The OWASP Top 10 is a list of the most common vulnerabilities found in web applications. It provides software development and application delivery guidelines on how to protect against these vulnerabilities. The OWASP Top 10 list is not focused on any specific product or application but recommends generic best practices for DevOps around key areas such as role validation and application security. The Kemp LoadMaster contributes to the defense in-depth approach to information security by providing a layer of application security providing:
OWASP Vulnerability | Explanation |
---|---|
A1. Injection | This is when an attacker sends rogue content to a web application interpreter causing the interpreter to execute authorized commands. |
A2. Broken Authentication | Incorrect implementation of authentication schemes and session management can allow unauthorized users to assume the identities of valid users. |
A3. Sensitive Data Exposure | Sensitive data such as financial, healthcare and PII must be protected both in-transit and at rest. |
A4. XML External Entities (XXE) | This is a vulnerability found in many older XML processors that allow external identity references within XML documents. These external identity references can be used to access internal files and data using a URI handler embedded in an XML file. |
A5. Broken Access Control | Many applications don’t enforce access control on application resources after a user session has been authenticated. This can lead to vulnerabilities due to poor configuration, which can lead to data being exposed to users who shouldn’t get access. Internal application checks and verifications should be used for all access to sensitive data, and not the assumption that an authenticated session is allowed access. |
A6. Security Misconfiguration | This is a very wide catch-all section that covers a variety of scenarios, including the application of latest security patches, default enablement of unnecessary features and the use of default accounts to mitigate. |
A7. Cross-Site Scripting | This is when a browser unknowingly executes scripts to hijack sessions or redirect to a rogue site. |
A8. Insecure Deserialization | When applications store data they use various methods to serialize a data stream, then write it to files or send it over a network connection. When reading data back, an application deserializes the data coming in to convert it to a format the application needs. Insecure deserialization occurs when an application reads data from an insecure source, or when an attacker has been able to modify an incoming data stream to include malicious code. |
A9. Using components with known vulnerabilities | Third-party libraries and frameworks used in application development may have known vulnerabilities that compromise the overall application security. |
A10. Insufficient Logging & Monitoring | Many systems are not monitored well enough and as a result attacks and data losses go undetected for prolonged periods of time. This allows attackers to continue to exploit weaknesses in systems, and possibly use undetected flaws in one application to attack others. |