OWASP Cloud-Native Application Security Top 10 OWASP Foundation

The pulse of release at every 3 years balances the speed of change in the application security market to confidently generate recommendations so that it doesn’t reflect short-term fluctuations. Injection is a broad class of attack vectors where untrusted input alters app program execution. This can lead to data theft, loss of data integrity, denial of service, and full system compromise.

These types of vulnerabilities can result in unauthorized changes to data or software execution paths. Several tools can used to analyse dependencies and flag vulnerabilities, refer to the Cheat Sheets for owasp top 10 proactive controls these. It is important to protect data both at rest, when it is stored in an area of memory,
and also when it is in transit such as being transmitted across a communication channel or being transformed.

What is the OWASP Top 10 and why does it matter?

This way you can be sure that you have someone who will keep a watchful eye on everything that cannot be found automatically and will be using top-class software to cover everything that can be found automatically. It covers all the vulnerabilities that ultimately surface due to the designers of the software not taking security into account. This involves insecure code or data handling, leading to potential manipulation and untrusted information within the software lifecycle. Injection moved down from the number 1 spot in 2017 and added cross-site scripting as a part of the category. Injection flaws happen when data from unverified sources is relayed to an interpreter as an element of a command or query. It potentially deceives interpreters into performing commands that were not intended, or gaining access to restricted information.

The OWASP Top 10 list of security issues is based on consensus among the developer community of the top security risks. The list explains the most dangerous web application security flaws and provides recommendations for dealing with them. The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. As organizations navigate an evolving and threatening digital landscape, it’s critical that we understand the potential security risks. The OWASP Top 10 servers are a vital guide to identifying, understanding, and mitigating these risks. It reflects the changing threat landscape and highlights the need for constant vigilance and adaptation in the face of emerging threats.

OWASP Top 10: Server Side Request Forger

A vulnerability finding from a legacy SAST tool cannot be used to appropriately understand the risk. See above for an example of how a SQL injection vulnerability must be put into context. In cloud-native applications, code and risks are distributed across applications and infrastructure in development and at runtime. It is no longer enough to identify an input validation vulnerability or a cloud misconfiguration. The OWASP Top 10 has been an essential guide for Application Security professionals since 2003 – and continues to be!

Fetching a URL has become a common scenario for modern web applications and as a result the incidence of SSRF is increasing,
especially for cloud services and more complex application architectures. Unfortunately, while several broken access control vulnerabilities like path traversal or open redirect can be discovered by Acunetix, many others are business logic vulnerabilities that cannot be spotted using any automatic tools. For example, the tool has no way to know whether a certain function in the software is intended to be used only by privileged users. Therefore, to cover this Top 10 item, you need to do manual penetration testing in addition to your automatic scans. Developers must be encouraged to internalize “security first” discipline to avoid pitfalls, such as content management systems (CMS) that generate all-access permission by default (up to and including admin-level access).

Vulnerable and Outdated Components

Many smaller businesses would struggle with this and would therefore abandon the idea of keeping their web applications secure. The OWASP Top 10 shows that this is not a simple task and just hiring a “security guy” will not help at all. While you may want to do additional penetration testing for the most elusive types, which are very unlikely to be found, our software can discover even the more obscure injections such as blind SQL injections or DOM-based XSS. What it means to you is that you should not perceive the OWASP Top 10 as just a simple “checklist of what to look for”. Instead, you should use it as a backbone of your web application security strategy in general.

There are 125k records of a CVE mapped to a CWE in the NVD data extracted from OWASP Dependency Check at the time of extract, and there are 241 unique CWEs mapped to a CVE. 62k CWE maps have a CVSSv3 score, which is approximately half of the population in the data set. We spent a few months grouping and regrouping CWEs by categories and finally stopped.

While tools such as Acunetix can help you cover the basics in this category, no automated tool can guess whether a certain piece of information is sensitive or not. For example, if you accidentally expose financial information, to an application such as Acunetix these are just numbers, only a human would know that these numbers should not be readable by everyone. Therefore, to cover A02, again you must complement automatic scanning with manual penetration testing. Broken access control means that a malicious user is able to access a function that should not be accessible to them.

• However, we believe that the COVID-19 pandemic and the resultant shift to remote work is the primary cause of this improvement.
• But with the rise of cloud-native applications, we need to change our approach to application security – not to the Top 10 itself, but how we understand and remediate Top 10 vulnerabilities.
• Grouping by  Root Cause
   or  Symptom
   isn’t a new concept, but we wanted to call it out.