OWASP and Secure Coding Practices

OWASP Overview

• OWASP (Open Web Application Security Project) is a nonprofit foundation.
• It aims to improve software security through community-led open source projects.
• This includes educational resources, training, and conferences.
• OWASP serves as a resource for developers and technologists looking to secure the web.
• It was founded in December 2001.

Secure Coding Practices

• The goal is to maintain the confidentiality, integrity, and availability of information.
• This can be achieved by implementing security controls to mitigate software vulnerabilities.
• Software security flaws can be introduced at any stage of the Software Development Lifecycle (SDLC).
• This includes not identifying security requirements upfront as well as introducing flaws during maintenance or updating
• Secure coding practices should be checked for Input validation, output encoding, Authentication, Access control, and Cryptographic practices.
• Error handling, databse, file and memroy management are important security areas.

Input Validation

• It ensures that only properly formatted data is entered into the system.
• Protecting the database from malformed or corrupted data.
• Examples include setting minimum/maximum value ranges and utilizing data type validators.
• Encode data to a common character set.

Authentication and Password Management

• Concerned with securely storing passwords to prevent attackers from obtaining them, even if the database is compromised.
• Authentication should fail securely.
• Password hashing needs to be implemented on a trusted system,
• Use centralized implementations for authorization
• Enforce password complexity requirements.
• Do not allow password hardcoding.

Session Management

• A web session is a sequence of network HTTP request and response transactions associated with the same user.
• It requires retaining user information during the session.
• The session ID or token binds the user's authentication credentials to the user's HTTP session traffic.
• Logout functionality should fully end the session and be available from all protected pages.
• Session inactivity timeout that is as short as possible needs to be established.
• A new session identifier should be generated on any re-authentication.
• Do not allow concurrent logins with the same user ID.

Cryptographic Practices

• Industry-standard cryptographic practices are crucial in various stages of web applications.
• This includes data entry, transmission, and storage.
• Cryptographic modules should fail securely.
• All random numbers need generation using a cryptography-approved random number generator.
• Only established cryptography-approved functions should be used.
• Cryptographic modules should comply with FIPS 140-2 or equivalent standards.

Error Handling and Logging

• Error handling involves anticipating, detecting, and resolving programming, application, and communication errors.
• Improper error handling can expose internal error messages, stack traces, or database dumps, leading to security problems.
• Sensitive information should not be disclosed in error responses.
• Error handlers should not display stack trace information (methods and calls).
• Generic error messages should be implemented.
• All logging controls should be implemented.
• Sensitive information should not be stored in logs.
• All input validation failures should be logged for future reference.

Database Security

• It encompasses a range of security controls designed to protect the DBMS (Database Management System).
• The database should be isolated as much as possible.
• The DBMS must be properly configured and hardened.
• Monitoring and auditing processes must be arranged accordingly.
• Strongly typed parameterized queries need to be utilized.
• Input validation and output encoding also need to be utilized.
• Variables need regulation and strong typing.
• The connection should be closed as soon as possible.
• Default accounts should be disabled.
• All unnecessary database functionality should be turned off.

Memory Management

• It is the process of controlling and coordinating how a software application accesses computer memory.
• Ensure long-term validity and program reliability
• Good memory management need strict programming discipline.
• The buffer should be double-checked to ensure that it is as large as specified.
• Allocated memory should be properly freed after function completion.
• Input and output control should be utilized for untrusted data.
• You should close resources specifically and not rely on garbage collection.

OWASP Top 10 Web Application Security Risks

• Injection Vulnerabilities
• Broken Authentication
• Sensitive Data Exposure
• XML External Entities (XXE)
• Broken Access Control
• Security Misconfiguration
• Cross-Site Scripting (XSS)
• Insecure Deserialization
• Using Components with Known Vulnerabilities
• Insufficient Logging & Monitoring

Injection Vulnerabilities

• Occur when untrusted data is sent to an interpreter as part of a command or query.
• An attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
• SQL injection is the placement of malicious code in SQL statements via web page input.

Broken Authentication

• Occurs when Authentication and session management is misimplemented.
• Allows attackers to compromise passwords, keys, or session tokens and bypass the authentication.
• Credential Stuffing, brute force access and Session hijacking are primary attacking patterns.

Sensitive Data Exposure

• Occurs when Many web applications don't protect sensitive data, such as financial and healthcare data.
• All Sensitive data must be protected at various data lifecycles.
• Sensitive data may be compromised without encryption at rest or in transit.

XML External Entities (XXE)

• XML external entities are custom XML entities with values loaded from outside the Document type definition.
• These entities allow definitions based on a file path or URL, creating security vulnerabilities.

Broken Access Control

• Restrictions on what authenticated users are allowed to do not get enforced.
• The attacker can exploit flaws to access unauthorized functionality and/or data.

Security Misconfiguration

• It is the most commonly seen vulnerability.
• This usually results from insecure default configurations, incomplete configurations, and verbose error messages with sensitive information.

Cross-Site Scripting (XSS)

• XSS attacks enable attackers to inject client-side scripts into web pages viewed by public users.
• An attacker could send a victim a misleading email with a link containing malicious JavaScript.
• May allow cookies to be stolen and an account to be taken over.

Insecure Deserialization

• Serialization converts data structures into a format for storage or transmission.
• Insecure deserialization can lead to remote code execution or creating a backdoor.
• Untrusted sources, lack of verification, and not checking for integrity are common causes.

Using Components with Known Vulnerabilities

• Using libraries, frameworks, and other software modules, can have the same running privileges as any application to which they contribute.
• If a vulnerable component or library is exploited it can cause data loss or takeover a server.
• Vulnerabilities in components can allow an unauthenticated attacker to execute arbitrary code on a targeted system.

Insufficient Logging & Monitoring

• Failure to adequately log, monitor, and report security events makes detecting suspicious behavior difficult.
• It increases the chances that applications will be exploited by an attacker undetected.
• Logging and monitoring makes it difficult for attackers to go un-noticed, preventing an application flaw being exploited and utilized.