diff --git a/docs/anchors/owasp-top-10.adoc b/docs/anchors/owasp-top-10.adoc new file mode 100644 index 0000000..993e3f3 --- /dev/null +++ b/docs/anchors/owasp-top-10.adoc @@ -0,0 +1,55 @@ += OWASP Top 10 +:categories: testing-quality +:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead +:related: regulated-environment, iec-61508-sil-levels +:proponents: OWASP Foundation +:tags: security, web-security, vulnerabilities, risk, appsec, owasp + +[%collapsible] +==== +Full Name:: OWASP Top 10 Web Application Security Risks + +Also known as:: OWASP Top Ten, Web Application Security Top 10 + +[discrete] +== *Core Concepts*: + +A01 – Broken Access Control:: Failure to enforce restrictions on what authenticated users can do; most prevalent web application risk + +A02 – Cryptographic Failures:: Sensitive data exposed due to weak or absent encryption; previously called "Sensitive Data Exposure" + +A03 – Injection:: Untrusted data sent to an interpreter as part of a command or query (SQL, OS, LDAP injection) + +A04 – Insecure Design:: Missing or ineffective security controls resulting from flawed design and threat modeling + +A05 – Security Misconfiguration:: Insecure default settings, incomplete configurations, open cloud storage, verbose error messages + +A06 – Vulnerable and Outdated Components:: Use of components (libraries, frameworks) with known vulnerabilities + +A07 – Identification and Authentication Failures:: Weaknesses in authentication, session management, and credential handling + +A08 – Software and Data Integrity Failures:: Code and infrastructure that does not protect against integrity violations (e.g., insecure deserialization, CI/CD tampering) + +A09 – Security Logging and Monitoring Failures:: Insufficient logging, detection, and response to breaches + +A10 – Server-Side Request Forgery (SSRF):: Server fetches remote resources from attacker-controlled URLs without validation + + +Key Proponent:: OWASP Foundation (https://owasp.org/Top10/, first published 2003, current edition 2021) + +[discrete] +== *When to Use*: + +* Performing security risk assessments on web applications +* Establishing secure coding guidelines and developer training programs +* Conducting threat modeling and security design reviews +* Prioritizing security findings during code reviews and penetration tests +* Defining acceptance criteria for security requirements +* Auditing third-party or open-source components for known vulnerabilities + +[discrete] +== *Related Anchors*: + +* <> +* <> +==== diff --git a/docs/anchors/owasp-top-10.de.adoc b/docs/anchors/owasp-top-10.de.adoc new file mode 100644 index 0000000..23f3e40 --- /dev/null +++ b/docs/anchors/owasp-top-10.de.adoc @@ -0,0 +1,55 @@ += OWASP Top 10 +:categories: testing-quality +:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead +:related: regulated-environment, iec-61508-sil-levels +:proponents: OWASP Foundation +:tags: security, web-security, vulnerabilities, risk, appsec, owasp + +[%collapsible] +==== +Vollständiger Name:: OWASP Top 10 Web-Anwendungs-Sicherheitsrisiken + +Auch bekannt als:: OWASP Top Ten, Web Application Security Top 10 + +[discrete] +== *Kernkonzepte*: + +A01 – Fehlerhafte Zugriffskontrolle:: Unzureichende Durchsetzung von Einschränkungen für authentifizierte Benutzer; häufigste Schwachstelle in Webanwendungen + +A02 – Kryptographische Fehler:: Offenlegung sensibler Daten durch schwache oder fehlende Verschlüsselung; früher als „Sensitive Data Exposure" bekannt + +A03 – Injection:: Einschleusen nicht vertrauenswürdiger Daten in einen Interpreter (SQL-, OS-, LDAP-Injection) + +A04 – Unsicheres Design:: Fehlende oder ineffektive Sicherheitsmaßnahmen durch fehlerhaftes Design und unzureichendes Threat Modeling + +A05 – Sicherheitsfehlkonfiguration:: Unsichere Standardeinstellungen, unvollständige Konfigurationen, offener Cloud-Speicher, zu ausführliche Fehlermeldungen + +A06 – Veraltete und anfällige Komponenten:: Einsatz von Bibliotheken, Frameworks oder Komponenten mit bekannten Schwachstellen + +A07 – Fehler bei Identifizierung und Authentifizierung:: Schwächen bei Authentifizierung, Session-Management und Credential-Verwaltung + +A08 – Fehler bei Software- und Datenintegrität:: Fehlende Absicherung gegen Integritätsverletzungen (z. B. unsichere Deserialisierung, Manipulation der CI/CD-Pipeline) + +A09 – Unzureichendes Sicherheits-Logging und -Monitoring:: Mangelnde Protokollierung, Erkennung und Reaktion auf Sicherheitsvorfälle + +A10 – Server-Side Request Forgery (SSRF):: Server ruft externe Ressourcen von angreiferkontrollierten URLs ab, ohne diese zu validieren + + +Schlüsselvertreter:: OWASP Foundation (https://owasp.org/Top10/, erstmals 2003 veröffentlicht, aktuelle Ausgabe 2021) + +[discrete] +== *Wann zu verwenden*: + +* Durchführung von Sicherheitsrisikobewertungen für Webanwendungen +* Erstellung von Richtlinien für sicheres Programmieren und Entwicklerschulungen +* Durchführung von Threat Modeling und sicherheitsorientierten Design-Reviews +* Priorisierung von Sicherheitsbefunden bei Code-Reviews und Penetrationstests +* Definition von Abnahmekriterien für Sicherheitsanforderungen +* Prüfung von Drittanbieter- oder Open-Source-Komponenten auf bekannte Schwachstellen + +[discrete] +== *Verwandte Anker*: + +* <> +* <> +==== diff --git a/website/public/data/anchors.json b/website/public/data/anchors.json index e2f59c0..c2b7f45 100644 --- a/website/public/data/anchors.json +++ b/website/public/data/anchors.json @@ -625,6 +625,37 @@ "tags": [], "filePath": "docs/anchors/nelson-rules.adoc" }, + { + "id": "owasp-top-10", + "title": "OWASP Top 10", + "categories": [ + "testing-quality" + ], + "roles": [ + "software-developer", + "software-architect", + "qa-engineer", + "devops-engineer", + "consultant", + "team-lead" + ], + "related": [ + "regulated-environment", + "iec-61508-sil-levels" + ], + "proponents": [ + "OWASP Foundation" + ], + "tags": [ + "security", + "web-security", + "vulnerabilities", + "risk", + "appsec", + "owasp" + ], + "filePath": "docs/anchors/owasp-top-10.adoc" + }, { "id": "problem-space-nvc", "title": "Problem Space NVC", diff --git a/website/public/data/categories.json b/website/public/data/categories.json index ba6b132..c2bfb5a 100644 --- a/website/public/data/categories.json +++ b/website/public/data/categories.json @@ -118,6 +118,7 @@ "anchors": [ "iec-61508-sil-levels", "mutation-testing", + "owasp-top-10", "property-based-testing", "tdd-chicago-school", "tdd-london-school", diff --git a/website/public/data/metadata.json b/website/public/data/metadata.json index 6d2ceeb..6ce00c0 100644 --- a/website/public/data/metadata.json +++ b/website/public/data/metadata.json @@ -1,15 +1,15 @@ { - "generatedAt": "2026-03-01T22:48:19.586Z", + "generatedAt": "2026-03-04T12:59:17.826Z", "version": "1.0.0", "counts": { - "anchors": 53, + "anchors": 54, "categories": 12, "roles": 12 }, "statistics": { - "averageRolesPerAnchor": "3.28", + "averageRolesPerAnchor": "3.33", "averageCategoriesPerAnchor": "1.00", - "anchorsWithTags": 8, - "anchorsWithRelated": 7 + "anchorsWithTags": 9, + "anchorsWithRelated": 8 } } \ No newline at end of file diff --git a/website/public/data/roles.json b/website/public/data/roles.json index 3195e0b..959d610 100644 --- a/website/public/data/roles.json +++ b/website/public/data/roles.json @@ -37,6 +37,7 @@ "mental-model-according-to-naur", "morphological-box", "moscow", + "owasp-top-10", "problem-space-nvc", "pyramid-principle", "regulated-environment", @@ -71,6 +72,7 @@ "five-whys", "iec-61508-sil-levels", "nelson-rules", + "owasp-top-10", "regulated-environment", "semantic-versioning", "spc", @@ -116,6 +118,7 @@ "five-whys", "iec-61508-sil-levels", "mutation-testing", + "owasp-top-10", "property-based-testing", "regulated-environment", "rubber-duck-debugging", @@ -144,6 +147,7 @@ "madr", "mece", "morphological-box", + "owasp-top-10", "pugh-matrix", "regulated-environment", "solid-principles", @@ -175,6 +179,7 @@ "mental-model-according-to-naur", "morphological-box", "mutation-testing", + "owasp-top-10", "property-based-testing", "regulated-environment", "rubber-duck-debugging", @@ -210,6 +215,7 @@ "madr", "mental-model-according-to-naur", "moscow", + "owasp-top-10", "pugh-matrix", "pyramid-principle", "regulated-environment",