OWASP Released Top 10 Proactive Controls that Software Developers to Keep in Mind
OWASP released Top 10 Proactive Controls for Software developers describing the more critical areas that software developers must focus on.
The OWASP Top 10 Proactive Controls 2018 contains a list of security techniques that every developer should consider for every software project development.
“OWASP Top Ten Proactive Controls similar to OWASP Top 10 but it focussed on defensive techniques and controls as opposed to risks.” reads OWASP Document.
The Proactive Controls list starts by defining security requirements derived from industry standards, applicable laws, and a history of past vulnerabilities.
Top 10 Proactive Controls
List of Top 10 Proactive Controls ordered from 1 to 10 based on the importance.
C1: Define Security Requirements C2: Leverage Security Frameworks and Libraries C3: Secure Database Access C4: Encode and Escape Data C5: Validate All Inputs C6: Implement Digital Identity C7: Enforce Access Controls C8: Protect Data Everywhere C9: Implement Security Logging and Monitoring C10: Handle All Errors and Exceptions
Define Security Requirements
Security requirements provide needed functionality that software needs to be satisfied. It is derived from industry standards, applicable laws, and a history of past vulnerabilities.
Instead of having a customized approach for every application, standard security requirements may allow developers to reuse the same for other applications.
Leverage Security Frameworks and Libraries
Third party libraries or frameworks into your software from the trusted sources, that should be actively maintained and used by many applications. Leveraging security frameworks helps developers to accomplish security goals more efficiently and accurately.
Secure Database Access
This section summarizes the key areas to consider secure access to all data stores.
1. Secure queries 2. Secure configuration 3. Secure authentication 4. Secure communication
Encode and Escape Data
Encoding and escaping plays a vital role in defensive techniques against injection attacks. The type of encoding depends upon the location where the data is displayed or stored.
Validate All Inputs
Only the properly formatted data should be allowed entering into the software system. The application should check that data is both syntactically and semantically.
Implement Digital Identity
Digital Identity is the way to represent the online transaction, below are the OWASP recommendations for secure implementation.
Enforce Access Controls
Access Controls involves the process of granting or denying access request to the application, a user, program, or process. Below are the OWASP Guidelines.
Design Access Control Thoroughly Up Front
Force All Requests to Go Through Access Control Checks
Deny by Default
Principle of Least Privilege
Don’t Hardcode Roles
Log All Access Control Events
Protect Data Everywhere
It is important to securely store the sensitive data such as passwords, credit card numbers, health records, personal information and business secrets as it particularly falls under EU’s General Data Protection Regulation GDPR and PCI DSS regulations.
Data classification based on the sensitivity is important.
Encrypting Data in Transit
Encrypting Data at Rest
Secret Key Lifecycle
Mobile Application: Secure Local Storage
Application Secrets Management
Implement Security Logging and Monitoring
Logging security information during the runtime operation of an application. Monitoring is the live review of application and security logs using various forms of automation.
Security Logging Implementation
Logging for Intrusion Detection and Response
Secure Logging Design
Handle all Errors and Exceptions
Error handling allows the application to correspond with the different error states in various ways. Some attacks may trigger error’s that helps in attack detection.