What are the OWASP Top 10 - 2017?

A1:2017 - Injection

Injections arise from the processing of untrusted data by an application. This data was either not validated and handled, or handled insufficiently. In the past, SQL Injections were frequently exploited; however, other injections, such as those against LDAP directories or the operating system, must also be considered.

A2:2017 - Broken Authentication

Authentication is the process in which a user proves their identity to an application. Failures here can allow attackers to misuse identities and impersonate another user.

A3:2017 - Sensitive Data Exposure

Inadequate protection of sensitive data has led to severe incidents in the past. In 2016, Yahoo had to admit to having lost 3.5 billion user data records, which included weakly hashed (MD5) passwords. Due to insufficient protection, billions of password combinations and other sensitive information, such as bank and credit card data, were exposed.

A4:2017 - XML External Entities (XXE)

The XML standard allows external data to be loaded into an XML document. Those who do not consider this when processing these documents risk unauthorized command execution, leakage of internal information, or denial of service.

A5:2017 - Broken Access Control

If access management is not stringently implemented, users can access data that has not been released to them. When designing an application , it is therefore mandatory and clear to define how users authenticate themselves to an application ( A2:2017 ) and, in the subsequent step, once the identity has been established, what the user is authorized to do.

A6:2017 - Security Misconfiguration

Errors in the configuration of systems such as firewalls, web servers, or web applications can have far-reaching consequences. Possible cases range from the disclosure of sensitive information and unauthorized system access to denial of service .

A7:2017 - Cross-Site Scripting (XSS)

Certain characters must be passed to the browser as special characters; otherwise, the browser interprets them as commands. Those who fail to master so-called output escaping risk Cross-Site Scripting , which allows attackers to potentially steal cookie information or deface pages .

A8:2017 - Insecure Deserialization

In serialization, complex data structures are converted into a sequential character string. The reverse process – deserialization – can be exploited to execute foreign commands.

A9:2017 - Using Components with Known Vulnerabilities

In today's world of frameworks and software libraries, developers very often use third-party code. While this offers efficiency and security advantages, it can equally become a gateway for hackers. Once security vulnerabilities in software components become known, an update must be provided immediately. Awareness and the use of secure components represent a major challenge.

A10:2017 - Insufficient Logging & Monitoring

Logging and the analysis of this data represent the most important way to detect an attack on one's own systems. Similarly, application errors during operation must be logged and communicated to the responsible parties.