Technology improves overtime, and it also means things are changing. The OWASP Top 10 received changes in 2021, where there were new categories, including some that went down and up as more critical to the cyber security world. This article will explain all the changes in the OWASP Top 10 2021 and what does it have to do with you?
What is the OWASP Top 10?
The OWASP Top 10 is a ranking of vulnerabilities that can be found in web applications. The rank in the OWASP (Open Web Application Security Project) Top 10 are ranked based on the recurrence of the problems encountered by testers and so on. Applying all the vulnerabilities on the OWASP Top 10 is important for a company, developer, or organization to assess the web application from risks.
Vulnerabilities on the OWASP Top 10 do not only impact the cyber security or technology world. Businesses, either small or big can also be impacted since technology is part of people’s life nowadays. Due to the technology improvement, the OWASP Top 10 is always being updated for three or four years to give the needed-new knowledge. But the OWASP Top 10 is not the only thing that got advanced with the technology, so does the hacker. With the help of improved technology, hackers will upgrade their skills too, so the rank of OWASP Top 10 will always get updated.
In 2021, the OWASP Top 10 released its newest rank, with changes in four categories, three new categories, and so on. Here is a new rank of the OWASP in 2021:
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identifications and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery
The OWASP Top 10 2021 Explained
- Broken Access Control
This section talks about data control by the system. For example, the login page of a certain social media may actually be able to do function B, but normal users can only access function. A good hacker might be able to bypass the protection and gain access control as the administrator and have all the access unlocked with all their privileges.
Broken Access Control problems can be prevented by applying tight control for authorization, always checking people’s activities on the server, minimizing any privilege in the server to decrease the risk, and so on.
- Cryptographic Failures
Cryptography is a bunch of codes that are protecting important data like passwords or credit card information. But like other technology, cryptography has flaws. When information like passwords are being stored and the extra protection is outdated and experiencing problems, then this sensitive information will be leaked, which will cause many problems and the company will lose the trust of its users.
This problem can be solved by frequently updating the encryption, disabling the caching on data-collection, encrypting all the data no matter where they are, and turning off autocomplete.
- Injection
Like its name, injection is the situation when the attacker injects special characters into the interpreter (SQL). This action will result in the application doing something that it is not meant to, like opening the database access or granting a special command to the attacker.
There are many ways to prevent an application from being attacked by injection, one of them is by minimizing the information that the attacker can expose with injection, or implementing a function that makes it impossible to do SQL injection.
- Insecure Design
This problem causes by problems in the web application design, which might include zero threat modeling, secure design patterns, or reference architectures. Insecure Design is a new category in 2021 because the industry was not well designed and prepared enough to deal with threats.
To fix insecure design problems, a company needs to implement threat modeling, secure access control, and so on. Segregation for every network layer can also be implemented, including security controls for the user stories.
- Security Misconfiguration
Security misconfiguration can be triggered by using the default configuration, which can let the unauthorized user have access to the security configuration. This can also be caused by incomplete configurations.
The issue with the security configuration can be minimized by deploying minimal platforms and deleting services or features that are unused and monitoring the cloud resources for security misconfiguration.
- Vulnerable and Outdated Components
Like its name, vulnerable and outdated components mean the usage of outdated software components in the company. If the outdated or vulnerable components have known vulnerabilities, then this can cause a snowballing effect on the company’s web application.
This can be prevented by checking the components’ versions to make sure they are not outdated, if they are, then immediately update them. The threats can be minimized by using the components from the official source (not pirating them).
- Identification and Authentication Failures
Previously, this issue was known as ‘broken authentication’ in 2017 (2nd rank), before it went down the rank to identification and authentication failures. The attacker can use brute force attacks to gain advantages from the vulnerabilities that are caused by the failures in identification and authentication. The help of standardized frameworks minimizes the risk of this threat.
Not only using standardized frameworks, but also enforcing strong passwords, applying multi-factor authentication, and implementing a secure session manager to create random session IDs.
- Software and Data Integrity Failures
This section is about web application updates without verifying integrity. Software and data integrity failures also mean errors because the web application code does not do any protection against integrity violations. The attacker can cause trigger this vulnerability by expropriating the software update.
To prevent this, make sure that CI/CD pipeline has a competent configuration, access control, and segregation. Libraries and others should consume repositories that are trusted or can be hosted internally.
- Security Logging and Monitoring Failures
This was the 10th rank in 2017, and was formerly known as ‘insufficient logging and monitoring’. Like its name, this category means the lack of time to detect an attack. The gap in time can help the attacker to interfere with the server, configuration, and so on.
Actively auditing and logging can help to detect this problem. Encoding the log data can aid to prevent this problem. Not only that but ensuring that all login and access control can be done with enough user context to identify weird accounts is important in this category.
- Server–Side Request Forgery
This category is newly introduced in 2021, and it means the attacker can force a server-side application to send HTTP requests to all domains that the attacker wants. This problem can still exist even though a VPN, or firewall is already being used.
Server-side request forgery can be prevented by disabling HTTP redirections, and always sanitizing and validating client-supplied input data,
What does This Mean?
The OWASP Top 10 keeps changing for three or four years with the development of technology and innovation. For example, the Identification and Authentication Failures went down to the seventh rank, but with the better-regulated frameworks, this problem became less critical but still dangerous. Not only that but there are new categories in the rank too. There are many factors that contribute to those new categories, but they are all because of the better hackers’ innovation (technological development). A company should always stay updated on the OWASP Top 10 list and all vulnerabilities outside of the rank.
References:
• https://www.synopsys.com/glossary/what-is-owasp-top-10.html
