SlideShare a Scribd company logo
OWASP Top Ten in Latvia
Most common web security problems
Agris Krusts, IT Centrs, SIA
2018
Who am I
• Agris Krusts, founder of IT Centrs, security consultant
• Managing pen-tes;ng engagements, pen-tests, security audits,
training
• E-mail: Agris.Krusts@itcentrs.lv
• TwiCer: @agris_krusts
• www.itcentrs.lv
© Agris Krusts, SIA IT Centrs, 2018 2
www.itcentrs.lv/files/devclub-2018.pdf
© Agris Krusts, SIA IT Centrs, 2018 3
© OWASP Top 10 2017 4
Data source
• Pen-tests for last 2 - 3 years
• ~ 130 systems
• Usually test environments
• According to appropriate OWASP TesBng Guide v4 control
• Detailed staBsBcs shows only most "popular" problems
• Comparing to similar data from 2011 - 2014
© Agris Krusts, SIA IT Centrs, 2018 5
Excep&ons from OWASP Top 10 2017
• No stats for:
• A8:2017-Insecure Deserializa;on
• A10:2017-Insufficient Logging & Monitoring
© Agris Krusts, SIA IT Centrs, 2018 6
Injec&ons
• Down from ~40% to less than 10%
• S6ll majority is SQLi (7)
• The rest: XML and code injec6ons
© Agris Krusts, SIA IT Centrs, 2018 7
Broken Authen,ca,on and session management
Vulnerable systems
Session fixa+on 11%
Logout problems 15%
Session +meouts 13%
Bypassing authen+ca+on 18%
Problems in password reset 7%
Weak passwords 13%
© Agris Krusts, SIA IT Centrs, 2018 8
Broken Authen,ca,on and session management
• Session fixa,on down from 30% to 11%
• Missing Secure and HttpOnly down from 44% to 5%
• S,ll some do not learn
© Agris Krusts, SIA IT Centrs, 2018 9
Sensi&ve Data Exposure
Systems
Browser caching 21%
SSL problems 31%
Sensi8ve informa8on over
HTTP
10%
© Agris Krusts, SIA IT Centrs, 2018 10
Sensi&ve Data Exposure
• SSL problems up from 27% to 31%
• Sensi7ve informa7on over HTTP down from 40% to 10%
© Agris Krusts, SIA IT Centrs, 2018 11
XML External En--es
• Separate category
• Only couple in Latvia
• Something like this ...
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/inetpub/secret.xml" >]>
<login>
<username>&xxe;</username>
</login>
© Agris Krusts, SIA IT Centrs, 2018 12
Broken Access Control
Systems
Directory traversal 1%
Bypassing authoriza7on 9%
Direct object reference 11%
© Agris Krusts, SIA IT Centrs, 2018 13
Broken Access Control
• Authoriza+on problems in general down from 40%
• Direct object reference down from 33% to 11%
© Agris Krusts, SIA IT Centrs, 2018 14
Security Misconfigura1on (most popular)
Systems
Pla$orm configura.on errors 17%
Old backups and unreferenced files
with sensi.ve informa.on
13%
Accessible admin interfaces 9%
No HSTS headers 26%
© Agris Krusts, SIA IT Centrs, 2018 15
Using Components with Known Vulnerabili6es
239 instances in 130 systems!
© Agris Krusts, SIA IT Centrs, 2018 16
Cross-site scrip,ng
Systems
Reflected XSS 21%
DOM XSS 7%
Stored XSS 18%
© Agris Krusts, SIA IT Centrs, 2018 17
Cross-site scrip,ng
• Down from 46% for dynamic and 36% for stored
• Less risk in dynamic because blocked by browsers
• Higher risk because of data may travel across many systems
© Agris Krusts, SIA IT Centrs, 2018 18
© Agris Krusts, SIA IT Centrs, 2018 19
© Agris Krusts, SIA IT Centrs, 2018 20
Summary
© Agris Krusts, SIA IT Centrs, 2018 21
Number of issues
A1: Injec*on 10
A2: Broken Authen*ca*on and session
management
134
A3 Sensi*ve Data Exposure 89
A4: XML External En**es 2
A5: Broken Access Control 27
A6: Security Misconfigura*on 97
A7: Cross-Site Scrip*ng 59
A9: Using Components with Known Vulnerabili*es 239
© Agris Krusts, SIA IT Centrs, 2018 22
• Web applica+ons are becoming more secure, at least some
• Frameworks help
• Some developers produce more secure code than others
• Old problems, if exit, are more difficult to exploit
• More problems in "new" technologies
© Agris Krusts, SIA IT Centrs, 2018 23
Thank You!
Ques%on and answers!
Agris Krusts, @agris_krusts, +371 29151412, www.itcentrs.lv 24
Agris Krusts
SIA IT Centrs
E-mail: agris.krusts@itcentrs.lv
Phone: +371 29151412
Twi$er: @agris_krusts
www.itcentrs.lv
© Agris Krusts, SIA IT Centrs, 2018 25

More Related Content

What's hot

Cerrera DINWC2015
Cerrera DINWC2015Cerrera DINWC2015
Cerrera DINWC2015
Dmitry Kalashnikov
 
BDX 2016 - Kevin lyons & yakir buskilla @ eXelate
BDX 2016 - Kevin lyons & yakir buskilla  @ eXelate BDX 2016 - Kevin lyons & yakir buskilla  @ eXelate
BDX 2016 - Kevin lyons & yakir buskilla @ eXelate
Ido Shilon
 
Introduction to Machine learning and Deep Learning
Introduction to Machine learning and Deep LearningIntroduction to Machine learning and Deep Learning
Introduction to Machine learning and Deep Learning
Nishan Aryal
 
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
Cloudera, Inc.
 
Team2 final project_presentation
Team2 final project_presentationTeam2 final project_presentation
Team2 final project_presentation
Nishtha Adroja
 
What is MLOps
What is MLOpsWhat is MLOps
What is MLOps
Henrik Skogström
 
Microsoft Machine Learning Smackdown
Microsoft Machine Learning SmackdownMicrosoft Machine Learning Smackdown
Microsoft Machine Learning Smackdown
Lynn Langit
 
Cnvrg webinar continual learning
Cnvrg webinar   continual learningCnvrg webinar   continual learning
Cnvrg webinar continual learning
Maya Perry
 
Thomas Jensen. Machine Learning
Thomas Jensen. Machine LearningThomas Jensen. Machine Learning
Thomas Jensen. Machine Learning
Volha Banadyseva
 

What's hot (9)

Cerrera DINWC2015
Cerrera DINWC2015Cerrera DINWC2015
Cerrera DINWC2015
 
BDX 2016 - Kevin lyons & yakir buskilla @ eXelate
BDX 2016 - Kevin lyons & yakir buskilla  @ eXelate BDX 2016 - Kevin lyons & yakir buskilla  @ eXelate
BDX 2016 - Kevin lyons & yakir buskilla @ eXelate
 
Introduction to Machine learning and Deep Learning
Introduction to Machine learning and Deep LearningIntroduction to Machine learning and Deep Learning
Introduction to Machine learning and Deep Learning
 
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
Hadoop World 2011: LeveragIng Hadoop to Transform Raw Data to Rich Features a...
 
Team2 final project_presentation
Team2 final project_presentationTeam2 final project_presentation
Team2 final project_presentation
 
What is MLOps
What is MLOpsWhat is MLOps
What is MLOps
 
Microsoft Machine Learning Smackdown
Microsoft Machine Learning SmackdownMicrosoft Machine Learning Smackdown
Microsoft Machine Learning Smackdown
 
Cnvrg webinar continual learning
Cnvrg webinar   continual learningCnvrg webinar   continual learning
Cnvrg webinar continual learning
 
Thomas Jensen. Machine Learning
Thomas Jensen. Machine LearningThomas Jensen. Machine Learning
Thomas Jensen. Machine Learning
 

Similar to „OWASP Top Ten in Latvia“ by Agris Krusts from IT Centrs SIA at Security focused 64th DevClub.lv

UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENTUNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
Ulf Mattsson
 
Security Architecture Best Practices for SaaS Applications
Security Architecture Best Practices for SaaS ApplicationsSecurity Architecture Best Practices for SaaS Applications
Security Architecture Best Practices for SaaS Applications
Techcello
 
Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center
NetworkCollaborators
 
The Big Data Ecosystem for Financial Services
The Big Data Ecosystem for Financial ServicesThe Big Data Ecosystem for Financial Services
The Big Data Ecosystem for Financial Services
DataStax
 
[Cisco Connect 2018 - Vietnam] Anh duc le building a secure data center
[Cisco Connect 2018 - Vietnam] Anh duc le   building a secure data center[Cisco Connect 2018 - Vietnam] Anh duc le   building a secure data center
[Cisco Connect 2018 - Vietnam] Anh duc le building a secure data center
Nur Shiqim Chok
 
Cisco Connect 2018 Vietnam - building a secure data center
Cisco Connect 2018 Vietnam - building a secure data centerCisco Connect 2018 Vietnam - building a secure data center
Cisco Connect 2018 Vietnam - building a secure data center
NetworkCollaborators
 
Cisco connect winnipeg 2018 introducing the network intuitive
Cisco connect winnipeg 2018   introducing the network intuitiveCisco connect winnipeg 2018   introducing the network intuitive
Cisco connect winnipeg 2018 introducing the network intuitive
Cisco Canada
 
Security architecture best practices for saas applications
Security architecture best practices for saas applicationsSecurity architecture best practices for saas applications
Security architecture best practices for saas applications
kanimozhin
 
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
Enterprise Management Associates
 
EAS-SEC Project
EAS-SEC ProjectEAS-SEC Project
EAS-SEC ProjectERPScan
 
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptx
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptxTrack 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptx
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptxAmazon Web Services
 
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadkówPLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
PROIDEA
 
Cyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & RecommendationsCyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & Recommendations
Ulf Mattsson
 
Content is King - Symantec
Content is King - SymantecContent is King - Symantec
Content is King - Symantec
Harry Gunns
 
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirementsMySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
Olivier DASINI
 
Enterprise Data Protection - Understanding Your Options and Strategies
Enterprise Data Protection - Understanding Your Options and StrategiesEnterprise Data Protection - Understanding Your Options and Strategies
Enterprise Data Protection - Understanding Your Options and StrategiesUlf Mattsson
 
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
AIIM International
 
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data Spain
 
Monitoring Multi-Cloud Performance
Monitoring Multi-Cloud PerformanceMonitoring Multi-Cloud Performance
Monitoring Multi-Cloud Performance
ThousandEyes
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Connect Toronto 2018   an introduction to Cisco kineticCisco Connect Toronto 2018   an introduction to Cisco kinetic
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Canada
 

Similar to „OWASP Top Ten in Latvia“ by Agris Krusts from IT Centrs SIA at Security focused 64th DevClub.lv (20)

UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENTUNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
UNCOVER DATA SECURITY BLIND SPOTS IN YOUR CLOUD, BIG DATA & DEVOPS ENVIRONMENT
 
Security Architecture Best Practices for SaaS Applications
Security Architecture Best Practices for SaaS ApplicationsSecurity Architecture Best Practices for SaaS Applications
Security Architecture Best Practices for SaaS Applications
 
Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center
 
The Big Data Ecosystem for Financial Services
The Big Data Ecosystem for Financial ServicesThe Big Data Ecosystem for Financial Services
The Big Data Ecosystem for Financial Services
 
[Cisco Connect 2018 - Vietnam] Anh duc le building a secure data center
[Cisco Connect 2018 - Vietnam] Anh duc le   building a secure data center[Cisco Connect 2018 - Vietnam] Anh duc le   building a secure data center
[Cisco Connect 2018 - Vietnam] Anh duc le building a secure data center
 
Cisco Connect 2018 Vietnam - building a secure data center
Cisco Connect 2018 Vietnam - building a secure data centerCisco Connect 2018 Vietnam - building a secure data center
Cisco Connect 2018 Vietnam - building a secure data center
 
Cisco connect winnipeg 2018 introducing the network intuitive
Cisco connect winnipeg 2018   introducing the network intuitiveCisco connect winnipeg 2018   introducing the network intuitive
Cisco connect winnipeg 2018 introducing the network intuitive
 
Security architecture best practices for saas applications
Security architecture best practices for saas applicationsSecurity architecture best practices for saas applications
Security architecture best practices for saas applications
 
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
NetSecOps: Everything Network Managers Must Know About Collaborating with Sec...
 
EAS-SEC Project
EAS-SEC ProjectEAS-SEC Project
EAS-SEC Project
 
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptx
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptxTrack 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptx
Track 1 Session 6_建立安全高效的資料分析平台加速金融創新_HC+EMQ Cliff(已檢核,上下無黑邊).pptx
 
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadkówPLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
PLNOG19 - Gaweł Mikołajczyk & Michał Garcarz - SOC, studium ciężkich przypadków
 
Cyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & RecommendationsCyber Risk Management in 2017: Challenges & Recommendations
Cyber Risk Management in 2017: Challenges & Recommendations
 
Content is King - Symantec
Content is King - SymantecContent is King - Symantec
Content is King - Symantec
 
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirementsMySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
MySQL Day Paris 2018 - MySQL & GDPR; Privacy and Security requirements
 
Enterprise Data Protection - Understanding Your Options and Strategies
Enterprise Data Protection - Understanding Your Options and StrategiesEnterprise Data Protection - Understanding Your Options and Strategies
Enterprise Data Protection - Understanding Your Options and Strategies
 
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
[Webinar Slides] Data Explosion in Your Organization? Harness It with a Compr...
 
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
Big Data security: Facing the challenge by Carlos Gómez at Big Data Spain 2017
 
Monitoring Multi-Cloud Performance
Monitoring Multi-Cloud PerformanceMonitoring Multi-Cloud Performance
Monitoring Multi-Cloud Performance
 
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
Cisco Connect Toronto 2018   an introduction to Cisco kineticCisco Connect Toronto 2018   an introduction to Cisco kinetic
Cisco Connect Toronto 2018 an introduction to Cisco kinetic
 

More from DevClub_lv

Fine-tuning Large Language Models by Dmitry Balabka
Fine-tuning Large Language Models by Dmitry BalabkaFine-tuning Large Language Models by Dmitry Balabka
Fine-tuning Large Language Models by Dmitry Balabka
DevClub_lv
 
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ..."Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
DevClub_lv
 
From 50 to 500 product engineers – data-driven approach to building impactful...
From 50 to 500 product engineers – data-driven approach to building impactful...From 50 to 500 product engineers – data-driven approach to building impactful...
From 50 to 500 product engineers – data-driven approach to building impactful...
DevClub_lv
 
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
DevClub_lv
 
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
DevClub_lv
 
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
DevClub_lv
 
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
DevClub_lv
 
SRE (service reliability engineer) on big DevOps platform running on the clou...
SRE (service reliability engineer) on big DevOps platform running on the clou...SRE (service reliability engineer) on big DevOps platform running on the clou...
SRE (service reliability engineer) on big DevOps platform running on the clou...
DevClub_lv
 
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
DevClub_lv
 
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
DevClub_lv
 
Building resilient frontend architecture by Monica Lent at FrontCon 2019
Building resilient frontend architecture by Monica Lent at FrontCon 2019Building resilient frontend architecture by Monica Lent at FrontCon 2019
Building resilient frontend architecture by Monica Lent at FrontCon 2019
DevClub_lv
 
Things that every JavaScript developer should know by Rachel Appel at FrontCo...
Things that every JavaScript developer should know by Rachel Appel at FrontCo...Things that every JavaScript developer should know by Rachel Appel at FrontCo...
Things that every JavaScript developer should know by Rachel Appel at FrontCo...
DevClub_lv
 
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
DevClub_lv
 
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
DevClub_lv
 
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
DevClub_lv
 
Bridging the gap between UX and development - A Storybook by Marko Letic at F...
Bridging the gap between UX and development - A Storybook by Marko Letic at F...Bridging the gap between UX and development - A Storybook by Marko Letic at F...
Bridging the gap between UX and development - A Storybook by Marko Letic at F...
DevClub_lv
 
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
DevClub_lv
 
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
DevClub_lv
 
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
DevClub_lv
 
Managing State in React Apps with RxJS by James Wright at FrontCon 2019
Managing State in React Apps with RxJS by James Wright at FrontCon 2019Managing State in React Apps with RxJS by James Wright at FrontCon 2019
Managing State in React Apps with RxJS by James Wright at FrontCon 2019
DevClub_lv
 

More from DevClub_lv (20)

Fine-tuning Large Language Models by Dmitry Balabka
Fine-tuning Large Language Models by Dmitry BalabkaFine-tuning Large Language Models by Dmitry Balabka
Fine-tuning Large Language Models by Dmitry Balabka
 
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ..."Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
"Infrastructure and AWS at Scale: The story of Posti" by Goran Gjorgievski @ ...
 
From 50 to 500 product engineers – data-driven approach to building impactful...
From 50 to 500 product engineers – data-driven approach to building impactful...From 50 to 500 product engineers – data-driven approach to building impactful...
From 50 to 500 product engineers – data-driven approach to building impactful...
 
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
Why is it so complex to accept a payment? by Dmitry Buzdin from A-Heads Consu...
 
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
Do we need DDD? by Jurijs Čudnovskis from “Craftsmans Passion” at Fintech foc...
 
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
Network security with Azure PaaS services by Erwin Staal from 4DotNet at Azur...
 
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
Using Azure Managed Identities for your App Services by Jan de Vries from 4Do...
 
SRE (service reliability engineer) on big DevOps platform running on the clou...
SRE (service reliability engineer) on big DevOps platform running on the clou...SRE (service reliability engineer) on big DevOps platform running on the clou...
SRE (service reliability engineer) on big DevOps platform running on the clou...
 
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
Emergence of IOT & Cloud – Azure by Narendra Sharma at Cloud focused 76th Dev...
 
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
Cross Platform Mobile Development using Flutter by Wei Meng Lee at Mobile foc...
 
Building resilient frontend architecture by Monica Lent at FrontCon 2019
Building resilient frontend architecture by Monica Lent at FrontCon 2019Building resilient frontend architecture by Monica Lent at FrontCon 2019
Building resilient frontend architecture by Monica Lent at FrontCon 2019
 
Things that every JavaScript developer should know by Rachel Appel at FrontCo...
Things that every JavaScript developer should know by Rachel Appel at FrontCo...Things that every JavaScript developer should know by Rachel Appel at FrontCo...
Things that every JavaScript developer should know by Rachel Appel at FrontCo...
 
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
In the Trenches During a Software Supply Chain Attack by Mitch Denny at Front...
 
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
Software Decision Making in Terms of Uncertainty by Ziv Levy at FrontCon 2019
 
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
V8 by example: A journey through the compilation pipeline by Ujjwas Sharma at...
 
Bridging the gap between UX and development - A Storybook by Marko Letic at F...
Bridging the gap between UX and development - A Storybook by Marko Letic at F...Bridging the gap between UX and development - A Storybook by Marko Letic at F...
Bridging the gap between UX and development - A Storybook by Marko Letic at F...
 
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
Case-study: Frontend in Cybersecurity by Ruslan Zavacky by FrontCon 2019
 
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
Building next generation PWA e-commerce frontend by Raivis Dejus at FrontCon ...
 
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
Parcel – your next web application bundler? by Janis Koselevs at FrontCon 2019
 
Managing State in React Apps with RxJS by James Wright at FrontCon 2019
Managing State in React Apps with RxJS by James Wright at FrontCon 2019Managing State in React Apps with RxJS by James Wright at FrontCon 2019
Managing State in React Apps with RxJS by James Wright at FrontCon 2019
 

Recently uploaded

JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 

Recently uploaded (20)

JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 

„OWASP Top Ten in Latvia“ by Agris Krusts from IT Centrs SIA at Security focused 64th DevClub.lv

  • 1. OWASP Top Ten in Latvia Most common web security problems Agris Krusts, IT Centrs, SIA 2018
  • 2. Who am I • Agris Krusts, founder of IT Centrs, security consultant • Managing pen-tes;ng engagements, pen-tests, security audits, training • E-mail: Agris.Krusts@itcentrs.lv • TwiCer: @agris_krusts • www.itcentrs.lv © Agris Krusts, SIA IT Centrs, 2018 2
  • 4. © OWASP Top 10 2017 4
  • 5. Data source • Pen-tests for last 2 - 3 years • ~ 130 systems • Usually test environments • According to appropriate OWASP TesBng Guide v4 control • Detailed staBsBcs shows only most "popular" problems • Comparing to similar data from 2011 - 2014 © Agris Krusts, SIA IT Centrs, 2018 5
  • 6. Excep&ons from OWASP Top 10 2017 • No stats for: • A8:2017-Insecure Deserializa;on • A10:2017-Insufficient Logging & Monitoring © Agris Krusts, SIA IT Centrs, 2018 6
  • 7. Injec&ons • Down from ~40% to less than 10% • S6ll majority is SQLi (7) • The rest: XML and code injec6ons © Agris Krusts, SIA IT Centrs, 2018 7
  • 8. Broken Authen,ca,on and session management Vulnerable systems Session fixa+on 11% Logout problems 15% Session +meouts 13% Bypassing authen+ca+on 18% Problems in password reset 7% Weak passwords 13% © Agris Krusts, SIA IT Centrs, 2018 8
  • 9. Broken Authen,ca,on and session management • Session fixa,on down from 30% to 11% • Missing Secure and HttpOnly down from 44% to 5% • S,ll some do not learn © Agris Krusts, SIA IT Centrs, 2018 9
  • 10. Sensi&ve Data Exposure Systems Browser caching 21% SSL problems 31% Sensi8ve informa8on over HTTP 10% © Agris Krusts, SIA IT Centrs, 2018 10
  • 11. Sensi&ve Data Exposure • SSL problems up from 27% to 31% • Sensi7ve informa7on over HTTP down from 40% to 10% © Agris Krusts, SIA IT Centrs, 2018 11
  • 12. XML External En--es • Separate category • Only couple in Latvia • Something like this ... <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///c:/inetpub/secret.xml" >]> <login> <username>&xxe;</username> </login> © Agris Krusts, SIA IT Centrs, 2018 12
  • 13. Broken Access Control Systems Directory traversal 1% Bypassing authoriza7on 9% Direct object reference 11% © Agris Krusts, SIA IT Centrs, 2018 13
  • 14. Broken Access Control • Authoriza+on problems in general down from 40% • Direct object reference down from 33% to 11% © Agris Krusts, SIA IT Centrs, 2018 14
  • 15. Security Misconfigura1on (most popular) Systems Pla$orm configura.on errors 17% Old backups and unreferenced files with sensi.ve informa.on 13% Accessible admin interfaces 9% No HSTS headers 26% © Agris Krusts, SIA IT Centrs, 2018 15
  • 16. Using Components with Known Vulnerabili6es 239 instances in 130 systems! © Agris Krusts, SIA IT Centrs, 2018 16
  • 17. Cross-site scrip,ng Systems Reflected XSS 21% DOM XSS 7% Stored XSS 18% © Agris Krusts, SIA IT Centrs, 2018 17
  • 18. Cross-site scrip,ng • Down from 46% for dynamic and 36% for stored • Less risk in dynamic because blocked by browsers • Higher risk because of data may travel across many systems © Agris Krusts, SIA IT Centrs, 2018 18
  • 19. © Agris Krusts, SIA IT Centrs, 2018 19
  • 20. © Agris Krusts, SIA IT Centrs, 2018 20
  • 21. Summary © Agris Krusts, SIA IT Centrs, 2018 21
  • 22. Number of issues A1: Injec*on 10 A2: Broken Authen*ca*on and session management 134 A3 Sensi*ve Data Exposure 89 A4: XML External En**es 2 A5: Broken Access Control 27 A6: Security Misconfigura*on 97 A7: Cross-Site Scrip*ng 59 A9: Using Components with Known Vulnerabili*es 239 © Agris Krusts, SIA IT Centrs, 2018 22
  • 23. • Web applica+ons are becoming more secure, at least some • Frameworks help • Some developers produce more secure code than others • Old problems, if exit, are more difficult to exploit • More problems in "new" technologies © Agris Krusts, SIA IT Centrs, 2018 23
  • 24. Thank You! Ques%on and answers! Agris Krusts, @agris_krusts, +371 29151412, www.itcentrs.lv 24
  • 25. Agris Krusts SIA IT Centrs E-mail: agris.krusts@itcentrs.lv Phone: +371 29151412 Twi$er: @agris_krusts www.itcentrs.lv © Agris Krusts, SIA IT Centrs, 2018 25