OWASP Proactive Controls: the answer to the OWASP Top Ten Kerr Ventures

Snyk interviewed 20+ security leaders who have successfully and unsuccessfully built security champions programs. Check out this playbook to learn how to run an effective developer-focused security champions program. Gain insights into best practices for utilizing generative AI coding tools securely in our upcoming live hacking session. For any of these decisions, you have the ability to roll your own–managing your own registration of users and keeping track of their passwords or means of authentication. As an alternative, you can choose to managed services and benefit from the cloud’s Serverless architecture of services like Auth0. Make sure you track the use of open source libraries and maintain an inventory of versions, their licenses and vulnerabilities such as OWASP’s top 10 vulnerabilities using tools like OWASP’s Dependency Check or Snyk.

• The queries used to conduct the database calls must be properly sanitized to prevent SQL Injection attacks.
• The Top 10 Proactive Controls are by developers for developers to assist those new to secure development.
• This concept is not only relevant for Cross-Site Scripting (XSS) vulnerabilities and the different HTML contexts, it also applies to any context where data and control planes are mixed.
• No matter how many layers of validation data goes through, it should always be escaped/encoded for the right context.
• Some of this has become easier over the years (namely using HTTPS and protecting data in transit).

Threat modeling analyzes a system representation to mitigate security and privacy issues early in the life cycle. Secure design patterns and reference architectures provide a positive, secure pattern that developers can use to build new features. Cryptographic failures are breakdowns in the use of cryptography within an application, stemming from the use of broken or risky crypto algorithms, hard-coded (default) passwords, or insufficient entropy (randomness).

OWASP Top 10 Proactive Controls

Each technique or control in this document will map to one or more items in the risk based OWASP Top 10. This mapping information is included at the end of each control description. Stay tuned for the next blog posts in this series to learn more about these proactive controls in depth.

However, development managers, product owners, Q/A professionals, program managers, and anyone involved in building software can also benefit from this document. OWASP Top 10 Proactive Controls describes the most important control and control categories that every architect and developer should absolutely, 100% include in every project. The Top 10 Proactive Controls are by developers for developers to assist those new to secure development. Database injections are probably one of the best-known security vulnerabilities, and many injection vulnerabilities are reported every year. In this blog post, I’ll cover the basics of query parameterization and how to avoid using string concatenation when creating your database queries.

A06 Vulnerable and Outdated Components

Two great examples of secure defaults in most web frameworks are web views that encode output by default (providing XSS attack defenses) as well as built-in protection against Cross-Site Request Forgeries. Sometimes though, secure defaults can be bypassed by developers on purpose. So, I’ll also show you how to use invariant enforcement to make sure that there are no unjustified deviations from such defaults across the full scope of your projects.

This mapping is based the OWASP Proactive Controls version 3.0 (2018). With the latest release of the top 10 proactive controls, OWASP is helping to move security closer to the beginning of the application development lifecycle. The list is “critical to moving the industry forward with ‘security left’ initiatives,” Kucic said. More junior developers do not have the knowledge or time to properly owasp controls implement or maintain security features, Kucic said. “Clearly, leveraging established security frameworks helps developers accomplish security goals more efficiently and accurately.” Once authentication is taken care of, authorization should be applied to make sure that authenticated users have the permissions to perform any actions they need but nothing beyond those actions is allowed.

Leverage Security Frameworks and Libraries

Identification and authentication failures occur when an application cannot correctly resolve the subject attempting to gain access to an information service or properly verify the proof presented as validation of the entity. This issue manifests as a lack of MFA, allowing brute force-style attacks, exposing session identifiers, and allowing weak or default passwords. Security misconfiguration is when an important step to secure an application or system is skipped intentionally or forgotten. An injection is when input not validated properly is sent to a command interpreter.