-
Security updates
-
Product news
-
Next-Gen Vulnerability Management
-
Getting started
-
General
-
Operating status
-
Network & System Security
-
Web Application Security
-
Cloud Security
-
API Security
-
Phishing Simulation & Awareness Training
-
Attack Surface Management
-
Scanner Appliance
-
Device Agent
-
On-premise platform deployment
-
Asset management
-
Vulnerability manager
-
Reports
-
Digest reports
-
Organizer
-
Continuous monitoring
-
Integrations
-
Platform API
-
Remediation
-
Users
-
PCI DSS
-
Terms & conditions
-
Dashboard
What is the difference between OWASP Top 10 version 2013 and 2017?
Two new risks were added with OWASP 2017
2017-A7 - Insufficient Attack Protection
Detecting, responding to, and blocking attacks make applications dramatically harder to exploit yet almost no applications or APIs have such protection. Critical vulnerabilities in both custom code and components are also discovered all the time, yet organizations frequently take weeks or even months to roll out new defenses.
2017-A10 - Underprotected APIs
Testing your APIs for vulnerabilities should be similar to testing the rest of your application for vulnerabilities. Different types of injection, authentication, access control, encryption, configuration & other issues can exist in APIs just as in a traditional application.
Two items were removed from OWASP Top 10 2017
- Cross-Site Request Forgeries (CSRFs)
- Unvalidated Redirects and Forwards
Two risks from the OWASP Top 10 2013 are merged
Insecure Direct Object References and Missing Function Level Access Control were merged into a single risk:
- Broken Access Control.