* The Open Web Application Security Project
The open source movement is one of the greatest things that has happened in the computer industry – it creates a more dynamic, relevant context that addresses not only what we want to be able to do but also improves what we already do. One of the open source initiatives that really interests me is the Open Web Application Security Project, or OWASP.
The goal of the project is to develop software tools and documentation to help people secure Web applications and Web services. Current OWASP subprojects include:
* Defining security requirements to build secure Web applications.
* Developing an industry standard Web application security testing framework.
* Defining a standard data exchange format (VulnXML) to allow commercial, open source and research tools to communicate and interoperate.
* An open source enterprise level Web application scanner (Web Scarab).
* A component based approach to filtering malicious Web application input and output.
* Providing an intentionally insecure Internet Bank Web application from which you can download and learn.
The group’s Web site features a very interesting free report titled “Guide to Building Secure Web Applications,” which includes the top 10 vulnerabilities in Web applications. Here is a summary (the actual report goes into greater detail):
* Unvalidated Parameters: Web request data are not validated before being used by a Web application.
* Broken Access Control: Restrictions on what authenticated users are allowed to do are not properly enforced.
* Broken Account and Session Management: Account credentials and session tokens are not properly protected.
* Cross-Site Scripting (XSS) Flaws: The Web application can be used as a mechanism to transport an attack to an end user’s browser.
* Buffer Overflows: Web application components that do not properly validate input can be crashed and, in some cases, used to take control of a process.
* Command Injection Flaws: Web applications pass parameters when they access external systems or the local operating system.
* Error Handling Problems: Error conditions that occur during normal operation are not handled properly.
* Insecure Use of Cryptography: Web applications frequently use cryptographic functions to protect information and credentials.
* Remote Administration Flaws: Many Web applications allow administrators to access the site using a Web interface.
*Web and Application Server Misconfiguration: Having a strong server configuration standard is critical to a secure web application.
The OWASP site is a must-read for all Web application developers and I suspect I’ll be discussing some of its subprojects in future issues. In the meantime, you have some reading to do.
