Securing computer applications and software is simply one of the most important stages of planning for development. After all, the level of usage is what determines success, and it reflects the number of active users in the app. There is no way you would refer about safety without referencing OWASP. The acronym OWASP is short for Open Web Application Security Project, which is an internationally recognized, nonprofit organization, focused on collaborating to strengthen software security around the world. OWASP is know for maintaining a OWASP top 10 vulnerabilities list, which is provided in detail below.
The group supporting the project is comprised of a range of web security experts from all around the world. They share their knowledge and experience about existing vulnerabilities, threats, attacks and countermeasures.
The idea is to gather the most important information that enables you to access security risks and ways to combat them effectively. It’s like betting experts, trying to condensate the knowledge they have about football teams’ performances. That way, they can predict who will flop and who will thrive and be potentially NFL MVP. The OWASP works the same way, to ensure the best practices for securing your software.
However, as every project, OWASP also has its own vulnerabilities. This list also shows its risks, impacts and countermeasures. Updated every three or four years, the last release was this year.
OWASP Top 10 Vulnerabilities
Injection
A code injection happens when a hacker sends invalid data to the web application with the intention of doing something different than what the application was designed/programmed to do. Perhaps the most common example around this security vulnerability is the SQL query that consumes untrusted data. Preventing code injection vulnerabilities really depends on the technology you are using on your site. For example, if you use WordPress, you can avoid code injection vulnerabilities by keeping only the minimum number of plugins and themes installed.
Broken Authentication
A broken authentication vulnerability could allow an attacker to use manual and / or automatic media to try to gain control over any account they want on a system – or even worse – to gain full control over the system. Websites with broken authentication vulnerabilities are very common on the web. Broken authentication usually refers to logical issues that occur in the application’s authentication mechanism, such as incorrect session management prone to username enumeration.
To prevent broken authentication from happening, do not make the administrators login page publicly accessible to all sites or IP addresses.
Exposure to sensitive data
Exposure to sensitive data is one of the most widespread vulnerabilities. It involves compromising data that should have been protected, such as passwords, credit card numbers or even health cards. It is vital for any organization to understand the importance of protecting user information and privacy. All companies must comply with their local privacy laws.
Avoid Data Exposure
There are several ways to avoid data exposure such as the three methods noted below.
- Make sure that strong, up-to-date algorithms, protocols, and standard keys are in place
- Use appropriate key management
- Disable response caching that contains sensitive data
XML External Entities (XXE)
Most XML parsers are vulnerable to XXE attacks by default. That is why the responsibility for ensuring that the application does not have this vulnerability lies primarily with the developer. To prevent this from happening, whenever it’s possible, use fewer complex data formats such as JSON and avoid serialization of sensitive data. Verify that XML or XSL file upload functionality validates incoming XML using XSD validation or something similar.
Broken Access Control
Occurs when there are internal references to objects (such as a file, folder, or registry) without access control that can be manipulated for unwanted access. To mitigate this risk, it is important to create indirect references to objects by user or session and to verify access from untrusted sources when using direct references. API rate limit can minimize potential damage.
Security Errors
Users may be able to perform unwanted actions for lack of correct security configuration. Automatic and periodic scans are useful for detecting missing updates, configuration errors, default account usage, etc. It is important to have a fast and effective process for deploying properly protected environments and keeping them up to date, with an architecture that offers secure separation of components.
Cross Site Scripting (XSS)
Exploitation of the XSS vulnerability makes an attacker able to insert malicious scripts into pages that would be trusted and use them to hijack users and administrators. Although the attack’s structure of operation is different, the spread is similar, a website link that is being attacked is prepared by the cybercriminal to perform malicious functions and is sent to the victims.
Always be aware when clicking on incoming links, even if the sender is a close acquaintance, before clicking make sure the link has no malicious content, such as having symbols along the address.
Unsafe Deserialization
Applications distributed with public listeners or applications that rely on maintaining client state are likely to allow serialized data tampering.
Do not accept serialized objects from untrusted sources or serialization that only allows primitive data types. If this is not possible, implement integrity checks or encryption of serialized objects to prevent hostile object creation or data tampering.
Another point is to isolate code that deserializes, such as those running in very low privilege environments or temporary containers. It is important to log de-serialization exceptions and failures. Restrict or monitor incoming and outgoing connectivity from containers or servers that de-serialize and, set alerts if a user is constantly de-serializing. Using components with known vulnerabilities
Insufficient Registration and Monitoring
Attackers can find vulnerable components through scanning or manual investigation.
Use tools for inventorying versions and dependencies of components (server-side and client-side). Monitor weaknesses in components from public sources such as NVD and use software for automatic investigation. It is also important to disable unused mechanisms and apply updates and patches from official sources that prevent vulnerabilities from being exploited.
Insufficient Logging and Monitoring
Inadequate failure logging, lack of alerts and locks allow the attacker to continue testing vulnerabilities until one is exploitable. Using widely used formats such as REST, GraphQL, JSON and applying the security mechanisms already mentioned to ensure secure communication, a strong authentication and access control scheme, and protections against all types of injections.
To learn more about vulnerabilities you can always search about OWASP.
| | | |
