What are OWASP Secure Coding Practices? Top 10 Web App Security Vulnerabilities

OWASP (Open Web Application Security Project) is a nonprofit organization established in 2001 to instruct (guide) website owners and security experts on constructing, purchasing, and maintaining trustworthy and secure software applications.

In lay terms, it is a forum where several application security firms and industry specialists provide input to identify the top, most critical security risks that threaten web applications.

What are OWASP Secure Coding Practices?

The OWASP Secure Coding Practices are a set of secure coding guidelines (best practices) or checklists with “n” number of prevention techniques through which damage from diverse software attacks can be mitigated and minimized.

Here’s a list of some of the techniques under each checklist.

Input Validation:

Properly validate all input data provided by users to stop malicious or invalid input from inducing security vulnerabilities that may lead to attacks like cross-site scripting, injection, buffer overflows, etc. Some strategies that you can use to execute input validation are:

• Ensure request & response headers incorporate only ASCII characters.
• Validate all data (including HTTP headers, URLs, embedded code, etc.) provided by the client before processing.

Output Encoding:

Decipher (translate) user input so that it cannot be executed as code when displayed in a browser, thus mitigating XSS attacks. Some strategies pointed out by OWASP are:

• Utilize Operating System (OS) commands to sanitize untrusted data.
• Encode every character except for those considered safe for the target interpreter.

Authentication & Password Management:

Implement a secure authentication mechanism to verify the identity of users and utilize encryption, salting, etc., to store and manage your passwords securely. Some techniques mentioned by OWASP for this are:

• Mandate authentication for all pages or resources that link to CIA Triad.
• Stop password reuse and inform clients when password reset occurs.

Session Management:

Securely address numerous requests from a web app service from diverse clients. Some points mentioned by OWASP for this are:

• Ensure all connections and sessions end upon logout, and multiple logins are prohibited for the same User ID.
• Minimize session inactivity timeout interval based on business and risk objectives.

Access Control:

Enforce appropriate access control measures to grant or deny user access to systems or resources based on their privilege levels, reducing the risk of unauthorized access. Some techniques of access control mentioned by OWASP are given below:

• Terminate inactive accounts.
• Access to app data, secured URLs, services, attributes, etc., should only be granted to authorized users.

Cryptographic Practices:

Employ cryptographic operations to encrypt sensitive data, ensuring that only authorized users can access and modify the data, thus maintaining data confidentiality. Some cryptographic approaches mentioned by OWASP for this are:

• Utilize cryptographic key management.
• Protect the Master key from unauthorized access.

Error Handling & Logging:

Implement error handling procedures to handle unsolicited output and employ logging to keep track of software/application changes and security-related events for auditing and monitoring purposes. Some logging and error handling approaches are mentioned below:

• Use error handlers that do not reveal debugging information in case of unsolicited input
• Ensure that logs do not hold session or system information.

Data Protection:

Enforce measures to guard paramount data from unauthorized alteration, compromise, or loss in order to ensure the integrity, availability, and confidentiality of the data. Some techniques to implement data protection are mentioned below:

• Disable the auto-complete feature while entering data into forms.
• Shield server-side code to deter unauthorized access.

Communication Security:

Protect sensitive information during transmission using an SSL certificate issued by a trusted CA, along with distinct encryption variants. Some approaches mentioned by OWASP for this are:

• Ensure that failed connections do not downgrade to unsecure protocols in case of SSL.
• Designate character encoding for all connections.

System Configuration:

Maintain computer systems, servers, and software in a desired, consistent state using configuration management tools. Some techniques mentioned by OWASP to achieve this are mentioned below:

• Keep components updated with the latest version of security patches.
• Isolate development and test environments from the production environment.

Database Security: Implement security measures to prevent various threats related to databases like SQL injection and data leakage. Some techniques to achieve this are mentioned below:

• Change default passwords.
• Enable multifactor authentication wherever applicable.

File Management:

Construct an organized structure to store and retrieve information securely and easily. Some file management approaches mentioned by OWASP to achieve this are:

• Organize by file types.
• Nest folders within folders.
• Review file headers to stop malicious (infected) uploads.
• Disable execution privileges in directories where files are uploaded.
• Avoid revealing absolute file paths to clients.

Memory Management:

Mitigate vulnerabilities related to memory exploits (buffer overflows, memory leaks, etc.) that can lead to security breaches. Here are some techniques or approaches to achieve this:

• Avoid vulnerable functions like strcat, print, etc.
• Truncate input strings prior to employing functions like – concatenation or copy.

Why is OWASP Useful?

OWASP curates a list of the top ten (10) most hazardous web application security vulnerabilities, along with the most efficient approaches to mitigate them. In addition to this, it:

• Enhances the security of applications against cyber attacks,
• Reduces the occurrence of errors and system failures,
• Improves encryption,
• Increases the likelihood of application success and
• Enhances the reputation of the software development company.

OWASP Top 10 Web Application Security Vulnerabilities

Broken Access Control (A01:2021)

Previously listed as number 5, broken access control has now moved up to the top spot on the list of web application security risks for 2021. Attackers use this vulnerability to acquire unauthorized access to user accounts by exploiting weaknesses (flaws) in the system’s access controls.

Resolution: By using secure coding practices and preventive actions (locking administrative accounts, using multi-factor authentication, etc.), access control and credential management issues can be mitigated.

You can also use an interactive application security testing solution (Seeker®) to detect insecure storage of sensitive data or cross-site request forgery, pinpoint any flawed or missing logic being utilized to manage JSON Web Tokens, etc.

Cryptographic Failures (A02:2021)

Entry previously positioned at number 3 and referred to as sensitive data exposure has moved to the second spot and was renamed as cryptographic failures.

Cryptographic failures happen when vital data stored or transmitted is compromised and put at risk. It mainly occurs because of using weak cryptographic keys, outdated cryptographic algorithms, hardcoded passwords, etc. 

Resolution: You can use the – “Coverity SAST” and “Black Duck SCA” checkers to scan for inadequate encryption strength and identify risky or broken cryptographic algorithms. Adequately encrypt data at rest and in transmission to overcome this vulnerability.

Injection (A03:2021)

Injection vulnerability has moved from the number one to the number three position. Cross Site Scripting (XSS) is now considered a part of this category.

A code injection occurs when a malicious actor adds malicious code into the input fields of a web application to make it behave in a manner it was not expected or designed to behave. Attackers can access sensitive information and execute unauthorized commands once they have infiltrated.

Resolution: To remove injection vulnerabilities, use remediation techniques like writing parameterized SQL queries, stripping special characters from user input, etc. Including SAST and IAST tools in your continuous integration / continuous delivery (CI/CD) pipeline is recommended to identify injection flaws at static and dynamic code levels.

Utilize AST tools to check for a variety of injection attacks, like LDAP injections, SQL injections, template injections, NoSQL injections, command injections, etc., during various test stages.

Insecure Design (A04:2021)

Insecure design is a new category in the 2021 OWASP Top Ten that focuses on risks related to design flaws & ineffective controls.

Resolution: As enterprises continue to “shift left,” traditional methods like secure design patterns and principles, threat modeling, etc., may not be enough to address this risk.

In addition, it is advisable to leverage Seeker IAST to enhance the security posture, identify vulnerabilities, and reveal all inbound and outbound services, API, and function calls in sophisticated cloud, web, and microservices-based apps.

Security Misconfiguration (A05:2021)

Misconfigurations in security arise from errors or inadequacies in the configuration process, such as not modifying insecure default values, granting extensive permissions, or displaying overly revealing error messages.

The 2023 Veracode SOSS report revealed that over 70% of apps that introduced a new vulnerability in the last year contained misconfiguration errors. This vulnerability has now moved from sixth to fifth position, and the external entities category is now considered a part of this category.

Resolution: To remove the Security Misconfiguration vulnerability, organizations should routinely check and adjust how their applications and infrastructure are set up and scan all infrastructure as code components to look for ways that sensitive information might be accidentally revealed.

Using the Seeker IAST tool is also recommended to detect inappropriate HTTP header configurations and information disclosure during application runtime testing.

Vulnerable and Outdated Components (A06:2021)

Vulnerable and Outdated Components vulnerability has moved from the number nine to the number six position. This vulnerability pertains to risky components in software that are either already known to be unsafe (like CVEs) or have the potential to become unsafe.

Resolution: To remove the A06:2021 vulnerability, create a Software Bill of Materials for all software distributed or deployed. To generate standardized SBoMs, use Container scanning tools and Veracode SCA and get access to all the third-party component vulnerabilities present.

Identification and Authentication Failures (A07:2021)

The “Identification and Authentication Failures” vulnerability, previously known as broken authentication vulnerability, is now ranked as the seventh most important security concern.

The presence of this vulnerability means that – “The way your application lets people log in or confirm their identity is not strong enough.” This usually happens when the login and session management functions are not set up correctly, which puts users’ identities at risk.

Resolution: To mitigate A07:2021, implement multifactor authentication. Apart from this, you can also utilize static and interactive application security testing solutions to identify and address broken authentication vulnerabilities, like – hardcoded credentials, missing critical steps in authentication, etc.

Software and Data Integrity Failures (A08:2021)

This vulnerability pertains to the risks associated with the tools used to – build, handle, or deploy software, which attackers can exploit. This includes the threat of creating insecure deployments, injecting malicious code or libraries into a CI/CD pipeline, stealing critical data, etc.

In 2021, in this new category of vulnerability, the vulnerability of insecure deserialization, which allows remote execution of code in the system, is also included.

Resolution: Application security tools like Protocol fuzzing, DAST, penetration testing, etc., can help detect deserialization flaws. You can also utilize Seeker IAST to detect tampering with token access algorithms, unsafe deserialization, insecure redirects, etc.

Security Logging and Monitoring Failures (A09:2021)

Security Logging and Monitoring Failures issue previously known as ‘insufficient logging and monitoring’ has moved up from the tenth to the ninth position in the list of top security risks. It is mainly about the insufficient monitoring and logging of a website, which can lead to more failures.

Resolution: Generating data is not sufficient; the organization should have ample storage and various ways to collect and respond to that data. They should also regularly check that these ways are working correctly. A tool like Veracode DAST can help with this by producing logs and alerts.

Server-Side Request Forgery (A10:2021)

A server-side request forgery (SSRF) is a new category of vulnerability added to the OWASP list of the top ten. SSRF happens when a web app brings a remote resource without validating the user-supplied URL, allowing a malicious actor to make the app transmit a crafted request to an unexpected destination.

Resolution:  Common methods like utilizing explicit allow lists, sanitizing user input, reviewing request responses before giving them back to the clients, etc., can be used to mitigate SSRF attacks. You can also use a modern AST tool – Seeker, to detect SSRF by monitoring and tracking it without extra triaging.

What are the Benefits of OWASP?

OWASP helps your organization stay competitive by – “planning” “developing“, “maintaining” and “operating” online applications that can be trusted.

Apart from this, it also mitigates risk, conducts threat modeling or architectural threat analysis, protects end users’ data (by providing methods for handling private data), gives developers more confidence in their code, etc.

Conclusion

As technology continues to connect us – the complexity and need for application security become exponentially more challenging to address.

If you are looking to enhance your security measures, the OWASP community and standards are an excellent starting point, as the world’s leading security experts back it, and it has been supported by nearly two decades of research.

Search