2021 OWASP Top Ten: Broken Access Control

Summary

In this insightful discussion on the OWASP Top 10 security risks, broken access control is identified as the most critical threat of 2021. Highlighting alarming statistics, it emphasizes that 94% of applications exhibit some form of this vulnerability. The video outlines common issues like insecure direct object references and excessive permissions, illustrating how attackers can exploit weak access controls. To mitigate these risks, it advocates for proactive strategies such as denying access by default, enforcing record ownership, and logging access control failures. The importance of integrating strong security measures early in the development lifecycle is also stressed.

Takeaways

• 🔒 Broken access control is the number one security risk in the OWASP Top 10 2021 list, moving up from the fifth position in 2017.
• 📊 94% of applications tested had some form of broken access control, with an average incident rate of 3.8%.
• 📈 The OWASP dataset reviewed over 318,000 occurrences of broken access control vulnerabilities.
• 🛡️ Effective access control mechanisms are essential to differentiate between legitimate users and attackers in an application.
• ⚠️ Endpoint manipulation can expose sensitive data; changing an ID in an API endpoint can lead to unauthorized access.
• 🔑 The principle of least privilege must be enforced, allowing users only the minimum access necessary to perform their tasks.
• 🚫 Insecure direct object references can enable users to access or modify other users' accounts if not properly controlled.
• 🖥️ Missing access controls for API methods (GET, POST, DELETE) can lead to data breaches and unauthorized actions.
• 🔍 Logging access control failures is critical for monitoring and identifying unauthorized access attempts.
• ⏱️ Implementing rate limiting for APIs helps mitigate the risks of automated attacks and enhances overall security.

Q & A

What is the primary focus of the OWASP Top 10 2021 list?

The primary focus of the OWASP Top 10 2021 list is to highlight the most critical security risks to web applications, with broken access control being identified as the number one risk.

How did broken access control rank in the OWASP list compared to previous versions?

Broken access control moved up from the fifth position in the 2017 OWASP Top 10 to the first position in the 2021 list.

What percentage of applications tested exhibited broken access control vulnerabilities?

94% of the applications tested exhibited some form of broken access control vulnerabilities.

What are the common consequences of broken access control?

Common consequences include information disclosure, unauthorized information modification, and potential data deletion by attackers.

What example did the presenter give to illustrate a broken access control issue?

The presenter illustrated a broken access control issue by discussing an API endpoint where changing the message ID in the URL could allow unauthorized access to different messages.

What is meant by the principle of least privilege in access control?

The principle of least privilege means that users should be granted the minimum level of access necessary to perform their job functions, reducing the risk of unauthorized access.

What strategies can be employed to prevent broken access control?

Strategies include implementing deny-by-default access policies, reusing access control mechanisms, enforcing record ownership, logging access control failures, and rate-limiting APIs.

Why is it important to log access control failures?

Logging access control failures is important for monitoring and auditing purposes, as it helps identify when unauthorized access attempts occur and allows for timely response and mitigation.

What is a common method attackers use to exploit broken access control?

A common method attackers use is modifying URLs or HTML pages to bypass access control checks, allowing them to access restricted resources.

How should access control features be integrated into application development?

Access control features should be integrated early in the development lifecycle to ensure that security measures are built into the application from the ground up, rather than added later.