Injection attacks have not gone away and remain a genuine threat to businesses that need to be mitigated. In 2021, injection attacks fell from the top spot it long occupied on the OWASP Top 10 List, ranking third among most critical threats.

Injection: Still a Top Three Threat After Losing Top Spot Yet, the increased availability of standardized authentication frameworks and their adoption by businesses make them easier to manage. While ranked lower than they were, broken authentication attacks remain a significant challenge. To mitigate their impact, ensure that passwords are long, strong and frequently changed, and implement multi-factor authentication. If someone can bypass or fool the authentication system, they have carte blanche to do pretty much anything they want and wreak a lot of havoc. However, make no mistake – these types of attacks remain extremely dangerous for a business. Under its old name of Broken Authentication, this category held the number 2 slot in 2017, but In its 2021 update, OWASP ranked it 7 th. Identification and Authentication Failures: Still a Major Challenge Also, to mitigate the effect of automated threats, you should rate limit API access.When a session is over, do not allow any tokens to be reused. This may minimize the window of opportunity an attacker has to compromise your applications. When you grant access, use a short lifespan on any session tokens used.Persistent failures could indicate an attack, and you should alert admins immediately – and block failing accounts.

When access control failures occur, log them.

Maintain the least privilege principle – give no more rights to anyone than necessary – deny by default and enforce it!

Don’t forget to do a thorough audit of the current access policies of your existing applications.

Least privilege access is the principle of restricting access rights for every user, APIs and processes to the absolute bare minimum of resources required to perform their routine and legitimate activities.

Least privilege access should be your first principle.

This has to change, as failure to ensure users, processes and devices cannot act outside their permissions leads to data security issues, data loss, modification and breaches. Yet, authentication is often put in place with no controls over the action a user, process or device can carry out. Indeed, there were a staggering 318,000 occurrences of broken access control vulnerabilities in the data set.Īccess control is critical. OWASP reported that 94% of apps were tested for broken access control, with 3.8% having one or more flaws. Security teams seem to be getting better at making sure they know who is accessing apps, but there is plenty of room for improvement in controlling what they can do with them. Previously number five on the OWASP list, broken access control has risen to the top spot. Broken Access Control: Rises to Number One App Security Risk

Owasp principle of least privilege