OWASP Top 10 - Revision history

KSzepannek at 19:50, 18 December 2024

2024-12-18T19:50:44Z

← Older revision		Revision as of 19:50, 18 December 2024
Line 6:		Line 6:
	By providing detailed explanations, real-world examples, and guidance, the OWASP Top 10 helps organizations to understand security risks and implement measures to prevent them.		By providing detailed explanations, real-world examples, and guidance, the OWASP Top 10 helps organizations to understand security risks and implement measures to prevent them.
	== History and Evolution ==		== History and Evolution ==

	=== Formation and Early Development ===		=== Formation and Early Development ===
	The OWASP Top 10 was first published in 2003 by the OWASP Foundation, which was founded by Mark Curphey and a team of volunteers. The original list was created to address the growing need for standardized guidance on web application security, as the internet became more connected to business operations. At the time, awareness of web application vulnerabilities was low, and there were only a few resources available for developers and security professionals to learn about them.		The OWASP Top 10 was first published in 2003 by the OWASP Foundation, which was founded by Mark Curphey and a team of volunteers. The original list was created to address the growing need for standardized guidance on web application security, as the internet became more connected to business operations. At the time, awareness of web application vulnerabilities was low, and there were only a few resources available for developers and security professionals to learn about them.
	The OWASP Foundation was established with the mission of creating free and open resources for improving application security. The Top 10 list quickly became one of its flagship projects, gaining widespread adoption due to its format and practical advice.		The OWASP Foundation was established with the mission of creating free and open resources for improving application security. The Top 10 list quickly became one of its flagship projects, gaining widespread adoption due to its format and practical advice.

			=== Evolution of Methods ===
			The methods used to create the OWASP Top 10 have improved a lot over the years to make them more accurate and fair. Earlier versions focused on a small set of known vulnerabilities and relied heavily on expert opinions. In 2017, OWASP introduced a more structured process, using incidence rates to measure how many applications had at least one instance of a vulnerability. This approach gave a clearer picture of risks across many applications, rather than just counting the number of issues found. By 2021, the process expanded to analyze nearly 400 vulnerabilities (CWEs) and included scores for how easy vulnerabilities were to exploit and their impact. Community surveys were also added to capture new threats and insights from security experts. These changes have made the OWASP Top 10 a strong and reliable guide for dealing with modern security risks.
	=== Major Updates Over the Years ===		=== Major Updates Over the Years ===
	The OWASP Top 10 has had many updates to reflect changing threats and technologies and shifts in attacker behavior. Each update has been built on feedback from security practitioners, data from real-world breach reports, and insights from academic research. Key updates include:		The OWASP Top 10 has had many updates to reflect changing threats and technologies and shifts in attacker behavior. Each update has been built on feedback from security practitioners, data from real-world breach reports, and insights from academic research. Key updates include:
Line 26:		Line 30:
	Each iteration of the OWASP Top 10 comes with detailed documentation, including explanations of the methods used to compile the list, descriptions of each risk, and recommended mitigation strategies.		Each iteration of the OWASP Top 10 comes with detailed documentation, including explanations of the methods used to compile the list, descriptions of each risk, and recommended mitigation strategies.

	== ~~Description of the~~ Categories ==		== OWASP Top 10 Categories ==

	~~=== Step 1 =~~==

	~~+++~~		An OWASP Top 10 category is made up of a group of related vulnerabilities (CWEs) that share a common root cause or theme. Each category focuses on the underlying issue, such as "Cryptographic Failures" or "Misconfigurations," rather than just the symptoms like "Sensitive Data Exposure." On average, a category includes about 19 CWEs, though some have as few as one (like Server-Side Request Forgery) or as many as 40 (like Insecure Design). Categories are also ranked based on factors like how often vulnerabilities occur in real-world applications, how easy they are to exploit, and the impact they can have if exploited. This structure helps developers and organizations focus on fixing the core problems that lead to security issues.

	== References ==		== References ==
Line 37:		Line 39:
	* https://owasp.org/top10		* https://owasp.org/top10
	* https://owasp.org/www-project-top-ten/2017/		* https://owasp.org/www-project-top-ten/2017/
			* https://owasp.org/Top10/A00_2021_Introduction/
	* https://github.com/OWASP/Top10/blob/master/2017-2003_Comparison/OWASP_Top_Ten_-_Comparison_of_2003%2C2004%2C2007%2C2010%2C2013_and_2017_Releases.docx		* https://github.com/OWASP/Top10/blob/master/2017-2003_Comparison/OWASP_Top_Ten_-_Comparison_of_2003%2C2004%2C2007%2C2010%2C2013_and_2017_Releases.docx


	[[Category:Documentation]]		[[Category:Documentation]]

KSzepannek at 17:17, 18 December 2024

2024-12-18T17:17:28Z

← Older revision		Revision as of 17:17, 18 December 2024
Line 1:		Line 1:
	== ~~Summary~~ ==		The OWASP Top 10 is a globally recognized standard that identifies the ten most critical security risks to web applications. Published by the Open Web Application Security Project (OWASP), a non-profit organization dedicated to improving software security, the OWASP Top 10 serves as an important resource for developers, security professionals, and organizations aiming to secure web applications and protect sensitive data from attacks.
			== Purpose and Objectives ==
			The primary goal of the OWASP Top 10 is to raise awareness of web application security vulnerabilities and provide guidance for mitigating these risks. By highlighting the most common and impactful threats, the list helps developers to write secure code, security teams to focus on critical areas and organisations to integrate those practices into their development.

	OWASP and OWASP Top 10		The OWASP Top 10 not only serves as an educational resource but also as a benchmark for compliance standards and as a good foundation for secure coding policies in enterprises. Its purpose is to help collaboration between development and security teams, ensuring that security becomes an integral part of the software development process.
			By providing detailed explanations, real-world examples, and guidance, the OWASP Top 10 helps organizations to understand security risks and implement measures to prevent them.
			== History and Evolution ==
			=== Formation and Early Development ===
			The OWASP Top 10 was first published in 2003 by the OWASP Foundation, which was founded by Mark Curphey and a team of volunteers. The original list was created to address the growing need for standardized guidance on web application security, as the internet became more connected to business operations. At the time, awareness of web application vulnerabilities was low, and there were only a few resources available for developers and security professionals to learn about them.
			The OWASP Foundation was established with the mission of creating free and open resources for improving application security. The Top 10 list quickly became one of its flagship projects, gaining widespread adoption due to its format and practical advice.
			=== Major Updates Over the Years ===
			The OWASP Top 10 has had many updates to reflect changing threats and technologies and shifts in attacker behavior. Each update has been built on feedback from security practitioners, data from real-world breach reports, and insights from academic research. Key updates include:

	~~== Requirements ==~~		• '''2003''': The first list identified issues like "Buffer Overflows," "Cross-Site Scripting (XSS)," and "SQL Injection."

	* Operating system: ~~Ubuntu 18~~.~~04 bionic amd64~~		• '''2007''': This update had a more structured approach to categorize risks and included vulnerabilities like "Insecure Communications" and "Failure to Restrict URL Access."
	* Packages: git emacs

	~~In order to complete these steps~~, ~~you must have followed [[Some Other Documentation]] before~~.		• '''2010''': As web applications became more complex, the 2010 version focused on risks like "Security Misconfiguration" and "Insufficient Transport Layer Protection." This edition also highlighted the importance of secure session management.

	~~== Description ==~~		• '''2013''': This update reflected a growing dependence on third-party components and added a category "Using Components with Known Vulnerabilities" but also authentication and authorization issues.

	~~=== Step 1 ===~~		• '''2017''': The 2017 list introduced modern risks like "XML External Entities (XXE)" and "Insufficient Logging and Monitoring." The addition of these categories reflected trends such as the rise of APIs and the importance of detecting attacks in real time.

	~~Enter these commands in the shell~~		• '''2021''': The most recent update prioritized risks like "Insecure Design" and "Software and Data Integrity Failures."

	~~echo foo~~		Each iteration of the OWASP Top 10 comes with detailed documentation, including explanations of the methods used to compile the list, descriptions of each risk, and recommended mitigation strategies.
	~~echo bar~~

	==~~= Step 2 =~~==		== Description of the Categories ==

	~~Make sure to read~~		=== Step 1 ===

	* War and Peace		+++
	* Lord of the Rings
	* The Baroque Cycle

	== ~~Used Hardware~~ ==		== References ==

	~~[[Device to be used with this documentation]]~~		* https://owasp.org
	~~[[Maybe another device to be used with this documentation]]~~		* https://owasp.org/top10
			* https://owasp.org/www-project-top-ten/2017/
	~~== Courses ==~~		* https://github.com/OWASP/Top10/blob/master/2017-2003_Comparison/OWASP_Top_Ten_-_Comparison_of_2003%2C2004%2C2007%2C2010%2C2013_and_2017_Releases.docx

	* ~~[[A course where this documentation was used]] (~~2017~~, 2018)~~
	* ~~[[Another one]] (2018)~~

	~~== References ==~~

	* https://wikipedia.org
	* https://google.com

	[[Category:Documentation]]		[[Category:Documentation]]

KSzepannek: Initial Creation

2024-12-18T14:58:58Z

Initial Creation

New page

== Summary ==

OWASP and OWASP Top 10

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]