Welcome to the final article in our blog series on the OWASP Top 10 Security Vulnerabilities. In this article, we’ll take a detailed look at OWASP Top 10 2017 A10 – Insufficient Logging & Monitoring. Audit Trail Vulnerabilities: Insufficient Logging and M...
In 2017, OWASP added a new vulnerability to the Top 10 list: A8 Insecure Deserialization, in place of the previous #8 vulnerability, Cross-Site Request Forgery. According to OWASP, “Insecure deserialization often leads to remote code execution. Even...
What is Access Control? Access control (authorization) determines which users can interact with what systems and resources within your company. When access control is broken, users could send unauthorized requests to your applications. Unauthorized access to ...
C# OWASP Top 10: How to Discover Vulnerabilities in a C# Web Application In this article, you’ll learn the top 10 security issues in web applications, as defined by the Open Web Application Security Project (OWASP Top 10 – 2017). For each issue, you...
Many applications provide a services layer (to other applications, to a presentation layer, etc.). Or, they consume services exposed by third-parties (not necessarily trusted). A REST model is a simple, widely-used way for designing such service layers. This ...
Legacy “business-oriented” languages present unique challenges for software security. Unfortunately, there is a lack of awareness about the security risks of these languages. In this post, we will focus on the security vulnerabilities inherent in busin...
Common Weakness Enumeration (CWE) is a software and hardware weaknesses classification system. It’s an extension of the Common Vulnerabilities and Exposures (CVE) list compiled by MITRE. This federally funded, non-profit organization manages research and deve...
As the cybersecurity landscape becomes increasingly complex, it’s essential for organizations to stay informed about the tactics most likely to be used against them. In 2023, SQL injection attacks accounted for 23% of all critical web application vulner...
SAST (also called “white box testing”) is the basic form of security testing for application development. It involves examining the uncompiled application source code to determine whether and where security vulnerabilities exist. This form of security testing...
Application security is no longer an afterthought. Developers now prioritize security due to the exponential risk of cybercrime. Developers need to pay more attention to security as it is a crucial aspect of app development. Application security solutions lik...
Open source software is good for your business since it allows you the freedom to modify it, so it meets all your company requirements. Aside from excellent security, the software is also cost-effective since you don’t have to worry about overpaying to use re...
Understanding How External Entities Attack XML Files Extensible Markup Language (XML) files are plain-text files that describe data behavior as that data relates to a connected network or server application. If you open an XML file, you’ll see code describing...
