OWASP Top 10

 OWASP Top 10

1. Broken Access Control : Occurs when unauthorized access to resources is mistakenly allowed .
1. Common causes include human error such as 
1. unprotected sensitive data, 
2. lack of system isolation, 
3. Misconfigured systems
2. To avoid this risk, implement:
1. Formal threat modeling
2. Cover access control in use case testing
3. Use secure configuration for deployment 
4. Design for error by anticipating mistake and reducing their impact.
2. Cryptographic failures : Can compromise confidentiality and integrity of data.
1. Common Causes :
1. Misconfigured system
2. Use of insecure protocol
3. Leaking cryptographic secrets
4. Using outdated or weak cryptographic algorithms.
2. To prevent this:
1. Implement Threat modeling
2. Safeguard private keys
3. Use encryption for data at rest and in transit
4. Use only approved cryptographic libraries and configurations.
3. Injection: is the misuse of external inputs that manipulates the application to behave insecurely.
1. Causes :
1. Insufficient human input validation
2. Failure to identify potential injection sources
2. To avoid:
1. Perform threat modeling
2. Treat all external applications/inputs data as harmful.
3. Perform regular penitent including fuzzing techniques.

4. Insecure Design: is the failure to incorporate Security in all stages of a project.
1. Common Causes:
1. Neglecting security considerations at various point of development process.
2. Inadequate security awareness.
2. Risk
1. Inability to pass security standards and expensive rework
3. To avoid this
1. Implement formal threat modeling
2. Develop a security mindset
3. Continuously learning and apply security knowledge 
5. Security misconfiguration: occurs when security measures are rendered ineffective due to incorrect deployment.
1. Common causes:
1. Failing to use secure configuration
2. Not reviewing configuration defaults
3. Assuming hidden applications as secure.
2. To mitigate this:
1. Conduct authorized penetration test against production deployments
2. Follow a consistent security review process
3. Use only third party components that have independent security validations
6. Vulnerable and outdated Components : can expose systems to risk.
1. Common causes
1. Assuming someone else is taking security actions
2. Underestimating the risk of unpatched systems 
3. Lack of dependency and version management
2. To avoid:
1. Follow a continuous software update process
2. Use well documented management processes
3. Actively monitor for security vulnerabilities news bulletin 
4. Perform regular pen test
7. Identification and Authentication failure: occurs when system mis identifies an actor and grants improper privileges.
1. Common causes:
1. Misconfiguration
2. Insecure session management 
3. Using simple and spoofable authentication mechanisms 
2. To avoid :
1. Perform proper threat modeling
2. At least Two factor Authentication 
3. Use approved SSO integrations
8. Software and data integrity Failure : occurs when unverified data and software are deemed trustworthy
1. Common causes
1. Trusting unverified data
2. Failing to ensure limited access for personnel to change the data or code
3. Related cryptographic failures
2. To Prevent:
1. Verify the Authenticity of all code and data
2. Do not rely on implicit trust
3. Use trusted public key infrastructure for data and code signing
9. Security Logging and Monitoring Failures : can leave malicious attacks undetected 
1. Common causes:
1. Misunderstanding of sufficient details required for forensic investigations 
2. Selective logging
3. Insecure storage
4. Transport of logs
2. To avoid this:
1. Log all accessed resources
2. Map actions to data for better traceability 
10. Server side request forgery: manipulating remote resources to make requests on behalf of an attacker
1. Common causes:
1. Processing data from insecured resources
2. Misconfigured middleware
2. To avoid:
1. Sanitize all data inputs
2. Use Strong authentication and Authorization for all endpoints 
3. Scan middleware regularly for any mis configurations