3

Recently, OWASP introduced two new set of categories as of 2017, April - to it's OWASP Top 10:

  1. Insufficient Attack Protection
  2. Unprotected APIs

I understand, Unprotected APIs does have an immediate risk which involves proving a huge attack surface along with possibilities of data leakages, however, I fail to understand how Insufficient Attack Protection is any threat or a risk for a category?

Improving my focus, I would summarize quoted from scamdemy:

Insufficient Attack Protection refers to the inability to detect, prevent and respond to various kinds of attacks against the application as a whole. This – due to the large number of unaudited third-party components that may contain critical vulnerabilities – necessitates the use of generic security tools such as intrusion detection systems (IDS), and web application firewalls (WAF) that can identify an ongoing attack such as SQL injection. It focuses on the consequences instead of the root causes of the weaknesses.

Does this imply to having WAF set-up in direct connect to having a great attack surface area without the presence of Firewalls? If absence of a component is an immediate categorization need on OWASP Top 10. Not sure, how other's aren't affected by the same?

e.g. By not having WAF, certain levels of Injection(s) will be evident given that their is a flaw in application code.

Do i presume, this is a move for the security audit team to market their Firewall products keeping OWASP Top 10 as a reference? Or was it really necessary technically?

  • You can ask them and contribute to the discussion: github.com/OWASP/Top10/blob/master/2017/… – schroeder Apr 12 '17 at 8:21
  • OWASP directly addresses your question. I'm not really sure what you're asking. You seem to be quoting a 3rd party and asking what the 1st party meant. Insufficient protection could also mean no use of things like fail2ban according to OWASP itself. – schroeder Apr 12 '17 at 8:25
  • 1
    @schroeder The 3rd Party is an example to improvement to strealine clarify in the question. The technicality is what remains to be the center of discussion. – Shritam Bhowmick Apr 12 '17 at 8:34
  • Then I still do not understand your question. Putting aside the WAF-specific example, and your opinion-based question at the end, are you asking if the lack of protection represents a definite threat/risk? Well, does SQLi represent a definite threat/risk? No, if it is mitigated. – schroeder Apr 12 '17 at 8:56
  • 1
    SQLi is a concrete and specific title, where as "Insufficient Attack Protection" is a vague title. The value of the Top-10 is in its prescriptive focus on specific issues. Even in the cheat sheet it has multiple simultaneous and very different interpretations, from logging, to IPSes and WAF to patch cycles and virtual patching capabilities. – mgjk Apr 12 '17 at 9:12
4

"Insufficient Attack Protection" is a horrible choice of words, but I don't have a suggestion on how to improve it.

I've overseen applications which were missing really basic detection abilities and it's frustrating trying to communicate the urgency of some kind of response to the application team.

Imagine an application with:

  • no protection against brute force password attacks,
  • no logging of login attempts,
  • no logging of session initiation or completion,
  • no logging of attempts to manipulate expired sessions etc.

I found myself writing brittle and awkward Snort signatures to extract basic logging data and tuning application firewalls to try to make up for missing behaviours while application teams simply said "meh, it's infosec's problem".

IPS signatures can't know "is this a valid user?" or "is this session active?" or "how much data has this person used today?", but application logic may have access to this information, or maybe just having the sessions logged would mean the SIEM could perform the logic.


Regarding scamdemy's article, I think he has it wrong. This has nothing to do with third-party components. Many of the security articles coming out on the proposed 2017 A7 seem to be knee-jerk reactions to pumping out a response to OWASP's new Top-10, it gets attention I suppose, but I don't think the authors have given their response careful thought.

The external links inside the A7 cheatsheet are far, far more descriptive:

IMHO, A7 needs some tweaking, I think "patching" references should be removed. Infosec can do virtual patches or dev processes can patch, but the references here detract from what I believe is their core message.

  • Exactly my doubts. 'Patching' or 'Mitigation Measures Missing' seems more focused to address the category. – Shritam Bhowmick Apr 12 '17 at 9:42
  • A lack of external mitigation tools is certainly a security issue, but IMHO more in keeping with infrastructure security covered by SANS or CIS top 20. Detection is super-important and the past issues I mentioned would require application development teams to log security information. Lack of "response" to abuse is very important but may not deserve a top-10 spot in 2017. – mgjk Apr 12 '17 at 10:08
0

According to OWASPs short description (full doc here):

The majority of applications and APIs lack the basic ability to detect, prevent and respond to both manual or automated attacks. Attack protection goes far beyond basic input validation and involves automatically detecting, logging, responding and even blocking exploit attempts. Application owners also need to be able to deploy patches quickly to protect against attacks.

Your question:

I understand, Unprotected APIs does have an immediate risk which involves proving a huge attack surface along with possibilities of data leakages, however, I fail to understand how Insufficient Attack Protection is any threat or a risk for a category?

Apart from keeping everything up-to-date and having developed a fairly secure API, an organization or business with a huge network (and mabye its own web hosting servers), needs to have more than those typicals. Firewalls and IDS need people to monitor them and know how to react in case of an intrusion or an exploitation attempt. That includes active response policies (blocking ip's, denying services in specific (malicious) clients etc). Now, if the attackers manage to successfully get past through firewalls, IDS and cause damage, there must be procedures to specify the actions needed to be done for the system/network recovery and further patching. Lacking in people to do those things and lacking specific policies (i.e. iso 27001), Insufficient Attack Protection is BOTH threat and a risk. Just take a moment and think that many companies (small/large/doesn't matter) don't even keep backups of their databases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.