XML External Entity injection risks, also known as XXE attacks, are one of the most common security issues across applications, APIs, and microservices. Although the XXE family of vulnerabilities is not as popular as SQL injection or XSS attacks, it is present in the OWASP Top 10 ranking of risks, at the 2017:A4 position of […]
One of the most serious vulnerabilities that affects web applications, APIs, and microservices are the Insecure Direct Object References (IDOR). It is a design flaw characterized by allowing uncontrolled access to sensitive data without proper authorization. Some recent examples of Insecure Direct Object References breaches are the USPS API bug that exposed 60 million records, […]
Over the years, Web Application Firewalls (WAF) have become a mainstream application protection mechanism and as a result they enjoy a broad market penetration. However, as we have described before, WAFs are falling out of the limelight. Research firms such as Gartner started recommending other protection alternatives in 2017. Some of the main drivers behind […]
Agile protection, and more broadly, agile application security, brings adaptability and automation to application security. It fits nicely with DevOps, one of the main trends today in application development. As you probably know, DevOps introduces automation into the SDLC by treating everything as code. This includes treating as code elements such as server infrastructure, deployment […]
Insecure Deserialization, also known as Untrusted Deserialization, is a serious category of Application Security issues potentially affecting most modern systems. In fact, Insecure Deserialization is part of the OWASP Top 10 ranking of risks, as of the current edition (2017). Some recent application security incidents involving Insecure Deserialization vulnerabilities are the following: CVE-2019-6503 Affects Chatopera, […]
In today’s complex Software Development Lifecycle practices, many of its main actors –if not all– are involved in Application Security. These actors include developers, the ops team, infosec specialists, QA, red/blue teams, etc. From all these actors, developers are surely a critical element in ensuring that the apps are free from security issues. We believe […]
Get latest developments in web application security, DevSecOps, and cloud security from the Hdiv Security blog.
