[TheRecord] OWASP Top 10 ranking has a new leader after ten years

The OWASP Top 10, a list of the most dangerous web vulnerabilities, has been updated after four years, and, after more than a decade, there is a new vulnerability at the top of the ranking.

Created in the mid-2000s, the list is curated by the Open Web Application Security Project, a nonprofit foundation that’s made up of security experts from around the world.

While it is not an official document, the OWASP Top 10 is often used in cybersecurity circles as a way to evaluate the importance and severity of vulnerabilities in web-based apps.

For example, bug bounty platforms use the OWASP Top 10 list to classify bugs that need to be patched right away or deserve higher monetary rewards.

Because the web programming landscape and its applications are constantly evolving as new programming languages and techniques are incorporated, OWASP experts usually get together once every three-four years to update the Top 10 ranking, moving entries in or out and up and down the list to reflect the current web app ecosystem.

The ranking was updated the last time in November 2017.

But last week, the OWASP team released for public comment a draft of its upcoming list, one that comes with a complete shake-up and even a new leader.

Image: OWASP

In a press release, the OWASP foundation explained its most recent update and ranking shifts:

A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.

A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.

A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.

A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures.

A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.

A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the industry survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any CVEs mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.

A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.

A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from CVE/CVSS data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.

A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.

A10:2021-Server-Side Request Forgery is added from the industry survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the industry professionals are telling us this is important, even though it’s not illustrated in the data at this time.

The 2021 ranking is also the first time since 2007 that the “Injection” vulnerability category has not been at the top of the ranking.

The reason for this is because web apps are getting more and more complex, and oftentimes, they are just a collection of APIs, with their own set of configuration options that, when combined, leave the door open for misconfigurations, unprotected endpoints, or unforeseen interactions.

202120172013Broken Access ControlInjectionInjectionCryptographic FailuresBroken AuthenticationBroken Authentication and Session ManagementInjectionSensitive Data ExposureCross-Site Scripting (XSS)Insecure DesignXML External Entities (XXE)Insecure Direct Object ReferencesSecurity MisconfigurationBroken Access ControlSecurity MisconfigurationVulnerable and Outdated ComponentsSecurity MisconfigurationSensitive Data ExposureIdentification and Authentication FailuresCross-Site Scripting (XSS)Missing Function Level Access ControlSoftware and Data Integrity FailuresInsecure DeserializationCross-Site Request Forgery (CSRF)Security Logging and Monitoring FailuresUsing Components with Known VulnerabilitiesUsing Components with Known VulnerabilitiesServer-Side Request ForgeryInsufficient Logging & MonitoringUnvalidated Redirects and Forwards

201020072004InjectionCross-Site Scripting (XSS)Unvalidated InputCross-Site Scripting (XSS)Injection FlawsBroken Access ControlBroken Authentication and Session ManagementMalicious File ExecutionBroken Authentication and Session ManagementInsecure Direct Object ReferencesInsecure Direct Object ReferenceCross Site ScriptingCross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF)Buffer OverflowSecurity MisconfigurationInformation Leakage and Improper Error HandlingInjection FlawsInsecure Cryptographic StorageBroken Authentication and Session ManagementImproper Error HandlingFailure to Restrict URL AccessInsecure Cryptographic StorageInsecure StorageInsufficient Transport Layer ProtectionInsecure CommunicationsApplication Denial of ServiceUnvalidated Redirects and ForwardsFailure to Restrict URL AccessInsecure Configuration Management

OWASP is expected to approve the ranking by the end of the year.

While a draft, the ranking is expected to remain the same, barring massive negative feedback, which doesn’t appear to have happened since the new Top 10 list has been revealed last week.

The OWASP Top 10 2021 is out. I’m excited the SSRF is on the list and would like to thank @vanderaj for giving me the chance to contribute to writing the section of SSRF! #owasp https://t.co/bGnpkoPm8J

— Orange Tsai 🍊 (@orange_8361) September 10, 2021

The post OWASP Top 10 ranking has a new leader after ten years appeared first on The Record by Recorded Future.

Source: Read More (The Record by Recorded Future)

You might be interested in …

Daily NCSC-FI news followup 2021-04-19

Lazarus APT conceals malicious code within BMP image to drop its RAT blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/ Lazarus APT is one of the most sophisticated North Korean Threat Actors that has been active since at least 2009. This actor is known to target the U.S., South Korea, Japan and several other countries. In one of their most recent campaigns […]

Read More

[ThreatPost] Auditors: Feds’ Cybersecurity Gets the Dunce Cap

All posts, ThreatPost

Out of eight agencies, four were given D grades in a report for the Senate, while the Feds overall got a C-.  Source: Read More (Threatpost)

Read More

[SANS ISC] ISC Stormcast For Friday, July 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7598, (Fri, Jul 23rd)

All posts, Sans-ISC

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Source: Read More (SANS Internet Storm Center, InfoCON: green)

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.