Securing Web Applications: The Open Web Application Security Project
Management practices are an important part of the security mosaic and a number of such frameworks are justifiably popular, especially ISO-17799 and COBIT. Other useful best practices are less well known than they should be. The Open Web Application Security Project (OWASP) is one of those. Each day this week, the blog will include posts on the OWASP and some of the projects conducted by the group in an effort to spread the word on yet another high quality tool for security management.
Today, I’ll post the OWASP’s Top 10 Web Application Security flaws. Correcting these vulnerabilities is the first place to start with any Web application.
1. Unvalidated input
2. Broken access controls
3. Broken authentication and session management
4. Cross-site scripting
5. Buffer overflow
6. Injection flaws
7. Improper error handling
8. Insecure storage
9. Application denial of service
10. Insecure configuration management.
A summary of these is available at the OWASP Web site along with details, including a general description of the vulnerability, environments affected, examples and references, methods for determining an application is vulnerable to the flaw, and information on protecting applications from the flaw.
Tomorrows topic: the OWASP Report Generator for documenting security vulnerabilities.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
Comments
Dan,
We're about to release the revised T10 for 2007. If you'd like to review it, please mail me.
Andrew
Posted by: Andrew van der Stock | January 15, 2007 2:02 AM