Proactive Controls OWASP Foundation

API injections involve malicious data or code being inserted into an API, posing risks like unauthorized access and data breaches. Our data show injections constitute the largest single API risk group, so we recommend you treat them as a critical part of your API security program. Logging and monitoring helps detect, escalate, and respond to active breaches; without it breaches will not be detected. The Cheat Sheets provide guidance on sufficient logging and also provide for a common logging vocabulary.

A lack of input validation and sanitization can lead to injection exploits,
and this risk has been a constant feature of the OWASP Top Ten since the first version was published in 2003. These vulnerabilities occur when hostile data is directly used within the application
and can result in malicious data being used to subvert the application; see A03 Injection for further explanations. The OWASP Top Ten is a very well known list of web application security risks,
and is included by the OWASP Software Assurance Maturity Model (SAMM)
in the Education & Guidance practice within the Governance business function.

Secure coding practices – Part 2

Those same vetted security requirements provide solutions for security issues that have occurred in the past. The list goes on from injection attacks protection to authentication, secure owasp proactive controls cryptographic APIs, storing sensitive data, and so on. As developers prepare to write more secure code, though, they’re finding that few tools are designed with software writers in mind.

Also, developers should be made aware of the need to adhere to recommended password length, complexity, and rotation policies. Implement regular security testing (including code reviews and vulnerability assessments) to identify and fix cryptographic weaknesses, and also consider using secure cryptographic libraries too. Regular security audits and code reviews are a must to identify and fix access control issues, and multi-factor authentication should be enforced to limit unauthorized access. To compile its top 10 list of security vulnerabilities OWASP regularly gathers data from more than 200,000 organizations and from surveys of industry professionals. For any of these decisions, you have the ability to roll your own–managing your own registration of users and keeping track of their passwords or means of authentication.

Enforce access controls

Take care to prevent untrusted input from being recognized as part of an SQL command. Turn on security settings of database management systems if those aren’t on by default. Next, you review how the application stacks up against the security requirements and document the results of that review.

The aim of this common vocabulary is to provide logging that uses a common set of terms, formats and key words;
and this allows for easier monitoring, analysis and alerting. Perhaps one of the easiest and most effective security activities
is keeping all the third party software dependencies up to date. If a vulnerable dependency is identified by a malicious actor during the reconnaissance phase of an attack
then there are databases available, such as Exploit Database, that will provide a description of the exploit. These databases can also provide ready made scripts and techniques for attacking a given vulnerability,
making it easy for vulnerable third party software dependencies to be exploited . Systems and large applications can be configurable, and this configuration is often used to secure the system/application.

OWASP Proactive Control 4 — encode and escape data

Injection attacks exploit vulnerabilities in input validation and inadequate data handling. Attackers inject data such as SQL queries, code snippets, or commands into web application forms or URLs. They allow adversaries to access sensitive data and manipulate an application’s behavior. It lists security requirements such as authentication protocols, session management, and cryptographic security standards. Most importantly, the ASVS provides a phased approach to gradually implement security requirements as you are making your first steps. Security requirements are categorized into different buckets based on a shared higher order security function.

The process begins with discovery and selection of security requirements. In this phase, the developer is understanding security requirements from a standard source such as ASVS and choosing which requirements to include for a given release of an application. The point of discovery and selection is to choose a manageable number of security requirements for this release or sprint, and then continue to iterate for each sprint, adding more security functionality over time. The process includes discovering / selecting, documenting, implementing, and then confirming correct implementation of new security features and functionality within an application. OWASP’s Proactive Controls can provide concrete practical guidance to help developers build secure software, but getting developers motivated to write secure code can be challenging.