Hello, and welcome back to the last Stockton security fundamentals course.
As you should know, this course was developed. According to
the WASP, top 10, 2017 addition, the latest
version available. When it was first published by
September 20, 21, a new edition was published not
only with the new graphic design. But with what
seems to be a disruptive approach.
With the new owasp top 10 20, 21 Edition does
this course becomes obsolete. How
different is the 20 21 Edition. From the previous one?
These are some of the questions that drove us to update. This
course resulting in two new chapters. Let's
start answering the second question. How different are
the 2021 and 2017 editions. Hopefully,
it will help you draw your own conclusions. To
answer. The former question. The last top 10
has been a mix of symptoms and root cause
Has sensitive detects Bossier, the
top three risk in the 2017 Edition is a scene
from while security Miss configuration top. Six
in the 2017 Edition is a root. Cause for
the 2021 addition, the last ten
project team decided to focus solely on root causes.
So what happened with
the symptoms from the previous editions. Did they
disappear from the top 10? Aren't they risk anymore?
Taking sensitive detects poster as an example in the
2021, Nova's top 10 Edition this risk
moved into a category named after the root cause cryptographic
failures.
What happened with the injection and cross-site scripting
risks from the 2017 Edition is, another
example of what makes these new owasp top 10 Edition
look like completely different. But in fact not
that different, although it has
dropped to the third position. Since injection is
a root cause and contributed data supports. It has one of the
web application. Most critical risks. It was kept as
part of the top 10. On the other hand cross-site
scripting is a symptom and by definition
Type of injection, although it has been in the
top ten side-by-side with an injection category at least,
since 2010 in this new edition cross-site scripting
was moved into the injection category. This
is the big picture of what has changed.
Only the insecure design, and server-side request forgery categories.
Do not have some sort of Correspondence in the 2017 Edition
and can be called new. Nevertheless,
checking the CW is mapped
into the insecure design category. We find the cwe 209,
generation of error
message. Containing sensitive information. What
in the WASP top 10. 2017 was considered a
security Miss configuration.
If you've already completed the security misconfigurations session of
this course, then you've witnessed an insecure design
weakness. Therefore, only the
server side request forgery is really knew by
now. I hope you agree that the 20 21 Edition
is not that different from the 2017. Addition, in
terms of the most critical security risks a
web application faces nowadays, and that
should answer our other question. Is this course obsolete.
Definitely not. Does it still covers the last top? 10
fundamentals? Yes.
There are other noticeable differences such as the new
Factor table that replaces the previous one, with information about
threat, agents attack. Vectors the security weakness itself
and impacts understand display
data factors. You should be familiar with the following concepts.
CW, e or a common weakness. Enumeration is
a community developed list of software and Hardware weakness
types. It serves as a common language
and measuring stick for security tools and
as a baseline for weakness, identification mitigation
and prevention efforts.
CVS yes, or a common vulnerability scoring
system is an open framework for communicating. The
characteristics and severity of software vulnerabilities.
CVS consists of
three metric, groups base, temporal and
environmental the base. Matrix produces score
ranging from 0 to 10, which can
then be modified by scoring the temporal and environmental metrics
CV or
a common vulnerabilities and exposures.
Identifies defines and catalogs public,
disclosed cyber security vulnerabilities. There
is one CV record for each vulnerability in
the catalog. The vulnerabilities are
discovered than assigned and published by organizations from
around the world that have partnered with the CV
program.
To put everything in place when a researcher finds a
new vulnerability, he or she should report it to the software
vendor Computing, a CVS's score for the
finding will help communicate exploitability. And
in fact, as mapping it to Common weaknesses will
help the vendor to understand and address the issue. Once
the fact it software vendor releases a new version of
its software with a vulnerability. Patched details about
the security weakness should be made public spreading
this information.
Mission will help organizations to update the affected systems requesting
a CV. Number implies that the vulnerability will
be added to the database of known security vulnerabilities, and
push to all those who subscribe to database updates to
keep up with the new vulnerabilities.
That being said, you should now be able to handle the data presented
in the new tables. But before you're better at
reading, the data Factor section in the introduction.
Note that instead of a range from one low 23 high
as given by the WASP risk rating methodology exploitability
and impact scores are now
given on a 10 point Scale based on the corresponding CVS.
Yes, sub scores.
If you have completed all previous sessions, this is the
right time to read owasp top, 10, 20 21. All
the changes are well, documented and explained in the introduction section.
Otherwise, I recommend you to
go back and start the course from the beginning.
To make you feel more comfortable and confident regarding
the new owasp top 10, 20 21. We've
decided to add an extra session to cover the new top, 10 server-side
request forgery category. Although contributed
data shows a relatively low incidence rate with
above-average, testing coverage, along with above
average, ratings for exploit, and impact potential. This
category was added because the security Community
says it is relevant. And so let's hack Juice
Shop again.