OWASP top ten
•Download as PPTX, PDF•
0 likes•133 views
An overview of the top ten security threats in 2017 and beyond. OWASP top 10
Recommended
More Related Content
Similar to OWASP top ten
Similar to OWASP top ten (20)
Recently uploaded
Recently uploaded (20)
OWASP top ten
- 1. OWASP Top Ten Chris Ballance @ballance
- 2. What is OWASP? Will it sting me?
- 4. https://website.com/getusers.php?name=a Get a list of users…
- 5. SELECT * FROM users WHERE name = 'a' Renders this query to your database… Can you spot the problem?
- 7. a';DROP TABLE users; SELECT * FROM u
- 8. A2 - Broken Authentication and Session Management
- 11. A3 - Cross-Site Scripting (XSS)
- 12. A4 - Broken Access Control
- 14. Hey, this website doesn’t work… The Internet says to type chmod 777 *
- 15. A6 - Sensitive Data Exposure
- 16. A7 - Insufficient Attack Protection*
- 17. A8 - Cross-Site Request Forgery (CSRF)
- 18. A9 - Using Components with Known Vulnerabilities
- 20. A10 - Underprotected APIs*
- 21. There are more than ten vulnerabilities!
- 22. Additional Info OWASP Site https://www.owasp.org Udemy and Pluralsight courses luence.redventures.net/display/GAT/Security+Training+for+D
- 23. Questions?
Editor's Notes
- Came online in 2001 and is a not-for-profit charitable organization. “OWASP is an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. “ “All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. They advocate approaching application security as a people, process, and technology problem because the most effective approaches to application security include improvements in all of these areas.”
- SQL Injection
- Not using TLS Improperly storing passwords Sessions are visible and can be shared
- - Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites - Once inserted, a malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page
- Insecure IDs Path traversal (guessing urls) File permissions (read only, rarely if ever marked executable) Client-side caching (sensitive info should not be cached)
- Router default admin password example Stack traces turned on in production (Volvo example?)
- Poorly secured user credentials PII, PCI, Health Info, etc
- Detect, Respond, Patch quickly Palo Alto example, Traps example, Mimecast
- - In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your password. A malicious link could look like that:
- Apply security patches regularly and in a timely fashion
- - Patch issued by Microsoft, even for versions of Windows that are no longer supported - SMB / CIFS not necessary for most machines anyway. (disable unnecessary features)
- - The use of APIs is growing and they need to be protected just as much as publicly facing site.
- OWASP 10 is a good start, but there are many vulnerabilities to be concerned with. Be vigilant!
- OWASP 10 is a good start