3 ms·
The OWASP Top 10 is a list of vulnerabilities, not a checklist of things you have to actually "do".
by tptacek 11mo ago
The OWASP Top 10 is a list of vulnerabilities, not a checklist of things you have to actually "do".
- flomo 11mo agoCompletely agree. But fyi there is a bunch of dev training stuff around this, implying like "don't do an owasp or you're in trouble".
- ozim 11mo agoIf you look from perspective of vulnerability assessment, it kind of is.
- scott_w 11mo agoWhile you’re correct, corporate security teams demand suppliers “comply with OWASP,” despite this being a nonsensical statement to anyone who’d read the website. Unfortunately, the customer purchasing your product doesn’t know this and (naturally) trusts their own internal experts over you. Especially given all their other suppliers are more than happy to state they’re certified!
- tptacek 11mo agoI'm, uh, pretty familiar with the routine. I stand by what I said: you do not need any particular CSRF defense in place; you need to not have CSRF vulnerabilities. There's no OWASP checkbox-alike that requires you to have CSRF tokens, and plenty of real line-of-business apps at gigantic companies don't.
- scott_w 11mo agoTo be fair, though, you’re a lot more knowledgeable and experienced than some security “experts” I’ve had to deal with ;-)