Skip to main content

OWASP Top 10 2021

OWASP Top 10 2021

What is OWASP?
The Open Web Application Security Project, or OWASP, is an international non-profit organization dedicated to web application security. One of OWASP’s core principles is that all of their materials be freely available and easily accessible on their website, making it possible for anyone to improve their own web application security. The materials they offer include documentation, tools, videos, and forums. Perhaps their best-known project is the OWASP Top 10.

What is the OWASP Top 10?
The OWASP Top 10 is a regularly updated report outlining security concerns for web application security, focusing on the 10 most critical risks. The report is put together by a team of security experts from all over the world. OWASP refers to the Top 10 as an ‘awareness document’ and they recommend that all companies incorporate the report into their processes in order to minimize and/or mitigate security risks.

Below are the security risks reported in the OWASP Top 10 2021 report which is still a Draft:

OWASP Top 10 2021
  • A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
  • A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was a broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
  • A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
  • A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to "move left" as an industry, we need more threat modelling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
  • A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it's not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
  • A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
  • A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
  • A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
  • A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn't well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
  • A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it's not illustrated in the data at this time.

Popular posts from this blog

How to install Burp Suite Professional for free on Windows

How to install Burp Suite Professional for free on Windows As this is an illegal way to use Burp Suite I am not responsible for it. It is just for educational purpose information. Burp Suite is an integrated platform for performing security testing of web applications. It is designed to be used by hands-on testers to support the testing process. Here we will see how you can install it for free on your Windows 7/8/10 64-bit machine. Requirements:   Java JDK   Burp Suite Pro Zip   Burp Suite Latest Version After you have downloaded both the files, follow these steps: * Run the downloaded file JDK-13.0.2_windows-x64_bin.exe and let it install. * Search environment in the Windows search bar. You will see a match for Edit the system environment variables . Open it and then click the Environment Variables button at the bottom. You will see a window containing a part like this: Under the System variables tab, click New and add the following variables: Variable name: CLASSPATH Variable valu
Read more

CEH V11 vs CEH V10 Difference

 CEH V11 vs CEH V10 Latest Certification By EC-Council CEH V11 is recently introduced by EC-Council as the Latest Basic Certificate for Cyber Security As Certified Ethical Hacker V11. But many of you want to the Key difference between CEH V11 vs CEH V10. What are the changes are brought for the CEH V11?  Let's find out. CEH V11 has introduced with Adhering to their approach of thinking like a hacker, EC-Council is all set to launch the latest version of CEH: CEH v11, adding in the curriculum the latest advancements in the field of cybersecurity. Domains have been kept intact, but new segments have been introduced with the addition and removal of a few topics. The latest version will see the addition of OT Technology, Serverless Computing, WPA3 Encryption, APT, File less Malware, Web API, and Web Shell on the list. On the practical aspects, the OS used for labs includes Windows 10, Windows Server2016, Parrot Security, Windows Server2019, Android, and Ubuntu Linux. CEH V 11 will teac
Read more

MIUI 12 Theme Editor

Design Your MIUI 12 Themes With New MIUI Theme Editor For MIUI 12. Download New Version Here! Designing a User Interface is not an easy task to do. A person needs to have creativity in mind along with intuitive instinct to create a sleek UI design. Not all people are good at design. However, with just enough tools to use, anyone can now design their own theme bundling their own UI styles. You might have enough design skills and good art instincts. However, you won’t be able to manifest that design without a proper tool. Actualizing a design concept into a usable theme needs a certain level of coding skills. The MIUI Theme Editor allows you to customize almost any aspects of the MIUI user interface (UI). You can configure the general apps’ icons and system apps’ icons. You can also specify the default wallpaper image used within the theme. Furthermore, the lock screen and home screen areas are also customize-able. Even deeper, you can also adjust the appearance of all not
Read more

CEH V12 vs CEH V11 Difference

 The EC-Council update launched on 7th September 2022 from its predecessor version 11 Certified Ethical Hacker Version 12 (CEH v12) is now a more up-scaled and advanced version of EC. There are various changes made in the new version 12 in the Certified Ethical Hacker credential. Understand the Difference Between CEH V11 and CEH V12 The attack methodologies and lab techniques have been enhanced and are given a new boost. The CEH v12 is one of the most sought-after and desired programs globally based on information security. In this new version, 500+ new threats and vulnerabilities are included, which can help learners work with better skills and knowledge. Difference Between CEH v11 and CEH v12 CEH V11 CEH V12 Total Number of Modules 20 20 Total Number of Slides 1640 1676 Total Number of Labs 200 220 Total Number of New Labs 92 33 Attack Techniques 420 519 New Technology Added IoT Technology, Serverless Computing, WPA3 Encryption, APT, Fileless Malware, Web   API, and Web Shell MITRE A
Read more

SAST vs DAST

SAST vs DAST If you come across what is SAST and DAST. Than probably you are looking for application source code review. we will know what exactly SAST and DAST is and What’s the best approach for application security testing? The differences between SAST and DAST include where they run in the development cycle and what kinds of vulnerabilities they find. Learn why you need both. Recent high-profile data breaches have made organizations more concerned about the financial and business consequences of having their data stolen. They know they need to identify vulnerabilities in their applications and mitigate the risks. So they’re adding application security testing, including SAST and DAST, to their software development workflows.   What are SAST and DAST? SAST and DAST are application security testing methodologies used to find security vulnerabilities that can make an application susceptible to attack. Static application security testing (SAST) is a white box method of testing. It exam
Read more

How to Deploy Multiple Dist file to the Apache Server

How to Deploy Multiple Dist file to the Apache Server   To Deploy Multiple Dist file apache server the Easiest way i have describe below follow the instruction whether your project would be html, PHP or any dist file such as angular you can follow the below Steps. To Deploy any project to the Apache Server We have to make changes in 2 files and one folder. Follow the below process to Deploy the dist file. • Rename the dist file to the project name and copy the file to the Path /var/www/html/   • Make changes in the Index.html or Index.php by giving folder name in base href e.g., /foldername/ • Now Go to /etc/apache2/sites-available and make copy of 000-default.conf or any pervious file for example healthgiggle.conf Copy command cp -r healthgiggle.conf /etc/apache2/sites-available/pjname.conf • Now open the file in vi editor vi pjname.conf and make changes ServerName: Your project name which will appear in URL after main domain e.g., healthgiggle/projectname DocumentRoot: Path of the p
Read more

How to add ads.txt in Blogger

How to add ads.txt in Blogger when you get Earnings at risk – You need to fix some ads.txt file issues to avoid severe impact on your revenue. When you are Qualified for Adsense and you get a notification that Earnings at risk – You need to fix some ads.txt file issues to avoid severe impact to your revenue. To solve this problem Just Click On Fix Now or it will take you to the Site page. As you can See in the above image there is Download TAB just Click on that the ads.txt file will be downloaded automatically or  Click On Account  → Account Information you will get Publisher ID. Now Just Copy paste your Publisher ID in this format. google.com, pub-your ID, DIRECT, f08c47fec0942fa0 Now go to the Blogger settings page → Monetisation → Custom ads.txt Copy-paste  google.com, pub-your ID, DIRECT, f08c47fec0942fa0 over there and save it. To check whether you have added ads.txt successfully you can write your  https://yourdomainname.com/ads.txt it will reflect the same text in it if it fa
Read more

Odoo Interview Question answer

        Interviewing Odoo Question answer   Odoo is very specific software with very specific requirements. Odoo is ERP and Odoo developer should be an ERP developer.  ODOO , formerly known as  OpenERP  (Enterprise Resource Planning), is a platform that companies can  use  to easily manage the basics of the company such as materials and warehouse management, human resources, finance, accounting, sales and many other enterprise features. List of Things Every Odoo Developer Should Know The knowledge of Python itself. Before learning Odoo he must master the Python language. Besides, the knowledge of OOP and understanding of model-view-controller patterns are must-have, as these are strongly used by Odoo. Strong JavaScript skills. Even though, Odoo is “all in one”, modern browsers do not understand Python scripts. And frontend part is written on JavaScript. XML/HTML. This technology will be used more often than JavaScript. Odoo authors have done all they could to minimize y
Read more

Covid -19 latest Vaccine Dexamethasone passed by WHO

COVID -19 latest Vaccine Dexamethasone passed by WHO With global coronavirus cases crossing the 8 million mark, the need for an anti-COVID-19  vaccine becomes more urgent. Drug-makers and experts across the world are ramping up efforts to arrive at the potential vaccine against Covid-19. From experimental drug remdesivir making strides to generic steroid drug dexamethasone emerging as the first Covid-19 drug, the race to developing the antidote to Covid-19 is getting more interesting by the day. It Shows a significant result to ventilated patients also to cure the patients. There is significant global media attention on the spread of Coronavirus, which has led to justifiable consumer concern about the risks from COVID-19 and an ‘Infodemic’. Fears about the risks from this outbreak, and the scale of the public health challenge, have resulted in a significant increase in people seeking information about what to do to protect and prevent the virus. Consumers are searching
Read more

LOG4J VULNERABILITY ASSESSMENT AND MITIGATION

LOG4J VULNERABILITY ASSESSMENT AND MITIGATION What is Log4j?   Log4j, Zero-day exploit the popular Javalogginglibrarylog4j2 was discovered that results in Remote Code Execution (RCE) by logging a certain string.Log4j2 is an open-source, Java-based logging framework commonly incorporated into Apache webservers and Spring-Boot web applications. The vulnerability has been reported with CVE-2021-44228 against the log4j-corejar.CVE-2021-44228 is considered an acritical flaw, and it has a base CVSS score of 10, the highest possible severity rating. Who is Impacted !! Too many services are vulnerable to this exploit as log4j is a wild rang used  Java-based logging utility. Cloud  services like Steam, Apple iCloud,  and applications like  Minecraft have already been found to be vulnerable. Anybody using Apache frameworks services or any Spring- Boot Java-based framework applications that uses log4j2 is likely to be vulnerable. HOW THE EXPLOIT WORKS !!   The exploit works when there is a servic
Read more