OWASP
How can Fluid Attacks help with OWASP compliance?
Ensuring compliance with current security requirements may be a complicated challenge for many companies whose operations depend on dynamic and evolving technology. Fluid Attacks recognizes this and offers you comprehensive testing and analysis to determine whether your company is effectively complying with all the corresponding security requirements.
Fluid Attacks' Continuous Hacking service tests around 200 technical security requirements in each of your projects. These requirements include preventing OWASP Top 10 Web Application Security Risks. We guarantee the detection of all vulnerabilities in your software associated with such risks. In addition, we provide you with reliable reports so that your team can take the necessary steps to adjust and maintain your information systems in line with OWASP requirements.
All our security testing is based on Criteria, which is a set of security requirements written by us in a comprehensible manner, using several international standards as a reference. It allows you to parameterize the assessments we make to your systems and determine what your company agrees to comply with and what would be considered a vulnerability.
What is OWASP?
The Open Worldwide Application Security Project (OWASP), of which Fluid Attacks is a corporate member, is a non-profit foundation that is committed to improving the security of software and it does so by creating awareness through different means of communication. The OWASP works as an online, open community where anyone can contribute to the production of material in the field of web application security and also take advantage of the available information. Their repository, which draws on the expertise of numerous members of the worldwide community with in-depth understanding of cybersecurity, is helpful for companies that develop or manage web and mobile applications.
Perhaps their most well-known project is the OWASP Top 10, which is updated every 3-4 years, and it includes the most critical web application security risks.
What is OWASP Top 10?
The OWASP Top 10 refers to a cybersecurity guide by the OWASP community that is created as a collaborative effort between experts and serves both developers and security professionals in their projects. This guide, with a current version from 2021, lists the ten most common and critical security risks in web applications and provides practical information for their prevention or remediation.
The idea with this ranking is to help reduce the presence of flaws in web applications that can be easily exploited and generate terrible impact. Organizations should always be careful not to bring into production applications with vulnerabilities related to these security risks, making sure to pay attention to the most prevalent risks in their specific industry sector. Here we show you the current list of risks with a brief description of each one (for more information see the official report):
1. Broken Access Control
Web applications need to establish limits for access to data and functions depending on the type of user. When that is not done properly, attackers can circumvent misconfigured (sometimes simply non-existent) access restrictions and operate as any user, including administrators.
2. Cryptographic Failures
This problem occurs when applications fail to protect data with adequate and modern encryption techniques or algorithms, use weak or predictable encoding for passwords or do not have sufficient protection for sensitive data (e.g., financial data). It leaves information assets easily accessible for attackers that can obtain them for illegal activities.
3. Injection
A code injection occurs when an application does not properly validate or sanitize user-supplied input and this can be leveraged to make it process the input as code.
4. Insecure Design
This risk refers to a lack of security controls to defend against attacks and failure to establish a secure development lifecycle.
5. Security Misconfiguration
This category refers to the inappropriate configuration of the application’s components, leaving things like default accounts or unnecessary features enabled or allowing overly informative error messages to be returned to users. Attackers can gain access through these accounts or features or attempt to exploit unpatched flaws inferred from the information exposed in error messages.
6. Vulnerable and Outdated Components
Web applications commonly use various open-source and third-party components in which vulnerabilities are sometimes found and need to be patched. Keeping outdated versions of those components with known vulnerabilities leads to having an application exposed to exploitation.
7. Identification and Authentication Failures
Attackers can take advantage of vulnerabilities related to custom authentication schemes, exposure and reuse of session identifiers, as well as non-existent password policy to gain access to user accounts and compromise the system.
8. Software and Data Integrity Failures
This occurs when the software used to develop the application is not checked to come from a trusted source and have digital signatures or when unencrypted serialized data is sent without some form of integrity check. This heightens the risk of malicious code or data being introduced into the software pipeline.
9. Security Logging and Monitoring Failures
When applications do not sufficiently log issues and events within them or do not create usable logs or these logs are not sufficiently monitored, data breaches might not be detected until months later when attackers have already done a lot of damage.
10. Server-Side Request Forgery (SSRF)
These flaws occur whenever an application does not validate the user-supplied URL when fetching a remote resource. This allows the attacker to coerce the application to send a crafted request to an unexpected destination.
OWASP Benchmark Project v1.2
The OWASP Benchmark Project is a test suite designed to evaluate the effectiveness of automated software vulnerability detection tools like SAST (static application security testing), DAST (dynamic application security testing) or IAST (interactive application security testing) scanners. Running a scanner to assess the OWASP Benchmark test cases allows you to measure that scanner’s accuracy, coverage and speed. When we decided to test our SAST tool, it achieved the best possible result against the OWASP Benchmark: A TPR (True Positive Rate) of 100% and an FPR (False Positive Rate) of 0%.
Although we at Fluid Attacks are pleased to have achieved this goal with the OWASP Benchmark, it is naturally just one of the multiple resources we have as a reference in order to enhance our tool. We firmly believe that comprehensive security testing includes not only automated tools, but also the expertise of ethical hackers. In our Advanced plan, we offer the merging of human knowledge and technology, a winning combination with unlimited support. Get in contact with us to get started.
