Top commonly found vulnerabilities in web applications & mitigation plan (OWASP TOP 10)

OWASP (also called Open Web Application Security Project) is the community in the area of web application security . Frequently it releases a list of Top 10 Security vulnerabilities which is most commonly found in web applications all around.

In this article We are going to talk about top 10 vulnerabilities which OWASP TOP 10 2021 talks about and mitigation plan for the same .

?

• A01:2021-Broken Access Control?
• This is NUMBER ONE vulnerability which is found quite often in web applications . The CORE idea of?this vulnerability?is 'One who should have access must be the only one who must be able to access a particular resource' . Any deviation falls into this?category , in other words unauthorised person , role should not be able to access a particular resource . (for example by using the same url unauthorised?role / person is able to access a resource )

AFFECTED APPLICATIONS PERCENTAGE # 94 %

?

• A02:2021-Cryptographic Failures?This is NUMBER TWO vulnerability found in web applications . This talks about Sensitive Data Exposure, which points to the of lack of proper Security?protocols in place and could lead to application at risk. This risk could be mitigated with ensuring encryption based data?security?at?rest and in transit .

?

• A03:2021-Injection?This is a NUMBER THREE?vulnerability in web applications . This behaviour occurs when data accepted?as INPUT is unexpectedly processed as INSTRUCTIONS .Prime examples are CROSS-SITE SCRIPTING?.Mitigation of this kind of vulnerability lies in neutralising the Incoming data so that it?doesnt?get processed . Filter and Encoding the Incoming data is an effective measure .

AFFECTED APPLICATIONS PERCENTAGE # 94 %

?

• A04:2021-Insecure Design?This is a?new category introduced in the OWASP 2021 at NUMBER FOUR vulnerability . This touches upon and gives?importance to the design phase considerations for a?secure application .For example
• a) Having a strong password policy
• b) Proper API gateways and firewalls with considerable amount of security .?

?

• A05:2021-Security Misconfiguration?This is a NUMBER FIVE vulnerability in web?based applications . This primarily?points out the misconfigurations while installations. Default configurations?could be one good subcategory for this type of vulnerability .For example using default passwords of a common portal product in the market . Surprisingly?OWASP Foundation indicates 90 percent of the applications were tested for some form of misconfigurations .

?

• A06:2021-Vulnerable and Outdated Components?This is a NUMBER SIX vulnerability . Loopholes in Installed softwares quite often poses the risk of hackers getting into your system and causing unimaginable problems . That is?the reason?software products companies keep testing?their products against the latest vulnerabilities and continue creating security patches . The practice of getting the latest Software patches/Security?patches installed should be adhered religiously . Leaders should assure that the process and people's challenges should not allow this vulnerability .

?

• A07:2021-Identification and Authentication Failures?This vulnerability points out at the issue of identification failures by application . This category is still an integral part of the Top 10, but the increased availability of Authentication in standardized frameworks seems to be helping.

?

• A08:2021-Software and Data Integrity Failures?This category is newly introduced in 2021 . This points?out the quite?often problem in today's Iterative software development. No doubt the Iterative model has empowered the projects to deliver?fast but at the same time in the hurry of delivering new security issues getting introduced is also a major problem . So steps like security testing after every iteration can mitigate this vulnerability .

?

• A09:2021-Security Logging and Monitoring Failures?Unable to keep a watch on WHO , WHEN and from WHERE logged into our system can lead to this vulnerability . Mitigation could be broadly categorised?as follows
• a) MONITORING software installations for Audit who accessed, when assessed, from where and what resources were accessed . Also what actions were performed .?
• b) ALERTING when unexpected event happens .Like?logged in from new location , odd hours

?

• A10:2021-Server-Side Request Forgery?This category points at vulnerability like Crafted requests with malicious intentions . Mitigation falls in having things like Allowed set of IPs / Not Allowed set of IPs to access the systems .

?

?

?

References :- OWASP Top 10 Resources .