OWASP OWASP top 10 - Agenda Background Risk based Top 10 items 1 – 6 Live demo Top 10 items 7 – 10 OWASP resources
OWASP The OWASP Guide
OWASP Threat Agent Attack Vector Weakness Prevalence Weakness Detectability Technical Impact Business Impact ? EasyWidespreadEasySevere ? AverageCommonAverageModerate DifficultUncommonDifficultMinor
OWASP Warning Risk analysis Insiders Architecture Modular Clarity SDLC Knowledge Predictability
OWASP Top Injection 2.Cross site scripting (XSS) 3.Broken authentication and session management 4.Insecure direct object reference 5.Cross site request forgery (CSRF) 6.Security missconfiguration 7.Insecure cryptograpic storage 8.Failure to restrict URL access 9.Insufficient transoport layer protection 10.Unvalidated redirects and forwards
OWASP A1 – Injection ClientAppl DB Shell PgmCPU
OWASP A1 – Injection String query = "SELECT * FROM accnts WHERE ID='" + request.getParameter("id") +"'"; id="foo';DROP accnts;--" SELECT * FROM accnts WHERE ID='foo';DROP accnts;--'; id="foo" SELECT * FROM accnts WHERE ID='foo';
OWASP A2 - Cross site scripting (XSS) Browser ApplDB
OWASP A2 - Cross site scripting (XSS) (String) page += " "; CC= "> window.location= x=document.cookie window.location= '> CC=“ "
OWASP A2 - Cross site scripting (XSS) < < < C; \x3c \x3C \u003c \u003C < %3C < < < < < < < <img src= onmoseover= <body onload=
OWASP A3 - Broken authentication and session mngmnt Unpredictable passwords, sessions-ID, security- questions No sessions-id/credentials i URL Avoid session-fixation Time out of sessions & logout buttons Different sessions id outside/inside TLS No clear text passwords
OWASP A4 - Insecure direct object references 2010q1 2011q2 period=2011q3 period=2011q2
OWASP A5 - Cross-site request forgery (CSRF)
OWASP A6 - Security missconfiguration Patching OS Application Frameworks / libraries Disable unnecessary services Stack traces Configuration
OWASP A7 - Insecure cryptographig storage Keep track on sensitive data Password one-way-hashed & salted Password/Key management TLS key pass phrase M2M lösenord (obfuscation)
OWASP A8 - Failure to restrict URL access /user/getAccounts /admin/getAccounts
OWASP A9 - Insufficient transport layer protection Use SSL/TLS No mixed content Use secure cookies Example FireSheep exploits poor solutions
OWASP A10 - Unvalidated redirects and forwards ks.com ks.com %65%2E%63%6F%6D %65%2E%63%6F%6D
OWASP OWASP resurser OWASP Secure Software Contract Annex OWASP Secure Software Contract Annex OWASP Developer’s Guide OWASP Developer’s Guide OWASP Enterprise Security API (ESAPI) OWASP Enterprise Security API (ESAPI) OWASP Software Assurance Maturity Model (SAMM) OWASP Software Assurance Maturity Model (SAMM) OWASP WebGoat OWASP WebGoat