I took one peek at the new OWASP top-10, and wasn't very surprised. Bad security policies and passwords on post-it notes is still my #1 worry. If you think you are up-to-date, the one to focus on is A6. A lot of recent issues in the wild relate to debug code leaking info or opening back doors. It's generally not the exploit of a script kiddie, but instead an old disgruntled employee.
The question to ask yourself: "How many people have we let go in the last year?"
* A1: Injection
* A2: Cross-Site Scripting (XSS)
* A3: Broken Authentication and Session Management
* A4: Insecure Direct Object References
* A5: Cross-Site Request Forgery (CSRF)
* A6: Security Misconfiguration
* A7: Insecure Cryptographic Storage
* A8: Failure to Restrict URL Access
* A9: Insufficient Transport Layer Protection
* A10: Unvalidated Redirects and Forwards
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment