July 2016 Summaries

The General Data Protection Regulation (GDPR), effective from May 2018, updates EU data protection laws to better align with the digital age, replacing the outdated 1995 Data Protection Directive. This regulation mandates that businesses focus on data security and privacy, introducing concepts like the right to be forgotten and Data Protection Officers. Companies must evaluate and possibly restructure their data processing and security practices to comply, as non-compliance could result in significant fines. It requires organisations to demonstrate compliance through processes such as maintaining a register of data processing and appointing data protection officers. Furthermore, the GDPR establishes a security breach notification framework, compelling organisations to notify authorities within 72 hours of a breach. Detectify offers tools and education to help businesses integrate security into their workflows, emphasizing that adopting a security-oriented approach is crucial for GDPR compliance and overall web security. As the regulation demands a top-down commitment to data protection and privacy, companies are encouraged to view compliance as an opportunity to align business strategies with data protection principles.

Cross-site Request Forgery (CSRF) is a security vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users, primarily targeting state-changing requests like credential updates or fund transfers. This attack, highlighted in OWASP’s Top 10 list of security risks, exploits the trust a site has in a user's browser. While CSRF's prevalence has decreased due to improved security measures in frameworks, it remains a significant threat, particularly in API calls where developers may overlook the need for a CSRF token. Attackers can execute CSRF by embedding malicious links in web pages or emails, and if successful, can cause substantial harm, especially if an administrator is targeted. Remediation involves implementing unique tokens per user session and re-authentication for sensitive actions, although misconceptions persist regarding the adequacy of methods like CAPTCHA and POST request limitations for protection. Tools like Detectify offer automated testing to identify such vulnerabilities in web applications, providing a resource for developers to ensure their security measures are effective.

Missing Function Level Access Control is a significant vulnerability identified by OWASP, which occurs when authentication checks in request handlers are inadequate, allowing unauthorized users to access sensitive URLs or functionalities intended for authorized users. This vulnerability is part of OWASP's Top 10 list and has become increasingly common since its initial identification as uncommon in 2010. The potential impact ranges from accessing seemingly trivial information to full system takeover, with exploitation often being straightforward, as it might involve simply performing actions that should require authentication. The Twitter vulnerability is a notable example, where a user altered request parameters to delete another user's account, showcasing the real-world implications of such vulnerabilities. Detectify offers a web security scanner to identify over 700 vulnerabilities, including those highlighted by OWASP, providing a systematic approach to discovering and mitigating Missing Function Level Access Control issues. Remediation involves implementing a default denial strategy, logging failed access attempts, and avoiding reliance on security through obscurity, as users may discover hidden URLs or APIs.

Security is an essential aspect of modern business operations, requiring integration into the entire development process to remain competitive and meet user demands for secure services. The most effective approach is to embed security seamlessly across planning, development, testing, and production phases, although doing so manually can be cumbersome and time-consuming. Utilizing automated monitoring systems like Detectify allows for continuous background analysis of websites, providing actionable security insights without disrupting existing workflows. Detectify's service includes features for setting up comprehensive security profiles, scanning both staging and production environments, and ensuring that teams remain vigilant about emerging vulnerabilities. The tool supports integration with various developer platforms to facilitate timely communication of security issues and promote a culture of shared responsibility and learning across the organization.

Sensitive Data Exposure, now categorized under Cryptographic Failures in the OWASP Top 10 for 2021, is a vulnerability where applications do not adequately protect sensitive information such as passwords, credit card data, or session tokens, which can result in severe consequences. Common in smaller organizations and hobby projects due to often overlooked security practices, it can also affect larger entities, though less frequently. The potential impact varies depending on the type of data exposed, with significant risks such as financial loss or unauthorized access to user accounts. Exploitability can range from challenging to straightforward; for instance, an unencrypted database can be easily accessed by an attacker. Detectify offers automated tests to identify these vulnerabilities by assessing over 700 potential issues, including those in the OWASP Top 10, providing a valuable tool for ensuring web security. Prevention requires understanding what constitutes sensitive data and consistently applying protection measures like encryption and secure transmission protocols to mitigate risks.