This document discusses application security and the OWASP Top 10 list of vulnerabilities. It covers topics like injection flaws, broken authentication, sensitive data exposure, and denial of service attacks. Application security involves adequately defending against easy-to-find vulnerabilities to achieve Level 1 certification. The OWASP Top 10 lists the most critical web app security risks, including injection, XSS, broken access control, and using components with known vulnerabilities. Denial of service attacks work by consuming limited resources like bandwidth or database connections to prevent legitimate use.

1. OWASP and Friends
(DDoS included)
Mažvydas Skuodas @ Helis LT

3. Top Attack Methods

4. Top Application Weaknesses

5. Top Impacts/Outcomes

9. Application Security Verification Levels

10. Level 1: Opportunistic
An application achieves Level 1 (or Opportunistic)
certification if it adequately defends against
application security vulnerabilities that are easy to
discover.

13. OWASP Top 10

14. OWASP Top 10 2013

15. https://github.com/OWASP/Top10/tree/master/2017

16. OWASP Top 10 2017 - Whats new?

19. InjectionA1

20. InjectionA1

21. Broken Authentication and Session
ManagementA2

22. Broken Authentication and Session
ManagementA2

23. Cross-Site Scripting (XSS)A3

24. Cross-Site Scripting (XSS)A3

25. Broken Access ControlA4

26. Broken Access ControlA4

27. Security MisconfigurationA5

28. Security MisconfigurationA5

29. Sensitive Data ExposureA6

30. Sensitive Data ExposureA6

31. Insufficient Attack ProtectionA7

32. Insufficient Attack ProtectionA7

33. Cross-Site Request Forgery
(CSRF)A8

34. Cross-Site Request Forgery
(CSRF)A8

35. Using Components with Known
VulnerabilitiesA9

36. Using Components with Known
VulnerabilitiesA9

37. Underprotected APIsA10

38. Underprotected APIsA10

42. Application Denial of Service
• Once an attacker can consume all of some
required resource, they can prevent legitimate
users from using the system.
• Some resources that are limited include
bandwidth, database connections, disk storage,
CPU, memory, threads, or application specific
resources. All of these resources can be
consumed by attacks that target them.

43. Application Denial of Service
• Defending against denial of service attacks is
difficult, as there is no way to protect against
these attacks perfectly.
• As a general rule, you should limit the resources
allocated to any user to a bare minimum.

44. In Short:
• Filter input
• Escape output
• Be paranoid!