Are you brainstorming to understand or find what are/can be the biggest cybersecurity risks, it can be confusing? You can find many resources to explore, there is one particular one called OWASP, about which you might have heard and known a bit also. So, let’s just break down to know why it is needed and what it is enclosed with.
Open Web Application Security Project, is a non-profit foundation that focuses on improving security for businesses, customers, and developers, through dozens of open-source projects, collaboration and training opportunities. And in 2021, it has enabled professionals to come together to work toward a greater goal of improving application security update for the first time since 2017.
The risk severity assessments do not take into account the business consequences of their implementation. And it is possible, the names of the risks in the rating, correspond to the names of the similar vulnerabilities in the Common Weakness Enumeration (CWE) classification. Therefore, unlike the classifications, the OWASP Top 10 project does not claim to cover all the existing risks, but only represents the most relevant ones at the time of the rating release.
OWASP Top 10 Vulnerabilities:
Broken Access Control – moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category.
Cryptographic Failures – The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise and it has shifts up one position.
Injection – 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. And now it is scripted as cross-site and slides down to the third position.
Insecure Design – focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks. And this is a new category for 2021.
Security Misconfiguration – 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up.
Vulnerable and Outdated Components – is a known issue that we struggle to test and assess risk previously. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
Identification and Authentication Failures – This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
Software and Data Integrity Failures – focus on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity.
Security Logging and Monitoring Failures – This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
Server-Side Request Forgery – The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.
