detection
*********************************************************
Logs can be fed into real time intrusion detection and performance and system monitoring tools.
For added security, logs should also be written to a write once / read many device such as a CD-R.

To help simplify and proactively defend against these threats, OWASP data is divided into 10 unique categories, with each one dedicated
to a specific type of security issue. Among them we see 5 risks in detail

Injection
**********
Injection flaws occur when an application sends untrusted data to an interpreter.
Injection flaws are very prevalent, particularly in legacy code.
They are often found in SQL, LDAP, Xpath, or NoSQL queries; OS commands; XML parsers, SMTP Headers, program arguments, etc.
Scanners and fuzzers can help attackers find injection flaws.
Injection can result in data loss or corruption, lack of accountability, or denial of access.

Solution to prevent
*********************
Preventing injection requires keeping untrusted data separate from commands and queries.
Input validation is recommended.
se a safe API which avoids the use of the interpreter entirely or provides a parameterized interface.

Cross-Site Scripting (XSS)
*****************************
Cross-site Scripting (XSS) refers to client-side code injection attack wherein an attacker can execute malicious scripts in web application
These scripts can even rewrite the content of the HTML page.
XSS attacks occur when an attacker uses a web application to send malicious code.
The end user’s browser has no way to know that the script should not be trusted, and will execute the script.
There are so many type of cross-site scripting they are server xss and client xss

Solution to prevent
***********************
Preventing XSS requires separation of untrusted data from active browser content.
The preferred option is to properly escape all untrusted data based on the HTML context (body, attribute,JavaScript, CSS, or URL)
that the data will be placed into.

Sensitive Data Exposure
*************************
Consider who can gain access to your sensitive data and any backups of that data.
Include both external and internal threats.
Attackers typically don’t break crypto directly.
They steal keys or steal clear text data off the server, while in transit, or from the user’s browser
External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.

Solutions to prevent
********************
Consider the business value of the lost data and impact to your reputation.
Unsafe cryptography, SSL usage, and data protection are well beyond the scope of the Top 10.
Don’t store sensitive data unnecessarily. Discard it as soon as possible.
Ensure passwords are stored with an algorithm specifically designed for password protection.
Disable autocomplete on forms collecting sensitive data.

Cross-Site Request Forgery(CSRF)
*********************************
Any website or other HTML feed that your users access could do this
Attacker creates forged HTTP requests and tricks a victim into submitting them via image tags, XSS, or numerous other techniques.
Detection of CSRF flaws is fairly easy via penetration testing or code analysis.

Solutions to pevent
**********************
Preventing CSRF usually requires the inclusion of an unpredictable token in each HTTP request.
Such tokens should, at a minimum, be unique per user session.
Requiring the user to reauthenticate, or prove they are a user (e.g., via a CAPTCHA) can also protect against CSRF.

Unvalidated Redirects and Forwards
**************************************
Consider anyone who can trick your users into submitting a request to your website.
If the target URL isn’t validated against a whitelist, you are vulnerable.
Victims are more likely to click on it, since the link is to a valid site.
Attacker targets unsafe forward to bypass security checks.
Unchecked forwards are harder, because they target internal pages.

Solutions to prevent
**********************
Simply avoid using redirects and forwards.
Don’t involve user parameters in calculating the destination.
Avoiding such flaws is extremely important as they are a favorite target of phishers trying to gain the user’s trust.

Related Questions

Navigate

• Browse (All)
• Browse T
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.