• Home
  • |
  • Blog
  • |
  • Next Steps – The #11 Web Application Security Risk
Next Steps - The #11 Web Application Security Risk

Web application security is an ever-evolving challenge. While awareness of OWASP’s Top 10 web application security risks is critical, new threats continuously emerge that developers need to stay on top of. OWASP highlights three additional risk categories worth focusing on: code quality issues, denial of service attacks, and memory management risks.

Code Quality Concerns

How code is written can introduce vulnerabilities apart from common risks like injection attacks. Code quality issues mentioned by OWASP include:

  • Conversion errors where data gets interpreted incorrectly between contexts
  • Exposing sensitive information through debug logs and practices
  • Time-of-check and time-of-use race conditions that allow data to change after validation

These types of flaws can lurk in code for a long time. Static and dynamic analysis tools offered in IDEs and CI/CD pipelines can detect code quality problems early. Performing security audits and following best practices around handling data and user input also helps avoid surprises down the road.

CWEs Mapped765
Max Incidence Rate3849.46%
Avg Incidence Rate2.22%
Avg Weighted Exploit7.16
Avg Weighted Impact6.76
Max Coverage0.85%
Avg Coverage23.42%
Total Occurrences101736
Total CVEs765
A11:2021 – Next Steps

Denial of Service Dangers

Denial of service (DoS) attacks aim to make applications unusable for legitimate users by overloading systems and crashing applications. Sometimes DoS vulnerabilities get introduced unintentionally through poor design. An app that allows unauthenticated users to download or manipulate files in a way that consumes excessive disk space or memory makes for an easy DoS target.

OWASP advises performing load and performance testing around areas like memory, CPU, disk I/O early in development. Building in caching, rate limiting, and efficiency improvements makes applications more resilient when under stress. Refer to OWASP’s DoS cheat sheet for additional defensive recommendations.

CWEs Mapped973
Max Incidence Rate817.54%
Avg Incidence Rate4.89%
Avg Weighted Exploit8.35
Avg Weighted Impact5.97
Max Coverage9.58%
Avg Coverage33.26%
Total Occurrences66985
Total CVEs973

Memory Management Risks

Higher level languages on web platforms get built on system languages like C and C++ with their own memory management intricacies. One common memory-related attack is a buffer overflow where attackers override parts of memory to break applications or gain control.

For mitigation, OWASP suggests using memory-safe languages like Rust and Go whenever possible. Thorough testing for memory management issues remains imperative, especially in large and complex apps. Enforcing least privilege principles also reduces the blast radius possible from memory-based attacks.

CWEs Mapped16184
Max Incidence Rate147.03%
Avg Incidence Rate1.16%
Avg Weighted Exploit6.78
Avg Weighted Impact8.15
Max Coverage6.06%
Avg Coverage31.74%
Total Occurrences26576
Total CVEs16184

An Evolving List

The risks above illustrate that even with robust awareness of the OWASP Top 10, web app security demands ongoing vigilance. Check out other OWASP projects like the Web Security Testing Guide for help going beyond the Top 10 risks all developers should be familiar with.

Thanks for reading this post. Please share this post and help secure the digital world. Visit our website, thesecmaster.com, and our social media page on FacebookLinkedInTwitterTelegramTumblrMedium, and Instagram and subscribe to receive updates like this.  

See Also  What is There in The Mandiant's Defender’s Advantage Cyber Snapshot Report- Issue 3

Read More:

About the author

Rajeshwari KA

Rajeshwari KA is a Software Architect who has worked on Full Stack development, Software Design and Architecture for small and large-scale mission critical applications in my 16 + years of experience. You can connect with her on LinkedIn.

Leave a Reply

Your email address will not be published. Required fields are marked

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Learn Something New with Free Email subscription

Email is also one of the ways to be in touch with us. Our free subscription plan offers you to receive post updates straight to your inbox.