Hello Everyone,
I hope you are all doing well!
Today, we are embarking on an exploration of security vulnerabilities—a crucial aspect as we strive to blend the principles of clean code and design to create optimized and maintainable code. With the IT industry's growth, cybercrimes and fraud are also on the rise, leading to significant financial losses worldwide.
In today's session, we will introduce the concept of the OWASP Top 10 vulnerabilities, a critical list that identifies the most prevalent security threats. Understanding these vulnerabilities will enable us to avoid incorporating vulnerable code during the initial development phases.
Furthermore, I am excited to announce that this discussion will kickstart a series where we’ll dive deep into each vulnerability detailed in the OWASP Top 10. We'll discuss the nature of these vulnerabilities, their potential impacts, and most importantly, the best practices and remediation strategies to mitigate them.
Let’s enhance our knowledge and fortify our development practices together. Let's get started.
Introduction
The Open Web Application Security Project (OWASP) is a non-profit organization dedicated to improving the security of software applications. Every few years, OWASP releases a list of the top 10 most critical security risks for web applications, known as the OWASP Top 10. The 2021 edition of the OWASP Top 10 has been released, highlighting the most prevalent and dangerous vulnerabilities that developers and security professionals should be aware of.
Importance
The OWASP Top 10 is a crucial resource for anyone involved in web application development and security. It provides a comprehensive overview of the current threat landscape, helping organizations prioritize their security efforts and allocate resources effectively. By addressing the vulnerabilities listed in the OWASP Top 10, organizations can significantly reduce their risk of security breaches and data loss.
Why is it needed?
As technology evolves, so do the tactics and techniques used by cybercriminals. The OWASP Top 10 is periodically updated to reflect these changes and provide the most relevant and up-to-date information on web application security risks. By staying informed about the latest threats, organizations can take proactive measures to protect their applications and data from malicious actors.
Financial Consequences of Cyber Attacks
The financial impact of cyber attacks in the context of the OWASP Top 10 vulnerabilities is profound. These substantial losses can generally be attributed to several critical factors:
Ransomware Payments: High costs incurred from payments to regain access to encrypted data or systems.
System Downtime: Loss of revenue due to halted or reduced operational capacity.
Data Breach Costs: Expenditures related to the investigation, remediation, and legal consequences of breaches.
Reputation Damage: Reduced customer trust and business resulting from breaches and attacks.
Increased Insurance Premiums: Higher costs for cybersecurity insurance following an attack.
Regulatory Fines: Financial penalties associated with non-compliance to data protection and privacy laws.
Top 10 Web Application Security Risks
What has changed from 2017 -> 2021
There are three new categories, four categories with naming and scoping changes, and some consolidation in the Top 10 for 2021.
Application
A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category.
A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was a broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography, which often leads to sensitive data exposure or system compromise.
A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site scripting is now part of this category in this edition.
A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures.
A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.
A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but it also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category that does not have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.
A09:2021-Security Logging and Monitoring Failures were previously Insufficient Logging & Monitoring and are added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above-average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
Conclusion
Addressing the OWASP Top 10 vulnerabilities is crucial for enhancing web application security. By integrating these security measures early in development, developers can safeguard applications from potential threats, protect businesses from financial losses, and foster a culture of security. Let's prioritize these practices to ensure a safer digital environment for all.