OWASP Top 10: What are them and how to prevent them
summary
OWASP Top 10 remains dominated by injection, XSS, broken access control and sensitive data exposure, with historical incidents like Heartbleed (OpenSSL 2014) wiping ~90% of servers as an example of scale. Practical fixes shown include filter_var and context-aware escaping for inputs, password_hash for safe password storage, prepared statements to stop SQL injection, and avoiding PHP unserialize on untrusted data. Uses Drupal built-ins, Composer security advisories and CI checks to detect vulnerable modules before deployment.
AI-written summary · about
chapters (16)
- 0:00Intro
- 4:16AES Bleichenbacher MD5 SHA-3
- 10:11What not to trust
- 14:40SANITIZE
- 19:36ESCAPE
- 22:59Injection
- 24:41Cross-Site Scripting (XSS)
- 27:23Insecure Unserialization
- 28:33XML External Entities (XXE)
- 34:40Sensitive Data Exposure
- 36:56Broken Authentication
- 41:00Broken Access Control
- 43:43Security Misconfigurations
- 44:55Components with known Vulnerabilities
- 46:37Insufficient Logging
- 49:49Further Resources
related talks
01h 02mUnderstanding the OWASP Top 10
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
58m: The OWASP Top Ten Proactive Controls 2018
53mOWASP Top Ten Proactive Controls
47mOWASP Top 10
30mTop 10 Introduction
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities