Welcome to the second part of World Wide Web
fundamental session in the next couple of
minutes. You'll be introduced to the WASP top ten project and
the latest published version of the awareness document. We
will start with some facts about the project. Then
we will do a walk through the latest published
version of the document and we will close the session discussing, how
it is built the project B. Authors
one words. The last top. 10 is a standard awareness
document for
purrs and web application security. It represents a
broad consensus about the most critical security risks to
web applications. The project is
led by four, well-known of us volunteers and real Bryan,
Neal, and Torsten with a few little changes
since it was first, published the document, bring security
awareness to developers and managers. It was
generally adopted by software industry and there's always a
huge expectation. When the time comes for the next update, the
document has been updated in published since
2003 and translated in several Languages by volunteers. If
you don't find yours, I challenge you to lead that effort. The
more languages. The document is translated into the
more people. The message will reach. This is the project page
where you'll find a quick overview of the latest published top
10, as well as several other links. If
you prefer to read the document in your own language, look
for it in the translation efforts tab.
If you're interested about the source or have a question or comment,
then you should go to the GitHub repo.
Better than talking. Let's see how the document looks
like.
This is the latest published version. At the time,
this course is being recorded.
The document structure hasn't changed that
much and you may expect future versions to keep the same structure.
The release notes section provides relevant information about
how that specific version was built and how
does the final top 10 Compares with the previous version?
Let's see how the top 10 security risks are presented in the document.
Every security risk in the top 10 looks like this one for
the next ten sessions. We will go through all
the 10 security risks and do you will exploit them
in an intentionally vulnerable application?
Let's now discuss how the top 10 is built. The process starts
with a public call for data. So that companies and individuals can
contribute their data provided data, should include
some metadata such as whether results came
from a human Assisi tool or a tool-assisted human approach
and the list of vulnerabilities following the
core common weakness. Enumeration contributed data
is analyzed the normalized. In some may be subject
of reclassification to group things in bigger, buckets. Then
comes the risk rating.
Which we will discuss in more detail in a few moments, but
which is based on the last brisk assessment framework available
at. Always plot Arc. A top-10 draft is
presented to the community for discussion and contributions. What
you may expect to happen. In the GitHub repo. We
saw table like this during our walk through the document, each
factor exploitability, prevalence
detectability, and Technical impact
wrench from one low 23 High doing
this simple math. You will get the risk.
Rating used to sort the top 10 security risks note
that neither likelihood of the threat agent, nor
the business impact are taken into account. The
later is business specific and each organization should
decide how much security risk. It is willing to accept Factor
ranges are given by the top 10 team exploitability.
In detectability are based on public
CVS prevalence. Is computed from contributed data
in the technical impact is an estimation. When
the final document is published.
All this was extensively discussed among the
community representing. A broad consensus. In
the next part. We will discuss how the World Wide Web
works.