But these are murky waters. And the landscape changes quickly. Crucially, the Open Web Application Security Project (OWASP) is an online community of cybersecurity experts that provides valuable resources to enhance security. And through its regularly updated guidance including the OWASP Top 10 Web Application Security Risks document, developers can limit the risk of, for instance, a data breach or malware attack, pre-emptively. The modern software development market is a competitive one. And it’s distinguished by speed. The speed at which an application works, the speed at which you can innovate and get to market before your rival. That supersedes application security and is one of the key reasons why OWASP is so important. Security cannot be an afterthought. In fact, it is increasingly more important – for consumers and businesses alike. Indeed, in a white paper published by the SANS Institute’s 2016 State of Application Security, 97% of respondents said they understood the importance of application security. Some said they even had an AppSec program integrated into their procedures. But just over a quarter said such a program was mature or very mature, underlining the need for the OWASP. The value of the OWASP top 10 is highlighted by the amount of academic books, standards, tools and organizations that reference it as a key resource. This includes The United States Federal Trade Commission, MITRE and Defense Information Systems Agency (DISA-STIG). Its current focus following its recent update includes key areas developers must look at including sensitive data exposure, security misconfiguration and injection flaws which the OWASP advises can be easily rectified if developers utilize parameterized queries when coding. The OWASP’s up to date guidance focuses attention on the most prevalent and severe threats to web application security. Customers will increasingly expect developers to show evidence that they have taken steps to mitigate security risk and remove all errors stipulated in the OWASP’s recommendations. Suitably, developers have access to a detailed breakdown to check their vulnerabilities and learn how to stop an attack. This is supported by attack scenarios to example how malicious threats could occur, further helping to identify and eradicate potential flaws, and enhancing the testing process. The tech sector benefits too from the OWASP’s impartiality, its advice built on a desire to develop best practice and create open standards. In the search for a particular tool to support application security, advice can often be steered towards an individual service provider’s own commercial goals. Through the OWASP, developers have free and comprehensive information at their fingertips within an open, collaborative forum. The need is clearly evident. Research in 2017 revealed 25% of current apps suffered from eight out of 10 vulnerabilities listed by the OWASP Top 10, while four out of every five had at least one vulnerability. Of the breaches, sensitive data was the most exposed. It goes to show more resources need to be applied to application security. Of course, a lack of funding or resources can be problematic but the impact of a data breach could be catastrophic. With the legwork already having been done by the OWASP, we have both the opportunity and the incentive to tackle web application security head-on.
