Une nouvelle version de l’OWASP Top 10 et peu de changement

L’OWASP, Open Web Application Security Project, se prépare à publier une nouvelle version de son fameux top 10. Celle-ci devrait être diffusée en juillet ou août 2017 après une consultation publique se terminant le 30 juin 2017.

un petit clic pour ma veille

Cliquer pour accéder à OWASP-Top-10-2017-RC1-English.pdf

Cette nouvelle version intègre en particulier 2 nouvelles catégories qui se décrivent de la manière suivante:

Insufficient attack protection“: “The majority of applications and APIs lack the basic ability to detect, prevent, and respond to both manual and automated attacks. Attack protection goes far beyond basic input validation and involves automatically detecting, logging, responding, and even blocking exploit attempts. Application owners also need to be able to deploy patches quickly to protect against attacks.”

Unprotected APIs”: “Modern applications often involve rich client applications and APIs, such as JavaScript in the browser and mobile apps, that connect to an API of some kind (SOAP/XML, REST/JSON, RPC, GWT, etc.). These APIs are often unprotected and contain numerous vulnerabilities.”

Pour en savoir plus, la page du Top 10 OWASP:

OWASP Top Ten

The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. Globally recognized by developers as the first step towards more secure coding. Companies should adopt this document and start the process of ensuring that their web applications minimize these risks.

Et également à lire ici:

2017 OWASP Top 10 is out, you can submit your comment until June

This week the Open Web Application Security Project (OWASP) presented the first release candidate for the 2017 OWASP Top 10, the principal novelty is the presence of two new vulnerability categories. The new categories introduced for OWASP Top 10 – 2017: « insufficient attack detection and prevention » « unprotected APIs. »

Veilleur et spécialiste en cybersécurité

Newsletter