Alexis Kestler
Web applications have become deeply ingrained in how businesses operate today. As companies rely more on web apps to drive key functions, application security risks continue to rise. With data breaches frequently traced back to application vulnerabilities, securing your web apps needs to become a top priority.
In this comprehensive guide, we‘ll do a deep dive on the most significant application security threats and provide actionable steps you can take to protect your organization. As a fellow cybersecurity enthusiast, I‘ll share my insider perspective to help you better understand and mitigate these risks.
OWASP Top 10: Critical Application Security Risks
The OWASP Top 10 list represents an industry-wide consensus on the most impactful application security risks we face today. OWASP, or the Open Web Application Security Project, is an influential organization focused on improving software security. They maintain the Top 10 list as a key resource for organizations to understand the current threat landscape.
Let‘s examine the latest 2021 OWASP Top 10 risks and threats in more detail:
1. Broken Access Control
Broken access control remains the top application security threat on the new OWASP Top 10 list. This occurs when an application fails to properly restrict unauthorized access to sensitive functionality or data. Attackers can exploit these flaws to access privileged actions and information.
For example, a broken access control vulnerability allowed an attacker to access Air Canada‘s mobile API and gain full access to users‘ profiles. The attacker could view full credit card details, passport numbers, phone numbers, email addresses, and more for over 20,000 users.
To mitigate broken access control:
- Adopt a Zero Trust approach – deny by default, verify explicitly
- Implement least privilege access – restrict to only required functions
- Verify user roles and permissions on the server side
- Test access controls to uncover flaws proactively
2. Cryptographic Failures
Applications often fail to utilize encryption correctly. This exposes sensitive data and undermines critical security controls. Common "crypto fails" include:
- Not encrypting data in transit – at least 42% of traffic is unencrypted according to 2021 scans
- Using weak or insecure cryptographic algorithms
- Generating weak encryption keys that are brute forcible
- Improperly storing secrets like encryption keys in code
For example, Exactis exposed 340 million records due to storing unencrypted data in a publicly accessible database. Failing to implement encryption properly can have disastrous consequences.
To avoid crypto fails:
- Transmit data only over encrypted connections – use HTTPS/TLS
- Generate strong encryption keys – sufficient length and proper randomness
- Eliminate use of broken or deprecated encryption algorithms
- Securely manage keys and secrets – don‘t embed in code or repositories
3. Injection
Injection remains a high severity risk – the numerous Equifax, Travelex, and WIRED breaches resulted from injection. Injection happens when untrusted data gets interpreted as commands or queries by the application. Attackers exploit this to execute malicious code and commands on servers.
The most prominent example is SQL injection, which targets database queries. But injection can happen across interpreters like OS commands, LDAP, NoSQL, ORM, and more. A serious injection exploit can lead to data loss, corruption, account takeover, and even full system compromise.
To prevent injection:
- Use prepared statements and parameterized queries
- Validate and sanitize all user-supplied input
- Limit privileges of interpreter processes – run with least privileges required
- Implement input validation and output escaping
According to Veracode‘s State of Software Security Report, injection remains one of the most prevalent vulnerabilities, impacting 18% of applications scanned in 2020. Staying vigilant is key.
4. Insecure Design
Insecure design refers to design-level flaws that undermine security assurances. Examples include:
- Excessive trust placed in client-side code or user input
- Overly complex architectures that inhibit proper security controls
- Difficulty implementing effective access controls due to poor compartmentalization
- Lack of effective lockout mechanisms against brute force login attacks
Such design flaws often lead to authorization failures, sensitivity data leaks, or abuse of application logic. For example, the ability to brute force accounts due to lack of lockout controls led to the massive Collection #1 credential stuffing attack.
Improving application security requires adopting these design principles:
- Fail safely – build in robust error handling
- Compartmentalize components and limit unnecessary dependencies
- Validate data on server side after any client side validation
- Conduct threat modeling to uncover design issues early
5. Security Misconfiguration
Security misconfiguration remains a widespread issue. Examples include unnecessary features enabled, using default accounts, lacking timely patches, improper access controls, and more. These preventable mistakes are often easy opportunities for attackers to penetrate defenses.
A common scenario – a cloud misconfiguration exposed over 540 million Facebook user records. Ensuring proper configuration hardening is essential.
Steps to address misconfigurations:
- Harden systems by disabling or removing unneeded components
- Establish configuration standards and follow principle of least functionality
- Maintain an inventory of components and versions to prioritize patching
- Implement periodic audits and testing to uncover risks
6. Vulnerable Components
With the massive growth in open source usage, vulnerable components have become a leading threat vector. If an application utilizes a component containing vulnerabilities, it inherits those weaknesses.
Common issues include outdated components with known flaws, never patched vulnerabilities, and improper configurations leading to exploits. For example, the major Equifax breach resulted from failure to patch an Apache Struts 2 vulnerability.
To reduce component risks:
- Maintain a complete inventory of all third party libraries in use
- Monitor security notifications and updates for components
- Prioritize upgrading vulnerable components quickly
- Securely configure components according to best practices
- Consider substituting vulnerable components with safer alternatives
7. Identification and Authentication Failures
Flawed authentication implementations continue to plague applications. Weak passwords, broken logout processes, session management issues, and lack of multi-factor authentication (MFA) pose serious risks.
Stolen credentials remain the top attack vector in data breaches. Strengthening authentication defenses is imperative. Steps to take:
- Enforce strong password policies – lengths, complexity, rotation
- Implement MFA, especially for sensitive accounts
- Properly manage user sessions – expiration, renewal, timely logout
- Limit login attempts to deter brute forcing
- Transmit credentials only over encrypted connections
8. Software and Data Integrity Failures
The integrity of software code and data is foundational to security. Compromising integrity enables adversaries to modify data or execute unauthorized code.
Main causes include:
- Lack of integrity checks allowing arbitrary data modification
- Ability to tamper with execution logic through code injection
- Circumventing access controls via privilege escalation
An example is the infamous SolarWinds supply chain attack that compromised code integrity to insert a backdoor. Maintaining integrity is critical. Steps to take include:
- Implement code signing to validate authenticity
- Store sensitive data encrypted to hinder manipulation
- Monitor for unauthorized changes through hashing and auditing
- Enforce principle of least privilege
9. Security Logging and Monitoring Failures
According to Verizon‘s 2021 Data Breach Investigations Report, the vast majority of breaches took weeks or more to detect due to lacking monitoring. Robust logging and effective monitoring is pivotal for rapid breach detection and response.
Common deficiencies include:
- Inadequate log storage, retention, and centralization
- Lack of verbose logging for access and changes
- Failure to monitor and analyze logs for anomalies
- Absence of audit trails for critical events
To address these gaps:
- Increase log storage with sufficient retention policies
- Centralize logs into a security information and event management (SIEM) system
- Actively monitor logs with alerts tuned for critical threats
- Perform log audits and forensics to uncover risks
- Maintain detailed audit trails for access and changes
10. Server-Side Request Forgery (SSRF)
A server-side request forgery attack tricks the application into making arbitrary internal or external requests not intended by the developer. This can enable attackers to pivot to internal systems, access resources behind firewalls, or launch denial of service attacks.
To reduce risk:
- Whitelist allowed domains and block requests to IPs
- Validate and sanitize all server-side input
- Disable access to internal systems not required for the application
- Monitor and log outbound requests from the application
While I‘ve only scratched the surface on these critical risks, taking steps to mitigate the OWASP Top 10 will significantly improve your overall security posture. Now let‘s talk more about building an effective application security program.
Building an Application Security Program
With application security threats on the rise, organizations need to take app sec much more seriously. A strategic application security program is essential to managing risks.
Based on my experience, these are key elements every app sec program needs:
Secure SDLC – Incorporate security practices throughout the entire software development lifecycle. Train developers on secure coding. Conduct architectural risk analysis. Perform static and dynamic application testing. Run penetration tests. The earlier you find and fix flaws, the better.
Vulnerability management – Actively scan applications and infrastructure to identify vulnerabilities and misconfigurations. Maintain a vulnerability management program for tracking, prioritizing, and patching flaws.
Application hardening – Harden apps by removing unnecessary functionality, disabling unused components, restricting access, applying latest patches, and properly configuring all elements.
Drift detection – Detect configuration drift from secure baselines to identify risky changes that may introduce vulnerabilities.
Runtime protection – Deploy web application firewalls and runtime application self protection controls to prevent and monitor attacks against running apps.
Logging and monitoring – Collect, aggregate, retain, and monitor logs to detect attacks against applications in real-time. Feed logs into your SIEM for correlation and alerts.
Incident response – Establish an incident response plan tailored for application security events like breaches of production apps. Ensure capability to swiftly detect, contain, and recover.
Security testing – Continuously test applications for security flaws through SAST, DAST, IAST, and pentesting. Incorporate security unit testing for developers.
Training – Institute secure coding training for developers. Educate teams on risks, controls, and best practices for application security.
Risk management – Identify application security risks, determine potential business impacts, and prioritize remediation. Tie risks to data classification and protection requirements.
Collaboration – Foster collaboration between security and development teams. Align on addressing risks while enabling development velocity.
Building a comprehensive application security program requires substantial effort but pays huge dividends in risk reduction. Gaining executive support and funding is key. But with diligent focus, organizations can implement app sec programs that enable secure development and protect critical applications.
Final Thoughts
As companies rely increasingly on web and mobile applications, application security is more important than ever. The risks are definitely real, as evidenced by frequent headline-grabbing application breaches. By understanding and mitigating the OWASP Top 10 and incorporating robust application security controls, companies can develop, deploy and run applications much more safely.
If you found this guide helpful or have feedback to improve it, I‘d love to hear from you! Reach out to me on Twitter @secureapps. And stay tuned for more articles diving deep on application security topics. By working together as a community, we can collectively uplift our application security game.
