1. Web Application Vulnerabilities and Insecure Software Root Causes: The OWASP Top 10 Cincinnati Chapter Meeting February 26 th , 2008 Marco Morana

4. Focus on the root cause: Insecure software.. … and still keep a 360 degree perspective: People, Process and Tools

5. Process perspective: Build Security in the SDLC

11. Common Security Issues: 2007 T10 vs. 2004 T10 29 10. Insecure Configuration Management 17 9. Denial of Service 4, 8, and 10 5. Buffer Overflows 7 1. Unvalidated Input 14 2. Broken Access Control (split in 2007 T10) 10. Failure to Restrict URL Access 8 Discussed under 10 9. Insecure Communications (NEW) 8 8. Insecure Storage 8. Insecure Cryptographic Storage 14 3. Broken Authentication and Session Management 7. Broken Auth. and Session Management 6 7. Improper Error Handling 6. Info Leakage and Improper Error Handling 36 5. Cross Site Request Forgery (CSRF) (NEW) 5 2. Broken Access Control (split in 2007 T10) 4. Insecure Direct Object Reference 3 3. Insecure Remote File Include (NEW) 2 6. Injection Flaws 2. Injection Flaws 1 4. Cross Site Scripting (XSS) 1. Cross Site Scripting (XSS) MITRE 2006 Raw Ranking OWASP Top 10 2004 OWASP Top 10 2007

17. A1: Cross Site Scripting -How to find the potential vulnerability

21. A2: Injection Flaws –SQL Injection Attack Illustrated 3 Attacker sends data containing SQL fragments Attacker enters SQL fragments into a web page that uses input in a query 1 Attacker views unauthorized data Custom Code Accounts Finance Administration Transactions Communication Knowledge Mgmt E-Commerce Bus. Functions Database 2 Application sends modified query to database, which executes it

32. A4: Insecure Direct Object Reference - How You Can Find If You Are Vulnerable

33. A4: Insecure Direct Object Reference - How You Can Find If You Are Vulnerable

36. A5:Cross Site Request Forgery

41. A6: Information Leakage and Improper Error Handling

61. A9 Insecure Communication - How You Can Find If You Are Vulnerable

67. Thank You