2.3 OWASP Modeling for Blockchain
OWASP (Open Web Application Security Project)
OWASP is a non-profit organization focused on improving the security of software and web applications. It provides free, open-source resources, tools, and guidance to help developers and organizations identify and mitigate security risks. OWASP is widely respected in the cybersecurity community and is particularly known for its role in raising awareness of web application security.
Key Contributions of OWASP:
Guidelines & Best Practices: OWASP offers various security guides and frameworks that assist in building secure software.
Tools: Tools like OWASP ZAP (Zed Attack Proxy) and OWASP Dependency-Check are used for finding vulnerabilities in applications.
Training & Events: OWASP organizes conferences, workshops, and community activities to educate developers and security professionals about cybersecurity.
Documentation: OWASP maintains resources like the OWASP Cheat Sheet Series, a collection of best practices for developers.
OWASP Top 10
The OWASP Top 10 is a list of the most critical web application security risks, compiled and regularly updated by OWASP based on the real-world data collected from various security professionals and organizations. It serves as a comprehensive guide for developers, organizations, and security teams to understand the most common vulnerabilities and how to address them.
OWASP Top 10 - 2021:
Broken Access Control
Access control issues allow unauthorized users to access restricted resources or perform actions they shouldn’t be able to. This is one of the most common security vulnerabilities.
Examples: Privilege escalation, unauthorized file access, bypassing authentication.
Cryptographic Failures
This category covers problems with encryption or improper handling of sensitive data, leading to exposure.
Examples: Weak or outdated cryptographic algorithms, improper key management, failure to encrypt sensitive data like passwords.
Injection
Includes SQL injection, command injection, and other types of injection attacks that exploit input fields to inject malicious code.
Examples: SQL injection, XML injection, LDAP injection.
Insecure Design
Insecure design refers to vulnerabilities in the design phase of a web application. This can result from poor architectural decisions or failure to incorporate security into the design.
Examples: Lack of proper security controls, flawed system architecture.
Security Misconfiguration
Security misconfigurations happen when software or systems are not securely configured, leaving them open to attacks.
Examples: Default credentials, unnecessary services enabled, overly permissive permissions.
Vulnerable and Outdated Components
This refers to using outdated software libraries, frameworks, or components that have known security vulnerabilities.
Examples: Using old versions of libraries, failure to patch vulnerabilities in third-party components.
Identification and Authentication Failures
Weak authentication mechanisms or improper implementation of user authentication can lead to account takeover or unauthorized access.
Examples: Insufficient password policies, weak multi-factor authentication (MFA), broken session management.
Software and Data Integrity Failures
This category concerns the failure to protect data integrity, preventing unauthorized modification of code or data.
Examples: Code injection attacks, untrusted software updates, using weak hashing algorithms.
Security Logging and Monitoring Failures
Failure to log and monitor security events leaves organizations vulnerable to undetected attacks or data breaches.
Examples: Lack of proper logging, missing alerts for suspicious activities.
Server-Side Request Forgery (SSRF)
SSRF attacks occur when an attacker is able to send arbitrary requests from the server-side application to internal or external systems, bypassing firewall rules or access controls.
Examples: An attacker can manipulate a vulnerable URL request to access internal resources like metadata endpoints or private servers.
Last updated
