Hello and welcome back. We're going to talk
about OWASP Top 10 Proactive Controls
and Vulnerabilities. Basically, we're going
to do an overview of the OWASP Top 10
Proactive Controls. This is a list, basically a document that
the OWASP group has created. It's a starting point for
developing secure software. It has a focus on defensive
mechanisms and controls. Then, we're going to talk about
the OWASP Top 10 Project, which is a list of the Top 10 vulnerabilities
for a particular year. It helps to identify the most serious security risks
for web applications. Now, I'd like to note
that the contents of this presentation are
based on the OWASP Top 10. This work is under the Creative Commons
Attribution-ShareAlike 3.0 License. After this lesson, you will
be able to locate and examine existing best practices for
web application security. Great. So let's get started. The next proactive
control is control six which is to implement
digital identity. What this means is to set up a proper authentication system, and we want to make sure we understand different levels
of authentication. A good place to read about
that is a NIST 800-63b, Authentication Assurance
Level document. Effectively, in this document, there are three
authentication levels. The first level is to secure data that is low sensitivity. You can get away with securing it with a password only
authentication mechanism. But then, when you get to an authentication
level of level two, so a slightly more sensitive type of data that you're
trying to protect, you want to use
multi-factor authentication. An example of this is setting up duo 2FA for your web application. When you get up to the highest
type of sensitive data. So this is data for example, if this data was
compromised could lead to a loss of life or some sort of
very critical issue. You would want to use a crypto based authentication using
hardware crypto modules. This control addresses
the issues of broken authentication
and session management. This is a topic that we will get into further
in a later module. The next control
is control seven, which is to enforce
access controls. What this means is we want
to manage the privilege of using a set of resources
that a system provides. Note that access control is not the same as authentication. This is because authentication
answers the question; who is it that can
access the system? Are you really the
person you say you are? Authorization answers
the question; what are you allowed to access, now we know you as
an authenticated entity? Various access control
design methods exist. For example, discretionary
access control, mandatory access control,
role based access control, and attributed
based access control. Now, in general, with this sort
of proactive control, you want to keep
in mind that idea of the principle of
least privilege. What this means is to only
allow just enough access and privilege to resources that a particular user type
is allowed. You don't want to give more
than what is required for the entity or person
to perform their job. This proactive control addresses issues with broken
access controls. The next control is control eight which is to
protect data everywhere. In order to start
protecting data everywhere, you need to be able to classify the kinds of data that you have. Once you classify your data based on how sensitive each kind is, then you're able to
create strategies for implementing protections
for that data. In general, we want to encrypt our sensitive data
while in transit. So that means data going
from one process to another and also encrypting
our data at rest. We also want to keep
application secrets secret. Things like private keys to
repositories API keys, etc. You can do this by using, for example, a secrets vault
like HashiCorp Vault. This proactive control
protecting data everywhere addresses the issue of sensitive data exposure. The next proactive control
is control nine, which is to implement
security logging and monitoring. The idea here is to
basically follow a common logging format and also to log just
enough information for it to be useful for
a particular scenario. Here, at least log
the timestamp, user ID, the resulting output, but do not log any private
or confidential data. Also, you want to make sure
that the timestamps that you are logging are consistent
across your systems. Make sure, for example, that all of your hosts
are using UTC timestamps. Next, you want to be able to
set up your logging systems such that you are forwarding your logs to a central service. This is in order to
prevent any issues with log integrity and issues with
data loss with your logs. This proactive control
of security logging and monitoring addresses
the needs that you would have or your team
would have during an intrusion detection analysis and during security
investigations. It also addresses
the need that your team would have during
regulatory compliance. Last but not least, we're
going to talk about C10, the proactive control of handling all errors and exceptions. In general, what you want
to do here is to make sure that the user displayed
error messages that you have, don't leak any sensitive data. We also want to make sure
that we're logging exceptions such that any analysts that
are on your team or QA, for example, have enough information
in order to understand particular issues related to the exception that
you have logged. This proactive control
of handling errors and exceptions addresses information leakage issues and potential denial
of service issues. Now, that we've talked about the OWASP Top 10
Proactive Controls, I'm going to now talk about
the OWASP Top 10 Project. Remember, how when we looked at the OWASP Top 10
Proactive Controls, it was a set of
defense controls and recommendations to
perform in order to address certain
vulnerabilities or vulnerabilities and
weaknesses in general. What the OWASP Top 10 Project
gives us is a set of security weaknesses that
the security community has seen and want to
raise awareness on. This set of Top 10
Vulnerabilities can map back to
our Top 10 Proactive Controls. This OWASP Top 10 Project which is a set of
security weaknesses also talks about
the recommendations for fixing these 10
security weaknesses. This information also gives us additional guidance for improving our
application security. Now, with that said, OWASP Top 10 Application Security
Risks that we have, there's 10 of them. Particularly, for 2017, the
top three are injection, broken authentication, and
sensitive data exposure. These top three are going to be the main focus that we will
have for future lessons. I want to point out
that I've included Cross-Site Scripting
into our topic on injection vulnerabilities
for this particular course. There are two reasons. The first reason is that Cross-Site Scripting is a type of injection vulnerability, as mentioned in
the OWASP Project website. The second reason is that
because we are focusing on the top three particular
vulnerabilities from the OWASP Top 10 Application
Security list in 2017. Cross-Site Scripting is number
seven this year of 2017. However, it's also true
that Cross-Site Scripting has been consistently in
the top three since 2014. So from 2014 to 2016. It's good to be aware of Cross-Site Scripting
even though it's not listed in 2017 as
being in the top three. To wrap up, we've now covered
the general information contained within the OWASP
Top 10 Proactive Controls. This OWASP Top 10
Proactive Controls is a document that you can look up online in the OWASP
group's website. The same goes for the
OWASP Top 10 Project, which is a set of
security weaknesses. That is also a document
that you can look up online on the OWASP website. Now, the OWASP Top 10
Proactive Controls is a good starting point
of controls and recommendations on improving the security in our software. We also introduced
the general security weaknesses that we will be covering in
the next several modules.