E-BOOK

Protect Your Applications

Against All OWASP Top 10 Risks
Content

Web Applications are the Most Successful Vector for Breaches............. 3

Making OWASP Guidance Actionable and Automated............................. 4

Essential security tools for web applications........................................... 4

A1: Injection.................................................................................................. 7

A2: Broken Authentication and Session Management............................. 8

A3: Sensitive Data Exposure....................................................................... 9

A4: XML External Entities (XXE).................................................................10

A5: Broken Access Control........................................................................11

A6: Security Misconfiguration...................................................................12

A7: Cross-Site Scripting (XSS)....................................................................13

A8: Insecure Deserialization.....................................................................14

A9: Using Components with Known Vulnerabilities...............................15

A10: Insufficient Logging & Monitoring...................................................16

Learn More.................................................................................................17

About Imperva............................................................................................18

2 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
Web Applications are the Most Successful Vector for Breaches

Web Applications are the Most

Successful Vector for Breaches
When it comes to discovering the weakest link in your company’s security defenses, you may need to look
no further than your web applications. According to the 2017 Verizon Data Breach Investigation Report,
more successful breaches resulted from attacks on web applications than any other type of attack.
2017 OWASP
That’s why the Open Web Application Security Project (OWASP) is focused on researching and
Top 10 identifying the most common web application attacks. An open community and not-for-profit
• Injection organization, OWASP is dedicated to providing an unbiased source of information on cybersecurity
• Broken Authentication best practices. One of the most valuable awareness projects from OWASP is the OWASP Top 10,
• Sensitive Data Exposure which was first released in 2003 and revised most recently in 2017. It provides excellent insight into
• XML External Entities (XXE) the most critical security risks to web applications.
• Broken Access Control
• Security Misconfiguration
In spite of the fact that more than half of the threats on the OWASP 2017 Top 10 list have been
• Cross-Site Scripting (XSS)
in existence for more than a decade, many organizations still lack the processes and technology
• Insecure Deserialization
• Using Components with to protect against these threats. In fact, OWASP confirmed that many applications are still at risk
Known Vulnerabilities when it gathered and analyzed data on more than 50,000 applications contributed by a variety of
• Insufficient Logging & Monitoring organizations, consultants, and vendors. More than 2.3 million vulnerabilities were identified within
the applications submitted.

Clearly organizations are struggling to properly address web application security. This eBook goes
beyond the guidance from OWASP to provide insight into ways that security teams can use best-of-breed
solutions to protect against recently identified OWASP Top 10 threats. These solutions provide layers of
defense that work together to significantly mitigate the risk of each Top 10 threat to your organization.

3 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
Making OWASP Guidance Actionable and Automated

Making OWASP Guidance Actionable and Automated

OWASP has provided information on the top web application threats and guidance on how to prevent them since
2003. For the most part, the threats have not changed substantially during that time. Yet in 2016, web application
attacks were the most successful vector for breaches. What happened?

While the OWASP Top 10 document describes ways to prevent attacks based on each type of threat, human efforts
to practice secure coding, discover flaws, define and follow security best practices, and monitor application usage
are limited by enormous volumes of code, the pace of change, scarce resources and limited skillsets.

It’s physically impossible to inspect every piece of code—both custom and third party—to determine whether a
component is 100 percent vulnerability-free. For this reason, automation of web application security is imperative.

Essential security tools for web applications

Best-of-breed security solutions can protect applications and data—both on-premises and in the cloud—against all
online threats, including, but not limited to, the OWASP Top 10. Imperva protects your web applications and data
against web attacks, distributed denial of service (DDoS) attacks, site scraping and fraud.

4 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
Making OWASP Guidance Actionable and Automated

Subscription Services
• Reputation
HTTP Attacks • Community Defense
Account Takeover • Bot Protection
• Account takeover
Attempts

Imperva
SecureSphere
Web Application
Firewall (WAF)
Internet Firewall Web Database
Servers Servers

Non-HTTP
Attacks Imperva Web Application Security

Imperva SecureSphere Web Application Firewall (WAF) is an on-premises solution that analyzes all user
access to your web applications and protects your applications and data from attacks.

Imperva ThreatRadar arms Imperva SecureSphere Web Application Firewall with globally crowdsourced,
real-time threat intelligence to stop known malicious users and industrialized, multi-vector attacks.

Imperva SecureSphere Database Audit and Protection monitors database and user activity to detect and
stop unauthorized access of sensitive data.

5 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
Making OWASP Guidance Actionable and Automated

Imperva Subscription Services

Incapsula • Website Security
• DDoS Protection
• CDN & Optimizer
• Load Balancing

Imperva Incapsula Network

Web
Servers

Non-HTTP
Attacks Imperva Incapsula Web Application Security

Imperva Incapsula Web Security offers a cloud WAF as a standard feature of the Incapsula service that
also includes a CDN and optional DDoS protection and load balancing.

6 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A1: Injection

A1: Injection
Exploitability: Easy • Signature recognition, IP reputation and other
security methodologies are used by Incapsula’s SQL
Prevalence: Common
injection correlation engine to identify and block
Impact: Severe SQL injections.
Risk: Injection flaws, such as SQL, NoSQL, OS, and LDAP • Incapsula protects against Remote File Inclusion (RFI)
injection occur when an application sends untrusted by monitoring user inputs and filtering out malicious
data to an interpreter as part of a command or query. requests using a combination of signature, behavioral
The attacker’s hostile data can trick the interpreter into and reputation-based security heuristics.
executing unintended commands or accessing data • Attacker data (e.g. IP addresses, attack signatures,
without proper authorization.
etc.) is correlated across the entire Incapsula network
Protection: In addition to the OWASP recommendation to quickly pinpoint known malicious users and block
of keeping untrusted data separate from commands their access to protected sites.
and queries, organizations can use Imperva to • Incapsula IncapRules is a security rules engine that
accurately detect and block multiple types of injection enables granular customization of default security
attacks using a variety of techniques. settings and the creation of additional case-specific
security policies.
• A unique SQL injection correlation engine combines
information from the web application profile (positive
security model) and matches this information with
attack signatures (negative security model) using
SecureSphere’s Correlated Attack Validation engine.
• Pre-defined signatures help block additional injection
attacks such as LDAP, XPath, and OS injection.

7 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A2: Broken Authentication and Session Management

A2: Broken Authentication and Session Management

Exploitability: Easy • Strong correlation capabilities allow you to define
advanced rules for detection of session hijacking
Prevalence: Common
attempts such as simultaneous user authentication
Impact: Severe from two different IP addresses.
Risk: Application functions related to authentication • Application user tracking automatically captures
and session management are often implemented web application user names and associates all
incorrectly, allowing attackers to compromise subsequent session activity with that specific
passwords, keys, or session tokens, or to exploit other username to detect successful or failed logins
implementation flaws to assume (temporarily or and prevent brute-force attacks.
permanently) the identities of other users. • Incapsula includes a two-factor authentication
Protection: Imperva helps you meet OWASP (2FA) solution that provides strong, multi-factor
recommendations for strong authentication and session authentication for any website protected by Incapsula
controls and also helps you stop session attacks such as without requiring application code changes or
session hijacking, fixation, and tampering. hardware or software installation.
• The Incapsula IncapRules security rules engine
• When deployed as a transparent bridge,
enables granular customization of default security
SecureSphere tracks and enforces session variables,
settings and the creation of additional case-specific
without intruding on an application’s session
security policies.
management facility.
• SecureSphere profiles application activity to learn
about cookies and correctly identify attacks such as
cookie injection or poisoning.

8 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A3: Sensitive Data Exposure

A3: Sensitive Data Exposure

Exploitability: Average • By preventing the attacks that lead to a data breach—
such as man-in-the-middle (MITM), SQL injection, and
Prevalence: Widespread
OS command injection attacks—Imperva drastically
Impact: Severe reduces the opportunity for attackers to access
Risk: Sensitive data exposure has been the most encrypted data.
common, impactful attack according to OWASP. Many
web applications and APIs do not properly protect
sensitive data, such as financial, healthcare, and
personally identifiable information (PII). Attackers may
steal or modify such weakly protected data to conduct
credit card fraud, identity theft, or other crimes.
Protection: Imperva mitigates exposure of sensitive data
by preventing the attacks that lead to a data breach.
• Using data loss prevention (DLP) rules, SecureSphere
mitigates data exposure by inspecting outbound
traffic for sensitive information such as cardholder
data and Social Security numbers. If SecureSphere
detects leakage of sensitive data, it blocks web server
responses before they reach the end user.
• Imperva also stops malicious users from exploiting
web server and application vulnerabilities to gain
control and access sensitive data.

9 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A4: XML External Entities (XXE)

A4: XML External Entities (XXE)

Exploitability: Average • Signature recognition and other security
methodologies are used by Incapsula to identify
Prevalence: Common
and block XXE injections.
Impact: Severe
• Attacker data (e.g. IP addresses, attack signatures,
Risk: An XXE attack occurs when XML input containing etc.) is correlated across the entire Incapsula network
a reference to an external entity is processed by a to quickly pinpoint known malicious users and block
weakly configured XML parser. Attackers can exploit their access to protected sites.
vulnerable XML processors if they are able to upload
XML or include hostile content in an XML document.
Such an attack can lead to the disclosure of confidential
data, denial of service, server side request forgery, port
scanning from the perspective of the machine where
the parser is located, and other system impacts.
Protection: Imperva helps protect your organization
from XXE attacks against vulnerable XML processors
by detecting and blocking the threats using
multiple techniques.
• A correlation engine combines information from
the web application profile (positive security model)
and matches this information with out-of-the-box
attack signatures (negative security model) using
SecureSphere’s Correlated Attack Validation engine.
• Continual ThreatRadar threat intelligence and
signature updates help SecureSphere and Incapsula
automatically block emerging threats.

10 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A5: Broken Access Control

A5: Broken Access Control

Exploitability: Average • Custom policies can restrict access to certain files
by IP address or user name.
Prevalence: Common
• Dynamic application profiling identifies and
Impact: Severe
understands expected behavior for elements of
Risk: When restrictions on what authenticated users are an application to detect attempts to manipulate
allowed to do are not properly enforced, attackers can input values.
exploit these flaws to access unauthorized functionality • Imperva detects and blocks users from performing
and/or data. The threats include: unauthorized access to
activities that are considered a risk to a web
other users’ accounts, viewing sensitive files, modifying
environment. Attacks through valid user input against
other users’ data, changing access rights, and more.
known attack vectors, behaviors, and deviations are
Protection: Imperva helps you go beyond code review blocked.
to verify that all data and functions have appropriate • In addition to existing usernames and passwords,
controls for detecting and blocking risky or potentially Incapsula’s Login Protect feature adds a second level
malicious activities. of authentication based on a one-time passcode sent
• Dynamic application profiling learns which URLs and to the authenticating user via email, text message
functions require a valid session identifier such as (SMS), or Google Authenticator mobile application.
a cookie. If a cookie is not present or if the user has Login Protect can also be used as a primary method
manipulated it, then SecureSphere can block the of authentication.
session, user, or IP address.
• If attackers attempt to access hidden or protected
URLs by enumerating different file and directory
names, SecureSphere thwarts the attempt to use
forceful browsing to circumvent function-level
access controls.

11 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A6: Security Misconfiguration

A6: Security Misconfiguration

Exploitability: Easy • By applying both generic and application-
specific security measures, Incapsula can prevent
Prevalence: Widespread
exploitation of vulnerabilities created by security
Impact: Moderate misconfigurations.
Risk: Attackers will often try to exploit unpatched flaws • Incapsula can implement virtual patching on many
or access default accounts, unused pages, unprotected common applications such as WordPress, Joomla,
files and directories, and other misconfigurations to Drupal, and others to protect against known
gain unauthorized access or knowledge of the system. vulnerabilities and misconfiguration issues.
Security misconfiguration can happen at any level • With two-factor authentication from Incapsula,
of the application stack, including: network services,
misconfigurations such as using default names and
frameworks, application servers, web servers, database
passwords can be mitigated by forcing users to
servers, platforms, and other components.
successfully pass a second layer of authentication
Protection: Imperva protects against vulnerabilities to access sensitive areas of websites.
created by human configuration errors such as incorrect
security settings, unpatched software, and others.
• By profiling normal input, SecureSphere can alert
on and block deviations and attempts to misuse
access. If a developer or network administrator
misconfigured something within the environment and
an attacker tries to gain access, SecureSphere can
detect the deviation from normal usage and block it.
• Integrations with leading web server and application
scanners enables SecureSphere to import scan
results to instantly mitigate misconfigurations by
virtually patching vulnerabilities.

12 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A7: Cross-Site Scripting (XSS)

A7: Cross-Site Scripting (XSS)

Exploitability: Easy • SecureSphere analyzes where the XSS pattern
appears (for example, in a web page hyperlink) and
Prevalence: Widespread
whether the XSS pattern is new or a standard part of
Impact: Moderate the web application.
Risk: XSS is the second most prevalent issue in the • XSS signatures, policies, and correlation rules are
OWASP Top 10 and is found in roughly two-thirds of used by Imperva to detect and block attacks.
all applications. Flaws occur whenever an application • Utilizing a combination of algorithms, SecureSphere
includes untrusted data in a new web page without
validates user input and application behavior to
proper validation or escaping, or updates an existing
accurately detect and mitigate evasion techniques.
web page with user-supplied data using a browser
API that can create JavaScript. XSS allows attackers to
• Incapsula uttilizes custom signatures and specific
execute scripts in the victim’s browser, which can hijack XSS rules with system-wide correlation of attacker
user sessions, deface web sites, or redirect the user to data (e.g. IP addresses, attack signatures, etc.) across
malicious sites. the entire Incapsula network to quickly pinpoint
known malicious users and block their access to
Protection: Imperva accurately detects and mitigates protected sites.
XSS attacks using both positive (white list) and negative
(black list) models. The negative security model
explicitly declines known attack signatures and includes
XSS signatures, keywords, suspicious patterns and other
indicators to correctly detect XSS attacks.
• Dynamic Profiling creates an additional layer of
defense using a positive security model of the
application structure. It uses the dynamic web
application profile to allow only legitimate
user input.

13 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A8: Insecure Deserialization

A8: Insecure Deserialization

Exploitability: Difficult • Using its profiling mechanism to learn which external
web applications are allowed to communicate
Prevalence: Common
messages for deserialization to the protected
Impact: Severe domain, SecureSphere automatically detects
Risk: Applications and APIs can be vulnerable if they attempted injections.
deserialize (take structured data and rebuild it into • ThreatRadar Emergency Feed automatically updates
an object) hostile or tampered-with data supplied attack signatures and provides predefined security
by an attacker. While exploitation of deserialization policies to block emerging threats.
is somewhat difficult, the impact can be severe, with • Signature recognition is used by Incapsula to
deserialization flaws potentially leading to remote code
identify and block deserialization attacks.
execution, denial of service, and access control attacks.
• Virtual patching enables Incapsula to auto-apply
Protection: Imperva defends your applications against a patch on the edge to protect against known
deserialization attacks using profiling and policies, as vulnerabilities.
well as white- and black-list security models. Our zero-
day protection rules spot attacks, giving our security
team insight that is then used to publish new, dedicated
security rules to provide maximum protection to
Imperva SecureSphere and Incapsula WAF customers
against vulnerabilities such as the Apache Struts REST
Plugin XStream XML Request Deserialization RCE and
others.
• SecureSphere out-of-the-box policy rule detects and
blocks deserialization attacks using digital signatures.

14 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A9: Using Components with Known Vulnerabilities

A9: Using Components with Known Vulnerabilities

Exploitability: Average • For commonly used applications such as WordPress,
Joomla, Drupal, and others, Incapsula virtually
Prevalence: Widespread
patches the software to prevent any known
Impact: Moderate vulnerabilities from being exploited by attackers.
Risk: Components—such as libraries, frameworks, and When a new vulnerability is published, the Incapsula
other software modules—run with the same privileges as security team quickly develops a signature or set of
the application. If a vulnerable component is exploited, policies to virtually patch the vulnerability across the
such an attack can facilitate serious data loss or server entire Incapsula network.
takeover. Applications and APIs using components • Through defenses such as virtual patching, SQL
with known vulnerabilities may undermine application injection and XSS correlation engines, detection
defenses and enable various attacks and impacts. of HTTP protocol violations, and backdoor shell
Protection: Imperva protects web applications that protection, Incapsula identifies attempts to exploit
use third-party components, which may be vulnerable vulnerable components.
to exploits. • The Incapsula Research Team monitors external
sources such as new vulnerability disclosures and
• Using multiple layers of defense, including patented
analyzes all traffic going through Incapsula. Any new
Dynamic Profiling technology, SQL injection and XSS
attack identified on the network is automatically
correlation engines, and detection of HTTP protocol
analyzed, and new mitigation rules are propagated
violations, SecureSphere identifies known and zero-
to customers.
day attempts to exploit vulnerable components.
• Dynamic Profiling allows only legitimate values to be
used as input parameters and methods for URLs.
• Once a new vulnerability is published, the Imperva
Defense Center quickly develops a signature or a set
of policies to virtually patch the vulnerability.

15 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
A10: Insufficient Logging & Monitoring

A10: Insufficient Logging & Monitoring

Exploitability: Average • Machine learning is used to create a positive security
model of an application’s profile, avoiding false-
Prevalence: Widespread
positives and improving detection of anomalies by
Impact: Moderate learning the behavior of the common way to interact
Risk: Rather than a specific type of web application with the application.
threat or vulnerability, this risk is about the lack of or • For complete visibility into all database transactions,
incompleteness of best practices for detecting and including local privileged user access and service
responding to attacks. OWASP states that exploitation accounts, SecureSphere Database Audit and
of insufficient logging and monitoring is the bedrock Protection continuously monitors and audits all
of nearly every major incident. Attackers rely on the logins/logouts, updates, privileged activities
absence of monitoring and timely response to achieve and more.
their goals without being detected. • Incapsula provides a detailed analysis of every threat
Protection: In addition to detecting and blocking posed to a website including: IP address, user agent,
attacks, Imperva also provides extensive logging location, and other pertinent session information.
and alerting, including customizable reporting, for • Weekly graphical reports visualize trends in website
rapid response to security events. It minimizes false traffic, threats, and performance improvements.
positives by using Dynamic Profiling supported by
• A real-time statistics dashboard enables users to get
machine learning.
instant access to live information about their website
• Logging and monitoring with rich, graphical traffic and performance.
reporting capabilities provide detailed, actionable
• Proprietary machine learning and classification
security event information.
techniques reduce false positives.
• Custom policies can be defined to protect specific
• The IncapRules security rules engine enables granular
application weaknesses from attack.
customization of default security settings and the
creation of additional case-specific security policies.

16 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
Learn More

Learn More
The OWASP Top 10 is an excellent resource to understand today’s most critical risks for web
applications. It gives security teams and developers a structure around which to prioritize and organize
their security strategy. It also offers guidance on how to mitigate the threats.
An essential component of any web application strategy is automation. The right security solutions
dynamically learn the normal behavior of your applications to identify and act on application
vulnerability attacks including the ones in the OWASP Top 10, as well as business logic attacks such
as site scraping and account takeover attacks as well as other fraudulent activities.
Learn more about how Imperva can protect your applications against OWASP Top 10 and other threats:
• Incapsula Website Security
• Imperva SecureSphere
• Imperva Blog
• Imperva Incapsula Blog
• Gartner Magic Quadrant for Web Application Firewalls
• The State of Web Application Vulnerabilities
• Imperva App Security Center: OWASP Top 10

17 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
 About Imperva
Imperva® (NASDAQ: IMPV) is a leading provider of cyber security solutions that protect business-critical
data and applications. The company’s SecureSphere, CounterBreach, Incapsula and Camouflage
product lines enable organizations to discover assets and risks, protect information wherever it lives—in
the cloud and on-premises—and comply with regulations. The Imperva Defense Center, a research team
comprised of some of the world’s leading experts in data and application security, continually enhances
Imperva products with up-to-the-minute threat intelligence, and publishes reports that provide insight
and guidance on the latest threats and how to mitigate them. Imperva is headquartered in Redwood
Shores, California.
Learn more: [Link], our blog, on Twitter.

18 Protect Your Applications Against All OWASP Top 10 Risks | January 2018
© 2018, Imperva, Inc. All rights reserved. Imperva, the Imperva logo, SecureSphere, Incapsula, CounterBreach,
ThreatRadar, and Camouflage and design are trademarks of Imperva, Inc. and its subsidiaries. All other brand or
product names are trademarks or registered trademarks of their respective holders.
EBook-OWASP_Top_Ten_2017_0118-v3 [Link]