The 2013 OWASP Top 10
summary
Explains concrete changes: A9: using known vulnerable components added, two crypto items merged, seven items reordered; ranking comes from a defined risk rating methodology using four factors and prevalence data from six or seven vendors. Presents Sonatype download analysis showing 26% of popular library downloads are vulnerable at the moment of download, notes Maven OWASP dependency-check and a Maven versions plugin as practical automation, and outlines plans for an open, standardized data call to improve the next Top 10.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:32Dave Wichers
- 4:45About the OWASP Top 10
- 6:05OWASP Top Ten (2013 Edition)
- 8:35What Didn't Change
- 11:20OWASP Top 10 Risk Rating Methodology
- 14:49What's Changed?
- 17:24Mapping from 2010 to 2013 Top 10
- 21:41OWASP Top Ten 2010-A6 Security Misconfiguration
- 25:44Everyone Uses Vulnerable Libraries
- 29:212013-A9 - Using Known Vulnerable Components
- 34:34What Can You Do to Avoid This?
- 37:04Automation Example for Java-Maven Versions Plugin
- 40:20OWASP Dependency Check
- 42:05Expanded A7-Missing Function Level Access Control
- 43:18_OWASP Top 10 2013 Development Methodology
related talks
45mOWASP A9: A Year Later - Are you still using components with known vulnerabilities?
47mOWASP Top 10
50mThe How and Why of the OWASP Top Ten 2021
30mTop 10 Introduction
25mOWASP Top 10 Risks for Open Source Software
26mFlagship Projects: Top 10 "The making of the OWASP Top 10 and beyond"
29mFlagship Projects: Top 10 "Intro of Top 10"
51mHarmonizing the OWASP API and Application Top 10 Lists