Une nouvelle version de l’OWASP Top 10 et peu de changement

In Sécurité de l'info
Déroulez ici

L’OWASP, Open Web Application Security Project, se prépare à publier une nouvelle version de son fameux top 10. Celle-ci devrait être diffusée en juillet ou août 2017 après une consultation publique se terminant le 30 juin 2017.

Cliquer pour accéder à OWASP-Top-10-2017-RC1-English.pdf

Cette nouvelle version intègre en particulier 2 nouvelles catégories qui se décrivent de la manière suivante:

Insufficient attack protection“: “The majority of applications and APIs lack the basic ability to detect, prevent, and respond to both manual and automated attacks. Attack protection goes far beyond basic input validation and involves automatically detecting, logging, responding, and even blocking exploit attempts. Application owners also need to be able to deploy patches quickly to protect against attacks.”

Unprotected APIs”: “Modern applications often involve rich client applications and APIs, such as JavaScript in the browser and mobile apps, that connect to an API of some kind (SOAP/XML, REST/JSON, RPC, GWT, etc.). These APIs are often unprotected and contain numerous vulnerabilities.”

Pour en savoir plus, la page du Top 10 OWASP:

Category:OWASP Top Ten Project – OWASP

The OWASP Top 10 is a powerful awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.

Et également à lire ici:


La newsletter