🔒

Web Security: OWASP & Authentication

35 cards · 🇺🇸 English

Common web vulnerabilities (OWASP Top 10) and authentication concepts.

Study all 35 cards for free

Flashcards, quizzes, pixel-art games and a daily review that remembers for you.

Study this deck free

Try the first 10 cards

1 / 10
Question

OWASP

Knew itLearning

Tap the card for the answer · swipe right if you knew it, left if not

Already have an account? Sign in

Cards

  1. 1OWASP
    Open Worldwide Application Security Project - an online community that publishes open-source information and resources on IoT, system software, and web application security
  2. 2What type of organization is the OWASP Foundation?
    A 501(c)(3) non-profit organization in the US, established in 2004
  3. 3OWASP Top 10
    An annual listing of the most critical web application security risks, first published in 2003
  4. 4Cryptographic failures in OWASP Top 10
    Security vulnerabilities related to improper implementation or use of cryptographic functions, ranked #2 in the 2021 list
  5. 5Injection in the context of web security
    A vulnerability where untrusted data is sent to an interpreter as part of a command or query, ranked #3 in OWASP Top 10
  6. 6Insecure design
    Missing or ineffective security controls in the application architecture and design phase, ranked #4 in OWASP Top 10
  7. 7Security misconfiguration
    Improperly configured security settings, default configurations, or incomplete configurations, ranked #5 in OWASP Top 10
  8. 8Vulnerable and outdated components
    Use of software components with known vulnerabilities, libraries, or frameworks that are outdated, ranked #6 in OWASP Top 10
  9. 9SSRF
    Server-Side Request Forgery - an attack where an attacker can make the server perform unintended requests, ranked #10 in OWASP Top 10 - 2021
  10. 10Application security (AppSec)
    Tasks that introduce a secure software development life cycle to development teams to find, fix, and prevent security issues within applications
  11. 11SAST
    Static Application Security Testing - analyzes source code for security vulnerabilities during development before the application is executable (white-box approach)
  12. 12DAST
    Dynamic Application Security Testing - automatically detects vulnerabilities by crawling and analyzing running websites (black-box approach)
  13. 13IAST
    Interactive Application Security Testing - assesses applications from within using software instrumentation, combining strengths of SAST and DAST
  14. 14What advantage does SAST have over DAST?
    SAST can be used even before the application is executable and has access to full source code, yielding more detailed results
  15. 15Disadvantage of SAST
    It can produce many false positives that need to be manually verified
  16. 16Fuzzing
    A testing technique commonly used for input testing that involves providing invalid, unexpected, or random data as inputs to a program
  17. 17Runtime Application Self-Protection (RASP)
    Technology that augments existing applications to provide intrusion detection and prevention from within an application runtime
  18. 18Software composition analysis
    Tools (also called dependency scanners) that detect the usage of software components with known vulnerabilities
  19. 19OWASP ZAP
    An open-source penetration testing tool created by OWASP for web application security testing
  20. 20WebGoat
    A deliberately insecure web application created by OWASP as a guide for secure programming practices
  21. 21OWASP ASVS
    Application Security Verification Standard - a standard for performing application-level security verifications
  22. 22Threat model
    A technique used in design review phase to analyze an application's architecture and design for security problems before code is written
  23. 23White-box testing
    Security testing that involves critical examination of internal structure, architecture, and design with access to source code
  24. 24Black-box testing
    Security testing that tests functionality rather than internal structure, without access to source code
  25. 25What organizations reference the OWASP Top 10?
    MITRE, PCI DSS, Defense Information Systems Agency (DISA-STIG), and the United States Federal Trade Commission
  26. 26Identification and authentication failures
    Vulnerabilities related to confirming user identity, authentication, and session management, ranked #7 in OWASP Top 10
  27. 27Software and data integrity failures
    Failures to protect against integrity violations in software updates, critical data, and CI/CD pipelines, ranked #8 in OWASP Top 10
  28. 28Security logging and monitoring failures
    Insufficient logging, monitoring, and alerting that prevents detecting and responding to security breaches, ranked #9 in OWASP Top 10
  29. 29Coordinated vulnerability platform
    Hacker-powered application security solutions (bug bounty programs) where individuals receive recognition and compensation for reporting bugs
  30. 30OWASP Development Guide
    A comprehensive guide published by OWASP that provides best practices for secure software development

And 5 more cards. Study the whole deck free

Articles about this deck

More Programming decks

See all
Study all 35 cards free