WEBVTT - This file was automatically generated by VIMEO 1 00:00:13.300 --> 00:00:16.800 Hello, and welcome back to the last Stockton security fundamentals course. 2 00:00:18.500 --> 00:00:21.200 As you should know, this course was developed. According to 3 00:00:21.200 --> 00:00:24.400 the WASP, top 10, 2017 addition, the latest 4 00:00:24.400 --> 00:00:28.500 version available. When it was first published by 5 00:00:28.500 --> 00:00:31.900 September 20, 21, a new edition was published not 6 00:00:31.900 --> 00:00:34.400 only with the new graphic design. But with what 7 00:00:34.400 --> 00:00:36.300 seems to be a disruptive approach. 8 00:00:37.900 --> 00:00:41.200 With the new owasp top 10 20, 21 Edition does 9 00:00:40.200 --> 00:00:43.400 this course becomes obsolete. How 10 00:00:43.400 --> 00:00:46.300 different is the 20 21 Edition. From the previous one? 11 00:00:46.900 --> 00:00:49.300 These are some of the questions that drove us to update. This 12 00:00:49.300 --> 00:00:52.600 course resulting in two new chapters. Let's 13 00:00:52.600 --> 00:00:55.400 start answering the second question. How different are 14 00:00:55.400 --> 00:00:59.300 the 2021 and 2017 editions. Hopefully, 15 00:00:58.300 --> 00:01:01.500 it will help you draw your own conclusions. To 16 00:01:01.500 --> 00:01:04.300 answer. The former question. The last top 10 17 00:01:04.300 --> 00:01:06.500 has been a mix of symptoms and root cause 18 00:01:06.700 --> 00:01:09.400 Has sensitive detects Bossier, the 19 00:01:09.400 --> 00:01:12.200 top three risk in the 2017 Edition is a scene 20 00:01:12.200 --> 00:01:15.500 from while security Miss configuration top. Six 21 00:01:15.500 --> 00:01:18.800 in the 2017 Edition is a root. Cause for 22 00:01:18.800 --> 00:01:21.300 the 2021 addition, the last ten 23 00:01:21.300 --> 00:01:24.800 project team decided to focus solely on root causes. 24 00:01:24.600 --> 00:01:27.200 So what happened with 25 00:01:27.200 --> 00:01:30.100 the symptoms from the previous editions. Did they 26 00:01:30.100 --> 00:01:33.400 disappear from the top 10? Aren't they risk anymore? 27 00:01:34.500 --> 00:01:37.200 Taking sensitive detects poster as an example in the 28 00:01:37.200 --> 00:01:40.600 2021, Nova's top 10 Edition this risk 29 00:01:40.600 --> 00:01:44.100 moved into a category named after the root cause cryptographic 30 00:01:43.100 --> 00:01:44.800 failures. 31 00:01:45.800 --> 00:01:48.600 What happened with the injection and cross-site scripting 32 00:01:48.600 --> 00:01:51.400 risks from the 2017 Edition is, another 33 00:01:51.400 --> 00:01:54.500 example of what makes these new owasp top 10 Edition 34 00:01:54.500 --> 00:01:57.500 look like completely different. But in fact not 35 00:01:57.500 --> 00:02:00.200 that different, although it has 36 00:02:00.200 --> 00:02:03.100 dropped to the third position. Since injection is 37 00:02:03.100 --> 00:02:06.200 a root cause and contributed data supports. It has one of the 38 00:02:06.200 --> 00:02:09.200 web application. Most critical risks. It was kept as 39 00:02:09.200 --> 00:02:12.800 part of the top 10. On the other hand cross-site 40 00:02:12.800 --> 00:02:15.400 scripting is a symptom and by definition 41 00:02:15.700 --> 00:02:18.200 Type of injection, although it has been in the 42 00:02:18.200 --> 00:02:21.300 top ten side-by-side with an injection category at least, 43 00:02:21.300 --> 00:02:24.700 since 2010 in this new edition cross-site scripting 44 00:02:24.700 --> 00:02:28.000 was moved into the injection category. This 45 00:02:27.100 --> 00:02:30.000 is the big picture of what has changed. 46 00:02:31.100 --> 00:02:34.700 Only the insecure design, and server-side request forgery categories. 47 00:02:34.800 --> 00:02:38.300 Do not have some sort of Correspondence in the 2017 Edition 48 00:02:37.600 --> 00:02:41.700 and can be called new. Nevertheless, 49 00:02:40.700 --> 00:02:43.400 checking the CW is mapped 50 00:02:43.400 --> 00:02:48.100 into the insecure design category. We find the cwe 209, 51 00:02:46.200 --> 00:02:49.500 generation of error 52 00:02:49.500 --> 00:02:52.500 message. Containing sensitive information. What 53 00:02:52.500 --> 00:02:55.900 in the WASP top 10. 2017 was considered a 54 00:02:55.900 --> 00:02:57.600 security Miss configuration. 55 00:03:00.200 --> 00:03:03.300 If you've already completed the security misconfigurations session of 56 00:03:03.300 --> 00:03:06.700 this course, then you've witnessed an insecure design 57 00:03:06.700 --> 00:03:09.300 weakness. Therefore, only the 58 00:03:09.300 --> 00:03:12.800 server side request forgery is really knew by 59 00:03:12.800 --> 00:03:15.800 now. I hope you agree that the 20 21 Edition 60 00:03:15.800 --> 00:03:18.700 is not that different from the 2017. Addition, in 61 00:03:18.700 --> 00:03:21.400 terms of the most critical security risks a 62 00:03:21.400 --> 00:03:24.200 web application faces nowadays, and that 63 00:03:24.200 --> 00:03:27.900 should answer our other question. Is this course obsolete. 64 00:03:29.600 --> 00:03:32.200 Definitely not. Does it still covers the last top? 10 65 00:03:32.200 --> 00:03:33.900 fundamentals? Yes. 66 00:03:35.200 --> 00:03:38.200 There are other noticeable differences such as the new 67 00:03:38.200 --> 00:03:41.400 Factor table that replaces the previous one, with information about 68 00:03:41.400 --> 00:03:44.800 threat, agents attack. Vectors the security weakness itself 69 00:03:44.300 --> 00:03:47.400 and impacts understand display 70 00:03:47.400 --> 00:03:51.100 data factors. You should be familiar with the following concepts. 71 00:03:52.500 --> 00:03:55.400 CW, e or a common weakness. Enumeration is 72 00:03:55.400 --> 00:03:58.900 a community developed list of software and Hardware weakness 73 00:03:58.900 --> 00:04:01.500 types. It serves as a common language 74 00:04:01.600 --> 00:04:04.300 and measuring stick for security tools and 75 00:04:04.300 --> 00:04:07.800 as a baseline for weakness, identification mitigation 76 00:04:07.900 --> 00:04:09.300 and prevention efforts. 77 00:04:10.700 --> 00:04:13.600 CVS yes, or a common vulnerability scoring 78 00:04:13.600 --> 00:04:16.500 system is an open framework for communicating. The 79 00:04:16.500 --> 00:04:20.000 characteristics and severity of software vulnerabilities. 80 00:04:19.700 --> 00:04:22.400 CVS consists of 81 00:04:22.400 --> 00:04:25.400 three metric, groups base, temporal and 82 00:04:25.400 --> 00:04:28.400 environmental the base. Matrix produces score 83 00:04:28.400 --> 00:04:31.100 ranging from 0 to 10, which can 84 00:04:31.100 --> 00:04:34.800 then be modified by scoring the temporal and environmental metrics 85 00:04:34.300 --> 00:04:37.400 CV or 86 00:04:37.400 --> 00:04:39.500 a common vulnerabilities and exposures. 87 00:04:39.700 --> 00:04:42.600 Identifies defines and catalogs public, 88 00:04:42.600 --> 00:04:45.700 disclosed cyber security vulnerabilities. There 89 00:04:45.700 --> 00:04:48.500 is one CV record for each vulnerability in 90 00:04:48.500 --> 00:04:51.100 the catalog. The vulnerabilities are 91 00:04:51.100 --> 00:04:54.500 discovered than assigned and published by organizations from 92 00:04:54.500 --> 00:04:57.400 around the world that have partnered with the CV 93 00:04:57.400 --> 00:04:58.000 program. 94 00:04:59.300 --> 00:05:02.000 To put everything in place when a researcher finds a 95 00:05:02.200 --> 00:05:05.400 new vulnerability, he or she should report it to the software 96 00:05:05.400 --> 00:05:08.300 vendor Computing, a CVS's score for the 97 00:05:08.300 --> 00:05:11.300 finding will help communicate exploitability. And 98 00:05:11.300 --> 00:05:14.400 in fact, as mapping it to Common weaknesses will 99 00:05:14.400 --> 00:05:18.500 help the vendor to understand and address the issue. Once 100 00:05:18.500 --> 00:05:21.100 the fact it software vendor releases a new version of 101 00:05:21.100 --> 00:05:24.600 its software with a vulnerability. Patched details about 102 00:05:24.600 --> 00:05:27.800 the security weakness should be made public spreading 103 00:05:27.800 --> 00:05:28.200 this information. 104 00:05:28.300 --> 00:05:32.100 Mission will help organizations to update the affected systems requesting 105 00:05:31.100 --> 00:05:34.800 a CV. Number implies that the vulnerability will 106 00:05:34.800 --> 00:05:38.200 be added to the database of known security vulnerabilities, and 107 00:05:38.200 --> 00:05:41.400 push to all those who subscribe to database updates to 108 00:05:41.400 --> 00:05:43.500 keep up with the new vulnerabilities. 109 00:05:47.300 --> 00:05:50.700 That being said, you should now be able to handle the data presented 110 00:05:50.700 --> 00:05:53.400 in the new tables. But before you're better at 111 00:05:53.400 --> 00:05:55.900 reading, the data Factor section in the introduction. 112 00:06:02.100 --> 00:06:05.500 Note that instead of a range from one low 23 high 113 00:06:05.600 --> 00:06:09.700 as given by the WASP risk rating methodology exploitability 114 00:06:08.700 --> 00:06:11.300 and impact scores are now 115 00:06:11.300 --> 00:06:14.800 given on a 10 point Scale based on the corresponding CVS. 116 00:06:14.800 --> 00:06:15.800 Yes, sub scores. 117 00:06:19.400 --> 00:06:22.100 If you have completed all previous sessions, this is the 118 00:06:22.100 --> 00:06:25.100 right time to read owasp top, 10, 20 21. All 119 00:06:25.100 --> 00:06:28.800 the changes are well, documented and explained in the introduction section. 120 00:06:28.500 --> 00:06:31.100 Otherwise, I recommend you to 121 00:06:31.100 --> 00:06:33.400 go back and start the course from the beginning. 122 00:06:34.900 --> 00:06:37.500 To make you feel more comfortable and confident regarding 123 00:06:37.500 --> 00:06:40.100 the new owasp top 10, 20 21. We've 124 00:06:40.100 --> 00:06:43.700 decided to add an extra session to cover the new top, 10 server-side 125 00:06:43.700 --> 00:06:46.600 request forgery category. Although contributed 126 00:06:46.600 --> 00:06:49.600 data shows a relatively low incidence rate with 127 00:06:49.600 --> 00:06:52.600 above-average, testing coverage, along with above 128 00:06:52.600 --> 00:06:55.900 average, ratings for exploit, and impact potential. This 129 00:06:55.900 --> 00:06:58.600 category was added because the security Community 130 00:06:58.600 --> 00:07:01.300 says it is relevant. And so let's hack Juice 131 00:07:01.300 --> 00:07:02.000 Shop again.