Difference between revisions of "Top 10 2013-Introduction"

From OWASP
Jump to: navigation, search
m ({{Top_10:LanguageFile|text=acknowledgements -> 'text=attribution' ....)
 
(14 intermediate revisions by 3 users not shown)
Line 1: Line 1:
 
{{Top_10_2013:TopTemplate
 
{{Top_10_2013:TopTemplate
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
     |next=Release Notes
+
     |next={{Top_10:LanguageFile|text=releaseNotes|language=en|year=2013}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
     |prev=About OWASP
+
     |prev={{Top_10:LanguageFile|text=aboutOWASP|language=en|year=2013}}
 +
    |year=2013
 +
    |language=en
 
}}
 
}}
  
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|title=Welcome|number=whole|year=2013}}
+
{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title={{Top_10:LanguageFile|text=welcome|language=en}}|year=2013|language=en}}
Welcome to the OWASP Top 10 2013! This update broadens one of categories from the 2010 version to be more inclusive of common, important vulnerabilities, and reorders some of the others based on changing prevalence data.  It also brings component security into the spotlight by creating a specific category for this risk, pulling it out of the obscurity of the fine print of the 2010 risk A6: Security Misconfiguration.
+
Welcome to the OWASP Top 10 2013! This update broadens one of the categories from the 2010 version to be more inclusive of common, important vulnerabilities, and reorders some of the others based on changing prevalence data.  It also brings component security into the spotlight by creating a specific category for this risk, pulling it out of the obscurity of the fine print of the 2010 risk A6: Security Misconfiguration.
  
The OWASP Top 10 is based on risk data from 8 firms that specialize in application security, including 4 consulting companies and 4 tool vendors (2 static and 2 dynamic). This data spans over 500,000 vulnerabilities across hundreds of organizations and thousands of applications. The Top 10 items are selected and prioritized according to this prevalence data, in combination with consensus estimates of exploitability, detectability, and impact estimates.
+
The OWASP Top 10 for 2013 is based on 8 datasets from 7 firms that specialize in application security, including 4 consulting companies and 3 tool/SaaS vendors (1 static, 1 dynamic, and 1 with both). This data spans over 500,000 vulnerabilities across hundreds of organizations and thousands of applications. The Top 10 items are selected and prioritized according to this prevalence data, in combination with consensus estimates of exploitability, detectability, and impact estimates.
  
 
The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to protect against these high risk problem areas – and also provides guidance on where to go from here.  
 
The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to protect against these high risk problem areas – and also provides guidance on where to go from here.  
</td></tr></table>
 
  
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|title=Warnings|number=left|year=2013}}
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=left|title={{Top_10:LanguageFile|text=warnings|language=en}}|year=2013|language=en}}
Don’t stop at 10. There are hundreds of issues that could affect the overall security of a web application as discussed in the OWASP Developer’s Guide. This is essential reading for anyone developing web applications today. Guidance on how to effectively find vulnerabilities in web applications are provided in the OWASP Testing Guide and OWASP Code Review Guide, which have both been significantly updated since the previous release of the OWASP Top 10.
+
'''Don’t stop at 10.''' There are hundreds of issues that could affect the overall security of a web application as discussed in the [https://www.owasp.org/index.php/OWASP_Guide_Project  OWASP Developer’s Guide] and the [https://www.owasp.org/index.php/Cheat_Sheets  OWASP Cheat Sheet Series]. These are essential reading for anyone developing web applications. Guidance on how to effectively find vulnerabilities in web applications is provided in the [https://www.owasp.org/index.php/Category:OWASP_Testing_Project  OWASP Testing Guide] and the [https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project  OWASP Code Review Guide].
  
Constant change. This Top 10 will continue to change. Even without changing a single line of your application’s code, you may become vulnerable as new flaws are discovered. Please review the advice at the end of the Top 10 in “What’s Next For Developers, Verifiers, and Organizations” for more information.
+
'''Constant change.''' This Top 10 will continue to change. Even without changing a single line of your application’s code, you may become vulnerable as new flaws are discovered and attack methods are refined. Please review the advice at the end of the Top 10 in “What’s Next For Developers, Verifiers, and Organizations” for more information.
  
Think positive. When you’re ready to stop chasing vulnerabilities and focus on establishing strong application security controls, OWASP has produced the Application Security Verification Standard (ASVS) as a guide to organizations and application reviewers on what to verify.
+
'''Think positive.''' When you’re ready to stop chasing vulnerabilities and focus on establishing strong application security controls, OWASP has produced the [https://www.owasp.org/index.php/ASVS  Application Security Verification Standard (ASVS)] as a guide to organizations and application reviewers on what to verify.
  
Use tools wisely. Security vulnerabilities can be quite complex and buried in mountains of code. In many cases, the most cost-effective approach for finding and eliminating these weaknesses is human experts armed with good tools.
+
'''Use tools wisely.''' Security vulnerabilities can be quite complex and buried in mountains of code. In many cases, the most cost-effective approach for finding and eliminating these weaknesses is human experts armed with good tools.
  
Push left. Focus on making security an integral part of your culture throughout your development organization. Find out more in the Open Software Assurance Maturity Model (SAMM) and the Rugged Handbook.
+
'''Push left.''' Focus on making security an integral part of your culture throughout your development organization. Find out more in the [https://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model  Open Software Assurance Maturity Model (SAMM)] and the [http://ruggedsoftware.org/  Rugged Handbook].
  
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|title=Acknowledgements|number=right|year=2013}}
 
Thanks to Aspect Security for initiating, leading, and updating the OWASP Top 10 since its inception in 2003, and to its primary authors: Jeff Williams and Dave Wichers.
 
  
 +
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=right|title={{Top_10:LanguageFile|text=attribution|language=en}}|year=2013|language=en}}
 +
Thanks to [https://www.aspectsecurity.com/ Aspect Security] for initiating, leading, and updating the OWASP Top 10 since its inception in 2003, and to its primary authors: Jeff Williams and Dave Wichers.
 +
<center>
 +
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]
 +
</center>
 
We’d like to thank those organizations that contributed their vulnerability prevalence data to support the 2013 update:
 
We’d like to thank those organizations that contributed their vulnerability prevalence data to support the 2013 update:
* Aspect Security  
+
* [https://www.aspectsecurity.com/ Aspect Security]
* HP (Results for both Fortify and WebInspect)
+
* [http://www.hpenterprisesecurity.com/ HP] – Statistics from both [http://www.hpenterprisesecurity.com/collateral/whitepaper/HP2012CyberRiskReport_0313.pdf Fortify] and WebInspect
* Minded Security
+
* [http://www.mindedsecurity.com/ Minded Security] – [http://blog.mindedsecurity.com/2013/02/real-life-vulnerabilities-statistics.html Statistics]
* Softtek
+
* [http://www.softtek.com/ Softtek] – [https://www.softtek.com/webdocs/special_pdfs/WP-State-of-the-art-2013.pdf Statistics]
* TrustWave
+
* [https://www.trustwave.com/spiderlabs/ Trustwave, Spiderlabs] – [http://www2.trustwave.com/rs/trustwave/images/2013-Global-Security-Report.pdf Statistics] (See page 50)
* Veracode – Statistics
+
* [http://www.veracode.com/ Veracode] [http://info.veracode.com/rs/veracode/images/VERACODE-SOSS-V4.PDF Statistics]
* WhiteHat Security Inc. – Statistics
+
* [https://www.whitehatsec.com/ WhiteHat Security Inc.] [http://owasptop10.googlecode.com/files/WPstats_winter11_11th.pdf  Statistics]
 +
 
 +
We would also like to thank everyone who contributed to previous versions of the Top 10, without which, it wouldn't be what it is today.We’d also like to thank those who contributed significant constructive comments and  time reviewing this update to the Top 10:
 +
 
 +
* Adam Baso ([http://wikimediafoundation.org/wiki/Home Wikimedia Foundation])
 +
* Mike Boberski (Booz Allen Hamilton)
 +
* Torsten Gigler
 +
* Neil Smithline – ([http://www.MorphoTrust.com MorphoTrust USA]) For producing the wiki version of the Top 10, and also providing feedback
 +
 
 +
And finally, we’d like to thank in advance all the translators out there that will translate this release of the Top 10 into numerous different languages, helping to make the OWASP Top 10 more accessible to the entire planet.
 +
 
  
 
{{Top_10_2013:BottomAdvancedTemplate
 
{{Top_10_2013:BottomAdvancedTemplate
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |type={{Top_10_2010:StyleTemplate}}
 
     |usenext=2013NextLink
 
     |usenext=2013NextLink
     |next=Release Notes
+
     |next={{Top_10:LanguageFile|text=releaseNotes|language=en|year=2013|language=en}}
 
     |useprev=2013PrevLink
 
     |useprev=2013PrevLink
     |prev=About OWASP
+
     |prev={{Top_10:LanguageFile|text=aboutOWASP|language=en|year=2013|language=en}}
 +
    |year=2013
 +
    |language=en
 
}}
 
}}

Latest revision as of 16:18, 17 June 2013

← About OWASP
2013 Table of Contents

2013 Top 10 List

Release Notes →
Welcome

Welcome to the OWASP Top 10 2013! This update broadens one of the categories from the 2010 version to be more inclusive of common, important vulnerabilities, and reorders some of the others based on changing prevalence data. It also brings component security into the spotlight by creating a specific category for this risk, pulling it out of the obscurity of the fine print of the 2010 risk A6: Security Misconfiguration.

The OWASP Top 10 for 2013 is based on 8 datasets from 7 firms that specialize in application security, including 4 consulting companies and 3 tool/SaaS vendors (1 static, 1 dynamic, and 1 with both). This data spans over 500,000 vulnerabilities across hundreds of organizations and thousands of applications. The Top 10 items are selected and prioritized according to this prevalence data, in combination with consensus estimates of exploitability, detectability, and impact estimates.

The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to protect against these high risk problem areas – and also provides guidance on where to go from here.

Warnings

Don’t stop at 10. There are hundreds of issues that could affect the overall security of a web application as discussed in the OWASP Developer’s Guide and the OWASP Cheat Sheet Series. These are essential reading for anyone developing web applications. Guidance on how to effectively find vulnerabilities in web applications is provided in the OWASP Testing Guide and the OWASP Code Review Guide.

Constant change. This Top 10 will continue to change. Even without changing a single line of your application’s code, you may become vulnerable as new flaws are discovered and attack methods are refined. Please review the advice at the end of the Top 10 in “What’s Next For Developers, Verifiers, and Organizations” for more information.

Think positive. When you’re ready to stop chasing vulnerabilities and focus on establishing strong application security controls, OWASP has produced the Application Security Verification Standard (ASVS) as a guide to organizations and application reviewers on what to verify.

Use tools wisely. Security vulnerabilities can be quite complex and buried in mountains of code. In many cases, the most cost-effective approach for finding and eliminating these weaknesses is human experts armed with good tools.

Push left. Focus on making security an integral part of your culture throughout your development organization. Find out more in the Open Software Assurance Maturity Model (SAMM) and the Rugged Handbook.


Attribution

Thanks to Aspect Security for initiating, leading, and updating the OWASP Top 10 since its inception in 2003, and to its primary authors: Jeff Williams and Dave Wichers.

Aspect_logo.gif

We’d like to thank those organizations that contributed their vulnerability prevalence data to support the 2013 update:

We would also like to thank everyone who contributed to previous versions of the Top 10, without which, it wouldn't be what it is today.We’d also like to thank those who contributed significant constructive comments and time reviewing this update to the Top 10:

  • Adam Baso (Wikimedia Foundation)
  • Mike Boberski (Booz Allen Hamilton)
  • Torsten Gigler
  • Neil Smithline – (MorphoTrust USA) For producing the wiki version of the Top 10, and also providing feedback

And finally, we’d like to thank in advance all the translators out there that will translate this release of the Top 10 into numerous different languages, helping to make the OWASP Top 10 more accessible to the entire planet.


← About OWASP
2013 Table of Contents

2013 Top 10 List

Release Notes →

© 2002-2013 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved. CC-by-sa-3 0-88x31.png