# Cybersecurity Basics: OWASP Top 10

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. For developers, the **OWASP Top 10** is a standard awareness document representing the most critical security risks to web applications.

## 1. Broken Access Control
Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data.
*   **Example:** A user changes the URL from `/user/get/1` to `/user/get/2` and views another user's account.
*   **Fix:** Enforce record ownership checks in code.

## 2. Cryptographic Failures
Previously known as "Sensitive Data Exposure". This involves failures related to cryptography (or lack thereof), leading to exposure of sensitive data like passwords, credit card numbers, or health records.
*   **Example:** Storing passwords in plain text or using weak hashing algorithms (like MD5).
*   **Fix:** Use strong, salted hashing algorithms (Argon2, bcrypt) and encrypt data at rest and in transit (HTTPS).

## 3. Injection
Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands. This includes **SQL Injection** and **Cross-Site Scripting (XSS)**.
*   **Example (SQLi):** `SELECT * FROM users WHERE name = '` + `userInput` + `'`;`
*   **Fix:** Use parameterized queries (Prepared Statements) or ORMs.

## 4. Insecure Design
This focuses on risks related to design and architectural flaws. It calls for more threat modeling, secure design patterns, and reference architectures.
*   **Concept:** You can't "code" your way out of a bad design. If the business logic allows unlimited login attempts, no amount of error handling fixes the brute-force vulnerability.

## 5. Security Misconfiguration
This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
*   **Example:** Leaving default admin/password credentials on a router or database.

## 6. Vulnerable and Outdated Components
Using libraries, frameworks, and other software modules with known vulnerabilities.
*   **Fix:** Regularly check dependencies (e.g., `npm audit`, OWASP Dependency Check) and update them.

## 7. Identification and Authentication Failures
Previously "Broken Authentication". This allows attackers to compromise passwords, keys, or session tokens, or to exploit implementation flaws to assume other users' identities.
*   **Example:** Allowing weak passwords, lacking Multi-Factor Authentication (MFA), or exposing session IDs in URLs.

## 8. Software and Data Integrity Failures
Code and infrastructure that does not protect against integrity violations.
*   **Example:** An application relies on plugins, libraries, or modules from untrusted sources, repositories, or CDNs without integrity checks (like Subresource Integrity).

## 9. Security Logging and Monitoring Failures
Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, and pivot to more systems.

## 10. Server-Side Request Forgery (SSRF)
SSRF flaws occur whenever a web application is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination.

## Zero Trust Security

Zero Trust is a security framework requiring all users, whether in or outside the organization's network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data.

*   **Motto:** "Never trust, always verify."
*   **Key Principles:**
    1.  **Verify Explicitly:** Always authenticate and authorize based on all available data points.
    2.  **Least Privilege:** Limit user access with Just-In-Time and Just-Enough-Access.
    3.  **Assume Breach:** Minimize blast radius and segment access.

## Man-in-the-Middle (MitM) Attacks

A Man-in-the-Middle attack is a cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other.

*   **Mechanism:** The attacker intercepts the data transfer (e.g., on an insecure public Wi-Fi network).
*   **Example:** You log in to your bank account on a coffee shop Wi-Fi. The attacker intercepts your credentials.
*   **Prevention:**
    *   **HTTPS:** Always use TLS/SSL encryption. This ensures that even if data is intercepted, it cannot be read.
    *   **VPN:** Encrypts all traffic from your device.

## DDoS Attacks (Distributed Denial of Service)

A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

*   **Mechanism:** Attackers use a network of compromised computers (botnet) to send massive amounts of requests to the target.
*   **Types:**
    *   **Volumetric Attacks:** Saturating bandwidth (e.g., UDP floods).
    *   **Protocol Attacks:** Consuming server resources (e.g., SYN floods).
    *   **Application Layer Attacks:** Crashing the web server (e.g., HTTP floods).
*   **Mitigation:** Rate limiting, Web Application Firewalls (WAF), Anycast network diffusion (CDNs).

[[programming/rest-apis]]
[[programming/database-basics]]
[[programming/ci-cd-pipelines]]