Transcription of OWASP Top 10 - 2013
1 10 O OWASP 2003 2013 The OWASP Foundation 2011 2013 OWASP Creative Commons Attribution ShareAlike license . , . , , , . , . OWASP Top 10 . Top 10 . , , , (MITRE, PCI DSS, DISA, FTC ) Top 10 . OWASP Top 10 10 . OWASP Top 10 2003 2004 2007 , 2010 . 2013 . Top 10.
2 , .. , .. OWASP Top 10 . , .. OWASP . OWASP ( OWASP ) , , , . OWASP . , , . OWASP , , , . OWASP , , .. OWASP . , , , . OWASP .
3 OWASP . OWASP . OWASP , , , , OWASP . OWASP . OWASP ! OWASP Top 10 2013 . 2010 Top 10 , . 2010 Top 10 A6: , . OWASP Top 10 2013 7 8 . , 500,000 . Top 10 , , , . OWASP Top 10 , , , , . Top 10.
4 Top 10 . Top 10 OWASP OWASP .. OWASP OWASP .. Top 10 . , . Top 10 , .. OWASP (ASVS) .. , . , .. (SAMM) the Rugged Handbook . 2003 OWASP Top 10 , , Aspect Security Jeff Williams Dave Wichers . 2013.
5 Aspect Security HP Statistics from both Fortify and WebInspect Minded Security Softtek Trustwave, SpiderLabs (50 ) Veracode WhiteHat Security Inc. Top 10 . , Top 10 . Top 10 , . Adam Baso (Wikimedia Foundation) Mike Boberski (Booz Allan Hamilton) Torsten Gigler Neil Smithline (MorphoTrust USA) For producing the wiki version of the Top 10, and also providing feedback , Top 10 2013 , . I RN 2010 2013 . , , . , OWASP Top 10.
6 2013 : 1)Top 10 ( ) . , . A2 A3 . 2)Top 10 (CSRF) 2010 -A5 2013 -A8 . CSRF 6 OWASP Top 10 , SCRF . 3) URL 2010 URL +2010-A8: URL 2013-A7: . URL , 4)2010-A7 2010-A9 2013-A6: : 2010-A7 2010-A9 , . , (2013-A4 2013-A7 ).
7 5)2013-A9: : + 2010-A6 , . OWASP Top 10 2010 ( ) OWASP Top 10 2013 ( ) A1 A1 A3 A2 A2 (XSS) A3 (XSS) A4 A4 A6 A5 A7 A9 A6 A8 URL A7 A5 (CSRF) A8 (CSRF) <A6 : > A9 A10 A10 A9 2010 -A7 2013 -A6( ) Weakness Attack Threat Agents Impact Weakness Attack Attack Vectors Security Weaknesses Technical Impacts Business Impacts Attack Impact Impact Asset Function Asset Weakness Control Control Control Weakness Security Controls Risk OWASP OWASP / FAIR (STRIDE DREAD) ?
8 OWASP Top 10 . OWASP .. , . , . , / .. TOP10 , . , . ?.
9 / SQL, , LDAP .. A1 , , ID . A2 XSS . XSS , , . A3 (XSS) , , . , . A4 , , , , . , .. A5.
10 , . , . A6 UI . , .. A7 CSRF HTTP .. A8 (CSRF) , , .. , . A9 , .. A10 OWASP Top 10 2013 T10 /.
