Summary of Web Application Security Risks: A Look at OWASP Top Ten 2017 - Christian Wenz

00:00:00 - 00:55:00

The video discusses the OWASP Top Ten 2017 list of web application security risks and provides mitigation strategies for each. Injection, cross-site scripting, and broken access controls are among the most common risks, and the video explains how to prevent and protect against them.

• 00:00:00 This talk will discuss the OWASP Top Ten 2017, which is a list of security risks that might occur in web applications. Christian Wenz covers the first item on the list, injection, and how to protect yourself from it. There are also changes to cross-site scripting and Broca access control, which are new to the list this year.
• 00:05:00 Web Application Security risks are listed in order of severity, with SQL injection being the most common and easily exploited. OWASP recommends using a up-to-date version of the OWASP Mapper to prevent CQ injection, and using prepared statements or parametrized queries to prevent commands and data from being in the same string.
• 00:10:00 The video discusses the OWASP Top Ten 2017 list of web application security risks and discusses how to mitigate them. Session management is one of the most commonly attacked risks, and making sure session IDs are only transported via HTTPS and have short timeout values is important.
• 00:15:00 Cross-site scripting (XSS) is a type of web application attack in which malicious code is injected into a user's web browser, allowing the attacker to execute arbitrary commands in the victim's browser. XSS attacks are particularly devastating because they can be performed without the user's knowledge or consent, and can be exploited to take control of a user's browser.
• 00:20:00 Christian Wenz discusses the risks associated with cross-site scripting (XSS) in web applications, and how to mitigate them using a cross-site scripting protection header. He also mentions that Internet Explorer 8 introduced some security features which have since been adopted by other browsers.
• 00:25:00 The video discusses the risks associated with web application security, focusing on the OWASP Top Ten 2017 list of risks. The video provides an example of how a web application might enforce security policies, using a controller to check if a user's IP address matches a specific list of allowed addresses.
• 00:30:00 This YouTube video discusses how content security policies can help protect against cross-site scripting attacks. The video explains that by default, inline JavaScript code is disabled in content security policies, and that this can limit the effectiveness of cross-site scripting attacks. New features in content security policy version 2 make it harder for attackers to inject malicious code.
• 00:35:00 Web application security risks are discussed in this YouTube video, including the risks of broken access controls, mass assignments, and model binding.
• 00:40:00 Web application security risks include back entry, sensitive data exposure, and management.
• 00:45:00 Web application security risks were discussed in this video, including the OWASP Top Ten list of 2017 risks. One of the risks on the list is insufficient attack protection, which means that if an attacker is successful in attacking a business, they should be able to find out information about the vulnerabilities exploited. One quick way to increase attack protection is to quickly install patches. Across the request forgery and cross request fortress risks, it was explained that by changing the WPA2 key on a router, an attacker can spoof a request made to a different site.
• 00:50:00 This video discusses the 10 most common web application security risks, and how to mitigate them. Among these are cross-site request forgery (CSRF), clickjacking, and injection of malicious code into APIs.
• 00:55:00 This YouTube video discusses the OWASP Top Ten 2017, which includes a list of the top 10 risks to web application security. One of the risks on the list is fishing, which is when a user goes to a website and tries to guess their password in order to gain access to their account. This video explains how to prevent this attack by adding a rel=noopener attribute to external links.