OWASP principles and security audits Flashcards
What does ‘minimize attack surface area’ mean?
Reducing all the potential vulnerabilities that a threat actor could exploit.
What is the principle of least privilege?
Users should have the least amount of access required to perform their everyday tasks.
What is defense in depth?
Organizations should have varying security controls that mitigate risks and threats.
What is separation of duties?
Critical actions should rely on multiple people, each of whom follow the principle of least privilege.
What does ‘keep security simple’ mean?
Avoid unnecessarily complicated solutions, as complexity makes security difficult.
What does ‘fix security issues correctly’ involve?
When security incidents occur:
Identify the root cause
Contain the impact
Identify vulnerabilities
Conduct tests to ensure successful remediation
What does ‘establish secure defaults’ mean?
The optimal security state of an application should be its default state for users; it should take extra work to make the application insecure.
What does ‘fail securely’ mean?
When a control fails or stops, it should default to its most secure option. For example, a failing firewall should block all connections rather than accept everything.
What does ‘don’t trust services’ mean?
Organizations shouldn’t explicitly trust that their third-party partners’ systems are secure, even when working together.
What is ‘avoid security by obscurity’?
The security of key systems should not rely on keeping details hidden. Security should depend on factors like password policies, defense in depth, and solid network architecture.
What should be included when identifying the scope of an audit?
The audit should:
List assets to be assessed
Note how the audit will help achieve organizational goals
Indicate audit frequency
Include evaluation of organizational policies, protocols, and procedures
What are examples of assets that should be assessed in an audit?
Examples include:
Firewall configurations
PII security
Physical asset security
Implementation of organizational policies
What is a risk assessment in an audit?
An evaluation of identified organizational risks related to:
Budget
Controls
Internal processes
External standards and regulations
What happens during the audit conducting phase?
You assess the security of the identified assets listed in the audit scope.
What is a mitigation plan?
A strategy established to:
Lower the level of risk
Reduce potential costs and penalties
Address issues that can negatively affect the organization’s security posture
