Hello and welcome back.
We're going to talk about OWASP Top
10 Proactive Controls and Vulnerabilities.
Basically, we're going to do an overview
of the OWASP Top 10 Proactive Controls,
and this is a list.
Basically, a document that the OWASP group has created.
It's a starting point for developing secure software.
It has a focus on defensive mechanisms and controls.
Then, we're going to talk about the OWASP Top 10 Project,
which is a list of
the top 10 vulnerabilities for a particular year.
It helps to identify
the most serious security risks for web applications.
Now I'd like to note that the contents of
this presentation are based on the OWASP Top 10,
and this work is under
the Creative Commons Attribution-ShareAlike 3.0 License.
After this lesson, you will be able to locate and examine
existing best practices for web application security.
Great, so let's gets started.
The OWASP Top 10 Proactive Controls are controls and
recommendations to apply during
the software development lifecycle.
I'd like to point out that it's only a starting point,
but it's still good starting,
still good place to start.
It gives us an awareness of various things that
we should perform during
the software development lifecycle,
in order to improve our application security.
But not only do you want to use
the OWASP Top 10 Proactive Controls,
you also want to include in
your software development lifecycle,
some verification standard for testing security controls.
An example of a verification standard is the OWASP ASVS.
ASVS stands for
Application Security Verification Standard.
In addition, you would want to
continually improve your processes,
by using a set of activities that
examines your software development lifecycle.
For example, you could look at
the recommendations from the OWASP SAMM,
S-A-M-M, and it stands
for the Software Assurances Maturity Model.
Or you could also examine the BCMM which
stands for Building Security and Maturity Model,
and it's a survey that is
performed across many companies,
and it tells you the current
software security practices that's
common amongst those that have been surveyed.
It allows for you to get a general sense for
how your security practices in
your company fare against what's been surveyed.
The idea in this lesson is that we are going to highlight
the mapping between the suggested control
or defense technique,
from the OWASP Top 10 Proactive Controls,
to the particular security weakness
or general weakness that's being addressed.
Now, let's move on to
the OWASP Top 10 Proactive Controls.
The first one is control one.
We want to define security requirements,
and we want to do this right
at the beginning before we do
any actual application development.
Defining security requirements is done as
close to the beginning of the lifecycle as possible,
and you want to iterate this process when
some new changes are
added to your application specification.
The goal of this is to define
a set of security requirements,
such that you are able to
create new security features that
will address the current vulnerabilities
in your application design.
This control prevents many vulnerabilities,
and is a broad recommendation that
will help prevent lots of different things.
The next thing we're going to
talk about is controlled two,
which is leveraging security frameworks and libraries.
Basically, this means, we want to use
existing tried and proven security frameworks or
libraries because it helps us as developers
to ramp up our web application security improvement,
and we don't have to do anything from scratch.
Other people have used
these frameworks or libraries before,
so we know that it's been tested.
This control also prevents many types of vulnerabilities.
The next thing we're going to talk
about is control three,
which is to secure database access.
The idea here in general,
is to make sure that any
database access that you are
using a secure in several ways.
The first way is to perform
database queries in a secure way.
For example, we don't
want to trust any queries that have been
generated using user input because
that would lead to SQL injection vulnerabilities.
The next thing that you want to make sure what
to do when you want to secure your database,
is to set up your database with secure configurations.
The reason why is because they don't normally
come secure by default out of the box.
You have to make sure that
with the particular database that you're using,
you understand what configurations
need to be locked down.
In general, you want to harden
your database configuration before using it.
The next thing you want to do,
is to set up secure authentication and
secure communication between
your application in your database.
This helps to mitigate injection vulnerabilities as
well as vulnerabilities related to authentication issues.
The next OWASP Top 10 Proactive Control is control four,
which is to encode and escape your data.
This is a defensive technique to
help prevent injection attacks.
We're going to go over
more detail on this in a later module.
But, this addresses injection
in cross-site scripting vulnerabilities.
The next proactive control, control five,
is that you want to make sure you have in your checklist,
is to validate all of your inputs.
Effectively you only want to
process properly formatted data.
But, make sure that validating all of
your inputs is not the only thing that you are using,
in order to create defenses in your application.
Validating all inputs has to also
be done along with other defenses like,
query parameterization in data escaping,
which we'll talk about in a later module.
The reason why we want to validate all our inputs,
is because it helps us to reduce
the attack surface of our web application.
This means then that the attacker
has to work a lot harder,
in order to exploit any weaknesses in our application.
Let's take a break and continue on,
with control six when we come back.