Proactive Controls OWASP Foundation

Just as input validation should not be your only defense, it also does not simply perform just one function. Arguably, input validation’s primary job is to improve user experience. Client-side validation is often employed to make the user’s experience better. However, client-side validation is always bypassable by attackers (or even enthusiasts wanting to use your service in a different way than you intended). As such, the server-side validation is where it takes on a security role. In order to detect unauthorized or unusual behaviour, the application must log requests.

For example, the ASVS contains categories such as authentication, access control, error handling / logging, and web services. Each category contains a collection of requirements that represent the best practices for that category drafted as verifiable statements. A security requirement is a statement of needed security functionality that ensures one of many different security properties of software is being satisfied. Security requirements are derived from industry standards, applicable laws, and a history of past vulnerabilities.

C4: Encode and Escape Data

Building a secure product begins with defining what are the security requirements we need to take into account. Just as business requirements help us shape the product, security requirements help us take into account security from the get-go. First, security vulnerabilities continue to evolve and a top 10 list simply can’t offer a comprehensive understanding of all the problems that can affect your software. Entirely new vulnerability categories such as XS Leaks will probably never make it to these lists, but that doesn’t mean you shouldn’t care about them. CodeQL is a very fast and flexible static analysis solution that can operate in different parts of the SAST spectrum.

Checking and constraining those inputs against the expectations for those inputs will greatly reduce the potential for vulnerabilities in your application. In this series, I’m going to introduce the OWASP Top 10 Proactive Controls one at a time to present concepts that will make your code more resilient and enable your code to defend itself against would-be attackers. When possible, I’ll also show you how to create CodeQL queries to help you ensure that you’re correctly applying these concepts and enforcing the application of these proactive controls throughout your code. The process includes discovering / selecting, documenting, implementing, and then confirming correct implementation of new security features and functionality within an application. It’s highly likely that access control requirements take shape throughout many layers of your application. For example, when pulling data from the database in a multi-tenant SaaS application, where you need to ensure that data isn’t accidentally exposed for different users.

Proactive Controls

Another example is the question of who is authorized to hit APIs that your web application provides. As software becomes the foundation of our digital—and sometimes even physical—lives, software security is increasingly important. But developers have a lot on their plates and asking them to become familiar with every single vulnerability category under the sun isn’t always feasible. Even for security practitioners, it’s overwhelming to keep up with every new vulnerability, attack vector, technique, and mitigation bypass. Developers are already wielding new languages and libraries at the speed of DevOps, agility, and CI/CD. Security requirements are categorized into different buckets based on a shared higher order security function.

Once you decide which test is required, you can contact us for more information on the testing. The queries used to conduct the database calls must be properly sanitized to prevent SQL Injection attacks. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer’s toolkit. You should definitely take the time to read more about security headers to better understand their meaning, use cases, and implications. Ultimately, security headers should be treated as yet another layer in your security-in-depth approach to secure development. National Employers Council, Inc. (NEC) began as an unemployment tax control service in 1975.

Augmenting Requirements with User Stories and Misuse Cases

In this blog post, I’ll cover the basics of query parameterization and how to avoid using string concatenation when creating your database queries. If there’s one habit that can make software more secure, it’s probably input validation. Here’s how to apply OWASP Proactive Control C5 (Validate All Inputs) to your code.

Use well-established frameworks that come with “security batteries” included and, if needed, complement them with existing proven components and libraries wherever possible. Encapsulate those libraries in your own classes, and use static analysis to find violations of your security requirement invariants. Leveraging security-brewed libraries owasp proactive controls and frameworks lets you benefit from established security expertise and failure-based improvements, which will make your code more sound and harder to bypass. A single security-focused library with a large user base across many applications will likely be exercised much more than a single, purpose-written solution for a specific application.