OWASP Top 10

Staying on top of the top concerns

There's been a lot of changes throughout my career in IT, and things are changing more and more rapidly, and that's true for our top concerns as well. There are things that go out of style or stop working, or maybe just are not as prevalent out there, and other things become more of a concern. So what we can do is we can stay on top to make sure that we understand what the top concerns are from a cyber security standpoint and what we should be keeping our eyes on. One of the things that helps us do that is the OWASP Top 10.

What OWASP is

Here I'm on the owasp.org site. Let's take a look at the about page and see what OWASP is all about. OWASP stands for Open Worldwide Application Security Project. So what does that mean?

Well, open: the first thing is that this is open source, which means that it's freely available for anybody that needs access to it. It's worldwide, so it's not really meant for any one nation. It's meant for application security, so a big part of this is how do we keep our applications secure. A lot of web developers need to be concerned about this, and a lot of people who are managing those services need to be concerned. And it's a project, and so the project is to put together a lot of resources for us to make sure that our organizations are secure, especially if we're developing some sort of application.

If we scroll down, their vision is quite clear: no more insecure software. The mission: to be the global open community that powers secure software through education, tools, and collaboration. Sounds like the type of site we should be familiar with.

The Top 10

What we're most concerned with is this OWASP Top 10. If we scroll through here, these are all the top 10 web application security risks that we have. This helps us really analyze our systems and see if we have those security risks with our systems.

You can see that they also update it. In fact, they're coming out with a new one here real soon. So we've got 2017 here, and they had a certain order for it, and then they redid it to 2021, and this is the 2021 order. And it's labeled here, A01, A2, A3, A4. So we can see that the first one is broken access control, the next one's cryptographic failure, the next one's injection. And we see that in 2017, injection was the number one concern, and that's dropped down to number three on our list now. And then we'll see when 2025 comes out, which should be out any time now, we'll see where it is at, if injection has changed at all, if that type of risk has changed at all, that weakness has changed at all.

Inside the injection entry

What we can do is we can open some of these up and take a look at what's inside and what we find on each one of these. So this is the broken access one, and I can open that up, or injection attack. That should definitely be one we're familiar with, so I'm going to open up an injection attack. Let's take a look at that one first.

Here's the information on injection. What we see here is that there are some mapped CWEs, so that's the common weakness enumerations. We'll take a look at that, because there's 33 that's mapped to this particular one. We also see the average incident rate: so out of a hundred that's tested, about 3% of those are found to have this weakness to it, so that's quite high. In fact, it has 274,000 occurrences of this weakness out there of the sites that are being tested, so there's a lot of sites out there that are vulnerable to this weakness.

It gives a description of what it is, ways to prevent this weakness, gives some example scenarios here, and then also a list of mapped CWEs. So we can actually see the common weakness that's associated with this. One of them, which is the basic cross-site scripting, we can open that up and take a look at the basic cross-site scripting and see what that one is about.

So essentially what we're actually looking at here is really more of a category. This is a category, but that's been rated in a scale of 1 to 10. This is number three in that rating, so number three, we need to watch out for injection attacks. And what do we need to watch out for? Well, we see these common weakness enumerations down here. This is the stuff that we need to watch out for and be cautious of, understand what our vulnerabilities could be and our weaknesses could be.

The rest of the list

I'm going to pop back over to this site here where we see the other ones. We've got broken access control, cryptographic failures, injections, insecure design, security misconfigurations, vulnerability and outdated components, identity and authentication failures, software and data integrity failures, security logging and monitoring failures, and server side request forgery.

Now, most of these are mapped to a lot of different CWEs. Let's take a look at this server side request forgery. So I open this up, and we can see it's only mapped to one. It's the only one out of that list that is only mapped to one CWE. So just realize that some of them are just a single weakness and some of them are mapped to multiple weaknesses.