OWASP - User contributions [en]

Projects/OWASP Enterprise Application Security Project

2017-11-29T08:49:00Z

Alexander:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Project About</noinclude>
| project_name = OWASP Enterprise Application Security Project
| project_home_page = OWASP Enterprise Application Security Project

| project_description =

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guideline for EA security assessment.

| project_license = [http://creativecommons.org/licenses/by-sa/3.0/ '''Creative Commons Attribution Share Alike 3.0''']

| leader_name1 = Alexander Polyakov
| leader_email1 = a.polyakov@erpscan.com
| leader_username1 = Alexander

| contributor_name2 = Dmitriy Chastuhin
| contributor_email2 = chipik2@gmail.com
| contributor_username2 =

| pamphlet_link =

| presentation_link =

| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp-eas

| project_road_map = http://www.owasp.org/index.php/OWASP_Enterprise_Application_Security_Project/Roadmp

| links_url1 = http://erpscan.com/
| links_name1 = ERPSCAN Enterprise Security Software and Services

| links_url2 = http://eas-sec.org/
| links_name2 = EAS-SEC

| release_4 =

| project_about_page = Projects/OWASP Enterprise Application Security Project
}}

Enterprise Application Vulnerability Statistics

2017-11-29T08:41:16Z

Alexander: /* Authors */

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show a result of statistical research in the business application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what kind of tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still don’t pay much attention to enterprise business application area, as we see during our and our collegues' researches and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. The purpose of those surveys is to increase awareness about business application security.

== Links ==

Surveys:

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

[http://erpscan.com/wp-content/uploads/2014/02/SAP-Security-in-Figures-A-Global-Survey-2013.pdf SAP Security In Figures – A Global Survey 2013]

Links:

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin

 

== Contributors ==

User:Alexander

2017-11-29T08:39:39Z

Alexander:

A Founder of ERPScan. His expertise covers security of enterprise business-critical software like ERP, CRM, SRM, banking and processing software. He is the manager of OWASP-EAS (OWASP subproject), a well-known security expert of the enterprise applications of such vendors as SAP and Oracle, who published a significant number of the vulnerabilities found in the applications of these vendors with acknowledgements from SAP. He is the writer of multiple whitepapers and surveys devoted to information security research in SAP like "SAP Security in figures". Alexander were invited to speak and train at international conferences such as BlackHat, RSA, HITB and 30 others around globe as well as in internal workshops for SAP and fortune 500 companies.

OWASP Enterprise Application Security Project

2017-11-29T08:38:04Z

Alexander:

=== Main ===

<div style="width:100%;height:100px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>
== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation, or sign-off of large scale (i.e. 'Enterprise') applications.

The latest project information can be found here <nowiki>http://eas-sec.org</nowiki>

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

[[Enterprise Application Vulnerability Statistics]]

2 Help companies to begin the assessment of enterprise applications

[[Enterprise Application Security Vulnerability Assessment]]

3 Help companies to securely develop and customize business applications

[[Enterprise Application Security Development Issues]]

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP Project|Enterprise Application Security Project]]
[[Category:OWASP_Document]]
[[Category:OWASP_Alpha_Quality_Document]]

Enterprise Application Vulnerability Statistics

2014-04-13T23:14:01Z

Alexander:

Enterprise Application Vulnerability Statistics

2014-04-13T23:12:23Z

Alexander:

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show a result of statistical research in the business application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what kind of tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still don’t pay much attention to enterprise business application area, as we see during our and our collegues' researches and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as:

• Network architecture security

• OS security

• Database security

• Application security

• Front-end security

Each of the described layers may have their own vulnerabilities that can give an attacker full access to business data, even if other layers are fully secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness about business application security.

== Links ==

Surveys:

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

[http://erpscan.com/wp-content/uploads/2014/02/SAP-Security-in-Figures-A-Global-Survey-2013.pdf SAP Security In Figures – A Global Survey 2013]

Links:

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Nikolay Mescherin, Kirill Nikitenkov, Dmitry Chastukhin, Dmitry Evdokimov

 

== Contributors ==

Enterprise Application Security Development Issues

2014-04-13T23:10:17Z

Alexander: Created page with " === Development Issues === == Objective == This document will describe different areas of program vulnerabilities that can be found in the source code of Enterprise Busin..."

=== Development Issues ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in the source code of Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write custom code such as ABAP for SAP, PeopleCode for PeopleSoft, X++ for Microsoft Dynamics, PL/SQL for Oracle EBS, LotusScript for Lotus and much, much more. Here, we will try to categorize them into 9 main areas filtered by criticality.

== Main ==

Crosslinks to CWE, SANS, OWASP and risks with descriptions will be added soon.

== 9 most critical types of issues in source code [EASSEC-ASDI-9-2013] ==

 1 Injections (code, SQL, OS)
 2 Critical calls (to DB, to OS)
 3 Missing or bad access control checks (missing auth checks)
 4 Directory / path traversal (write, read, SMBRelay)
 5 Modification of displayed content (XSS stored, XSS linked, JS/HTML injections)
 6 Backdoors (hardcoded credentials)
 7 Covert channels (sockets, HTTP calls, SSRFs)
 8 Information disclosure (hardcoded users, passwords, debug information)
 9 Obsolete statements (READ TABLE, kernel methods)

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov

Alexander Minozhenko

Pavel Kuzmin

Enterprise Application Security Vulnerability Assessment

2014-04-13T23:05:06Z

Alexander:

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start self-assessment of their systems to find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give an attacker full access to business data, even if other layers are completely secured.

All of the data was collected and categorized during our extensive experience of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations for every layer of Enterprise Business Applications that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues - 2010 ==

1 Lack of proper network filtration between EA and corporate network 
2 Lacking or vulnerable encryption between corporate network and EA network 
3 Lack of separation between Test, Dev, and Prod systems< 
4 Lack of encryption inside EA network 
5 Insecure trust relations between components 
6 Insecurely configured Internet-facing applications 
7 Vulnerable or default configuration of routers 
8 Lack of frontend access filtration 
9 Lacking or misconfigured IDS/IPS 
10 Insecure or inappropriate wireless comunications

== Top 10 OS issues - 2010 ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues - 2010 ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lacking or misconfigured network access control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Frontend issues - 2010 ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Top 9 Application issues - 2014 ==

1. Lack of patch management 
2. Default passwords for application access 
3. Unnecessary enabled functionality 
4. Open remote management interfaces 
5. Insecure configuration 
6. Unencrypted communication 
7. Access control and SoD 
8. Insecure trust relations 
9. Logging and monitoring 

== Links ==

[EASSEC-PVAG-ABAP] THE SAP NETWEAVER ABAP PLATFORM VULNERABILITY ASSESSMENT GUIDE 2014

http://erpscan.com/publications/the-sap-netweaver-abap-platform-vulnerability-assessment-guide/

== Authors ==

Alexander Polyakov
Nikolay Mesherin
Kirill Nikitenkov

Enterprise Application Security Vulnerability Assessment

2014-04-13T23:04:19Z

Alexander: Created page with "=== Implementation guides === == Objective == This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Her..."

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start self-assessment of their systems to find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give an attacker full access to business data, even if other layers are completely secured.

All of the data was collected and categorized during our extensive experience of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations for every layer of Enterprise Business Applications that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues - 2010 ==

1 Lack of proper network filtration between EA and corporate network 
2 Lacking or vulnerable encryption between corporate network and EA network 
3 Lack of separation between Test, Dev, and Prod systems< 
4 Lack of encryption inside EA network 
5 Insecure trust relations between components 
6 Insecurely configured Internet-facing applications 
7 Vulnerable or default configuration of routers 
8 Lack of frontend access filtration 
9 Lacking or misconfigured IDS/IPS 
10 Insecure or inappropriate wireless comunications

== Top 10 OS issues - 2010 ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues - 2010 ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lacking or misconfigured network access control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Frontend issues - 2010 ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Top 9 Application issues - 2014 ==

1. Lack of patch management 
2. Default passwords for application access 
3. Unnecessary enabled functionality 
4. Open remote management interfaces 
5. Insecure configuration 
6. Unencrypted communication 
7. Access control and SoD 
8. Insecure trust relations 
9. Logging and monitoring 

== Links ==

[EASSEC-PVAG-ABAP] THE SAP NETWEAVER ABAP PLATFORM VULNERABILITY ASSESSMENT GUIDE 2014
http://erpscan.com/publications/the-sap-netweaver-abap-platform-vulnerability-assessment-guide/

== Authors ==

Alexander Polyakov
Nikolay Mesherin
Kirill Nikitenkov

Enterprise Application Vulnerability Statistics

2014-04-13T23:00:56Z

Alexander: Created page with "==== Statistics ==== == Objective == This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Ap..."

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show a result of statistical research in the business application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what kind of tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still don’t pay much attention to enterprise business application area, as we see during our and our collegues' researches and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as:

• Network architecture security

• OS security

• Database security

• Application security

• Front-end security

Each of the described layers may have their own vulnerabilities that can give an attacker full access to business data, even if other layers are fully secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness about business application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Nikolay Mescherin, Kirill Nikitenkov, Dmitry Chastukhin, Dmitry Evdokimov

 

== Contributors ==

OWASP Enterprise Application Security Project

2014-04-13T22:58:59Z

Alexander:

Enterprise Business Application Security Software

2013-09-16T17:15:07Z

Alexander:

==== Software ====

== Objective ==

Here, information on tools and services that can be used for assessment of business applications will be available.

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess the security of their business applications.

 

== Intro ==

== Main ==

 [http://online.erpscan.com test SAPGUI Security Online]
 [http://erpscan.com/products/erpscan-pentesting-tool/ SAP Pentesting Tool by ERPScan]
 [http://erpscan.com/products/erpscan-webxml-checker/ ERPScan's web.xml checker]
 [http://www.metasploit.com/modules/auxiliary/scanner/sap Metasploit modules for SAP Pentesting]

== Links ==
 

== Authors ==

Enterprise Business Application Security Development Issues

2013-09-16T17:13:59Z

Alexander:

=== Development Issues ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in the source code of Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write custom code such as ABAP for SAP, PeopleCode for PeopleSoft, X++ for Microsoft Dynamics, PL/SQL for Oracle EBS, LotusScript for Lotus and much, much more. Here, we will try to categorize them into 9 main areas filtered by criticality.

== Main ==

Crosslinks to CWE, SANS, OWASP and risks with descriptions will be added soon.

== 9 most critical types of issues in source code (EASAD-9-2013) ==

 1 Injections (code, SQL, OS)
 2 Critical calls (to DB, to OS)
 3 Missing or bad access control checks (missing auth checks)
 4 Directory / path traversal (write, read, SMBRelay)
 5 Modification of displayed content (XSS stored, XSS linked, JS/HTML injections)
 6 Backdoors (hardcoded credentials)
 7 Covert channels (sockets, HTTP calls, SSRFs)
 8 Information disclosure (hardcoded users, passwords, debug information)
 9 Obsolete statements (READ TABLE, kernel methods)

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov

Alexander Minozhenko

Pavel Kuzmin

Enterprise Business Application Security Development Issues

2013-09-16T17:13:28Z

Alexander:

=== Development Issues ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in the source code of Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write custom code such as ABAP for SAP, PeopleCode for PeopleSoft, X++ for Microsoft Dynamics, PL/SQL for Oracle EBS, LotusScript for Lotus and much, much more. Here, we will try to categorize them into 9 main areas filtered by criticality.

== Main ==

Crosslinks to CWE, SANS, OWASP and risks with descriptions will be added soon.

== 9 most critical types of issues in source code (EASAD-9-2013) ==

 1 Injections (code, SQL, OS)
 2 Critical calls (to DB, to OS)
 3 Missing or bad access control checks (missing auth checks)
 4 Directory / path traversal (write, read, SMBRelay)
 5 Modification of displayed content (XSS stored, XSS linked, JS/HTML injections)
 6 Backdoors (hardcoded credentials)
 7 Covert channels (sockets, HTTP calls, SSRFs)
 8 Information disclosure (hardcoded users, passwords, debug information)
 9 Obsolete statements (READ TABLE, kernel methods)

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov
Alexander Minozhenko
Pavel Kuzmin

Enterprise Business Application Security Implementation Assessment

2013-09-16T17:09:10Z

Alexander:

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start self-assessment of their systems to find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give an attacker full access to business data, even if other layers are completely secured.

All of the data was collected and categorized during our extensive experience of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations for every layer of Enterprise Business Applications that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues - 2010 ==

1 Lack of proper network filtration between EA and corporate network 
2 Lacking or vulnerable encryption between corporate network and EA network 
3 Lack of separation between Test, Dev, and Prod systems< 
4 Lack of encryption inside EA network 
5 Insecure trust relations between components 
6 Insecurely configured Internet-facing applications 
7 Vulnerable or default configuration of routers 
8 Lack of frontend access filtration 
9 Lacking or misconfigured IDS/IPS 
10 Insecure or inappropriate wireless comunications

== Top 10 OS issues - 2010 ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues - 2010 ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lacking or misconfigured network access control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Frontend issues - 2010 ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Top 9 Application issues - 2013 ==

1. Lack of patch management 
2. Default passwords for application access 
3. Unnecessary enabled functionality 
4. Open remote management interfaces 
5. Insecure configuration 
6. Unencrypted communication 
7. Access control and SoD 
8. Insecure trust relations 
9. Logging and monitoring 

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov
Nikolay Mesherin
Kirill Nikitenkov

Enterprise Business Application Vulnerability Statistics

2013-09-16T17:01:34Z

Alexander:

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show a result of statistical research in the business application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what kind of tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still don’t pay much attention to enterprise business application area, as we see during our and our collegues' researches and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as:

• Network architecture security

• OS security

• Database security

• Application security

• Front-end security

Each of the described layers may have their own vulnerabilities that can give an attacker full access to business data, even if other layers are fully secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness about business application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Nikolay Mescherin, Kirill Nikitenkov, Dmitry Chastukhin, Dmitry Evdokimov

 

== Contributors ==

Enterprise Business Application Vulnerability Statistics

2013-09-16T16:57:31Z

Alexander:

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show a result of statistical research in the business application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what kind of tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still don’t pay much attention to enterprise business application area, as we see during our and our collegues' researches and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security

Each of the described layers may have their own vulnerabilities that can give an attacker full access to business data, even if other layers are fully secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness about business application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Nikolay Mescherin, Kirill Nikitenkov, Dmitry Chastukhin, Dmitry Evdokimov

 

== Contributors ==

OWASP Enterprise Application Security Project

2013-09-16T16:48:11Z

Alexander:

Enterprise Business Application Security Implementation Assessment

2013-09-15T21:53:37Z

Alexander:

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues - 2010 ==

1 Lack of proper network filtration between EA and Corporate network 
2 Lack or vulnerable encryption between corp net and EA Network 
3 Lack of separation between Test, Dev, and Prod system< 
4 Lack of encryption inside EA Network 
5 Insecure trusted relations between components 
6 Insecurely configured Internet facing applications 
7 Vulnerable / default configuration of routers 
8 Lack of frontend access filtration 
9 Lack or misconfigured monitoring IDS/IPS 
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues - 2010 ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues - 2010 ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lack or misconfigured network acess control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 9 Application issues - 2013 ==

1. Lack of patch management 
2. Default Passwords for application access 
3. Unnecessary enabled functionality 
4. Open remote management interfaces 
5. Insecure configuration 
6. Unencrypted communication 
7. Access control and SOD 
8. Insecure trust relations 
9. Logging and Monitoring 

== Top 10 Frontend issues - 2010 ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov
Nikolay Mesherin
Kirill Nikitenkov

OWASP Enterprise Application Security Project

2013-09-15T21:33:24Z

Alexander:

Enterprise Business Application Security Implementation Assessment

2013-09-15T21:33:13Z

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 
2 Lack or vulnerable encryption between corp net and EA Network 
3 Lack of separation between Test, Dev, and Prod system< 
4 Lack of encryption inside EA Network 
5 Insecure trusted relations between components 
6 Insecurely configured Internet facing applications 
7 Vulnerable / default configuration of routers 
8 Lack of frontend access filtration 
9 Lack or misconfigured monitoring IDS/IPS 
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lack or misconfigured network acess control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management 
2 Default passwords for application access 
3 SoD conficts 
4 Unnecessary enabled application features 
5 Open remote management interfaces 
6 Lack of password lockout/complexity checks 
7 Insecure options 
8 Unecrypted communications 
9 Insecure trust relations 
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov
Nikolay Mesherin
Kirill Nikitenkov

Enterprise Business Application Security Development Issues

2013-09-15T20:44:12Z

Alexander:

=== Development Issues ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in source code of Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code such as ABAP for SAP, PeopleCode for PeopleSoft,X++ for Microsoft Dynamics, PL/SQL for Oracle EBS, LotusScript for Lotus and much much more. Here, we will try to categorize them into 9 main areas filtered by criticality.

== Main ==

Crosslinks to CWE, SANS, OWASP and risks with descriptions will be added soon.

== 9 most critical types of issues in source code (EASAD-9-2013) ==

 1 injections (Code sql os)
 2 critical calls (to db to os )
 3 missing or bad access control checks (miss auth checks )
 4 directory/path traversal (write, read, smbrelay)
 5 Modification of displayed content (XSS stored, linked, js/html injections)
 6 backdoors (hardcoded credentials)
 7 covert channels (sockets, http calls, ssrf's, )
 8 information disclose (hardcoded users, passwords, debug information,
 9 obsolete statements ( READ TABLE, kernel methods,….)

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov
Alexander Minojenko
Pavel Kuzmin

Enterprise Business Application Security Development Issues

2013-09-15T20:42:38Z

Alexander:

=== Development Issues ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in source code of Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code such as ABAP for SAP, PeopleCode for PeopleSoft,X++ for Microsoft Dynamics, PL/SQL for Oracle EBS, LotusScript for Lotus and much much more. Here, we will try to categorize them into 9 main areas filtered by criticality.

== Main ==

Crosslinks to CWE, SANS, OWASP and risks with descriptions will be added soon.

== 9 most critical types of issues in source code (EASAD-9-2013) ==

1 injections (Code sql os)
2 critical calls (to db to os )
3 missing or bad access control checks (miss auth checks )
4 directory/path traversal (write, read, smbrelay)
5 Modification of displayed content (XSS stored, linked, js/html injections)
6 backdoors (hardcoded credentials)
7 covert channels (sockets, http calls, ssrf's, )
8 information disclose (hardcoded users, passwords, debug information,
9 obsolete statements ( READ TABLE, kernel methods,….)

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov
Alexander Minojenko
Pavel Kuzmin

Enterprise Business Application Security Development Issues

2013-09-15T20:36:07Z

Alexander: Created page with " === Development of guides === == Objective == This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications..."

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS 
2 Improper Access Control 
3 Information disclosure 
4 Command/code injection in proprietary language 
5 SQL Injection 
6 Missing Encryption of Sensitive Data 
7 Buffer overflows 
8 Path traversal 
9 CSRF 
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX) 
2 Exposed Dangerous Method or Function (ActiveX) 
3 Insecure scripting server access 
4 File handling Frontend vulnerabilities 
5 Use of a Broken or Risky Cryptographic Algorithm 
6 Cleartext Storage of Sensitive Information 
7 Use of hard-coded password 
8 Lack of integrity checking for front-end application 
9 Cleartext Transmission of Sensitive Information 
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group) 
Mikhail Markevich 
Dmitry Evdokimov (ERPScan Research Group) 
Alexey Sintsov (ERPScan Research Group)

Enterprise Business Application Vulnerability Statistics

2013-09-15T20:33:19Z

Alexander:

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tuyrin, Nikolay Mescherin, Kirill Nikitenkov, Dmitriy Chastuhin, Dmitriy Evdokimov

 

== Contributors ==

OWASP Enterprise Application Security Project

2013-09-15T20:30:59Z

Alexander:

=== Main ===

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (i.e. 'Enterprise') applications.

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

[[Enterprise Business Application Vulnerability Statistics]]

2 Help companies to begin assessment of enterprise applications

[[Enterprise Business Application Security Implementation Assessment]]

3 Help companies to securely develop and customize business applications

[[Enterprise Business Application Security Development Issues]]

4 Develop free tools for Enterprise business applications assessment

[[Enterprise Business Application Security Software]]

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

=== Statistics ===

== Objective ==

This document is the first statistics report which will be repeated annually including tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show the results of statistical research in the Business Application security area made by ERPscan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM, and others are one of the major topics within the field of computer security as these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still do not pay much attention to Enterprise Business Application, judging by our and our collegues' research and assessment data.
Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities.
Overall security of an Enterprise Business Application consist of different layers, such as: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 

Every described layer may have its own vulnerabilities that can give attacker full access to business data even if other layers are completely secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin, Dmitry Evdokimov (ERPScan Research Group)

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS 
2 Improper Access Control 
3 Information disclosure 
4 Command/code injection in proprietary language 
5 SQL Injection 
6 Missing Encryption of Sensitive Data 
7 Buffer overflows 
8 Path traversal 
9 CSRF 
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX) 
2 Exposed Dangerous Method or Function (ActiveX) 
3 Insecure scripting server access 
4 File handling Frontend vulnerabilities 
5 Use of a Broken or Risky Cryptographic Algorithm 
6 Cleartext Storage of Sensitive Information 
7 Use of hard-coded password 
8 Lack of integrity checking for front-end application 
9 Cleartext Transmission of Sensitive Information 
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group) 
Mikhail Markevich 
Dmitry Evdokimov (ERPScan Research Group) 
Alexey Sintsov (ERPScan Research Group)

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 
2 Lack or vulnerable encryption between corp net and EA Network 
3 Lack of separation between Test, Dev, and Prod system< 
4 Lack of encryption inside EA Network 
5 Insecure trusted relations between components 
6 Insecurely configured Internet facing applications 
7 Vulnerable / default configuration of routers 
8 Lack of frontend access filtration 
9 Lack or misconfigured monitoring IDS/IPS 
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lack or misconfigured network acess control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management 
2 Default passwords for application access 
3 SoD conficts 
4 Unnecessary enabled application features 
5 Open remote management interfaces 
6 Lack of password lockout/complexity checks 
7 Insecure options 
8 Unecrypted communications 
9 Insecure trust relations 
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

Enterprise Business Application Vulnerability Statistics 2009

2012-12-26T16:44:05Z

Alexander:

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

In this document, we will show the results of statistical research in the Business Application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical they are and what kind of tendencies we see.

== Intro ==

Business applications like ERP, CRM, SRM are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in them will cause significant monetary loss. Nonetheless, people still don’t pay much attention to Enterprise Business Application area, as we see during our and our colleagues' research and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server, and other parts. Also, those systems rely on various hardware and software that can have their own vulnerabilities. The overall security of Enterprise Business Application consists of different layers, such as: 
• Network architecture security; 
• OS security; 
• Database security; 
• Application security; 
• Front-end security.

Every described layer may have its own vulnerabilities that can give attackers full access to business data even if other layers are fully secured.
In this document, all popular applications from the described levels and their vulnerabilities will be shown. The purpose of this document to increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report coming soon...

== Authors==

Alexander Polyakov (ERPScan Research Group) 
Dmitry Chastukhin (ERPScan Research Group) 
Dmitry Evdokimov (ERPScan Research Group)

== Contributors==

Leodid Kats (dsec.ru) 
Olga Yurova (dsec.ru)

Enterprise Business Application Vulnerability Statistics 2009

2012-12-26T16:43:18Z

Alexander:

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

In this document, we will show the results of statistical research in the Business Application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical they are and what kind of tendencies we see.

== Intro ==

Business applications like ERP, CRM, SRM are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in them will cause significant monetary loss. Nonetheless, people still don’t pay much attention to Enterprise Business Application area, as we see during our and our colleagues' research and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server, and other parts. Also, those systems rely on various hardware and software that can have their own vulnerabilities. The overall security of Enterprise Business Application consists of different layers, such as: 
• Network architecture security 
• Os security 
• Database security 
• Application security 
• Front-end security.

Every described layer may have its own vulnerabilities that can give attackers full access to business data even if other layers are fully secured.
In this document, all popular applications from the described levels and their vulnerabilities will be shown. The purpose of this document to increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report comming soon...

== Authors==

Alexander Polyakov (ERPScan Research Group) 
Dmitry Chastukhin (ERPScan Research Group) 
Dmitriy Evdokimov (ERPScan Research Group)

== Contributors==

Leodid Kats (dsec.ru) 
Olga Yurova (dsec.ru)

Enterprise Business Application Vulnerability Statistics 2009

2012-12-26T16:43:03Z

Alexander:

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

In this document, we will show the results of statistical research in the Business Application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical they are and what kind of tendencies we see.

== Intro ==

Business applications like ERP, CRM, SRM are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in them will cause significant monetary loss. Nonetheless, people still don’t pay much attention to Enterprise Business Application area, as we see during our and our colleagues' research and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server, and other parts. Also, those systems rely on various hardware and software that can have their own vulnerabilities. The overall security of Enterprise Business Application consists of different layers, such as: 
• Network architecture security 
• Os security 
• Database security 
• Application security 
• Front-end security.

Every described layer may have its own vulnerabilities that can give attackers full access to business data even if other layers are fully secured.
In this document, all popular applications from the described levels and their vulnerabilities will be shown. The purpose of this document to increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report comming soon...

== Authors==

Alexander Polyakov (ERPScan Research Group) 
Dmitry Chastukhin (ERPScan Research Group) 
Dmitriy Evdokimov (ERPScan Research Group)

== Contributors==

Leodid Kats (dsec.ru)
Olga Yurova (dsec.ru)

Enterprise Business Application Vulnerability Statistics 2009

2012-12-26T16:42:39Z

Alexander:

== Objective ==

This document is the first statistics report which will be repeated annually, showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

In this document, we will show the results of statistical research in the Business Application security area made by ERPScan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical they are and what kind of tendencies we see.

== Intro ==

Business applications like ERP, CRM, SRM are one of the major topics within the field of computer security because these applications store business data, and any vulnerability in them will cause significant monetary loss. Nonetheless, people still don’t pay much attention to Enterprise Business Application area, as we see during our and our colleagues' research and audits. Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server, and other parts. Also, those systems rely on various hardware and software that can have their own vulnerabilities. The overall security of Enterprise Business Application consists of different layers, such as: 
• Network architecture security 
• Os security 
• Database security 
• Application security 
• Front-end security.

Every described layer may have its own vulnerabilities that can give attackers full access to business data even if other layers are fully secured.
In this document, all popular applications from the described levels and their vulnerabilities will be shown. The purpose of this document to increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report comming soon...

== Authors==

Alexander Polyakov (ERPScan Research Group)
Dmitry Chastukhin (ERPScan Research Group)
Dmitriy Evdokimov (ERPScan Research Group)

== Contributors==

Leodid Kats (dsec.ru)
Olga Yurova (dsec.ru)

OWASP Enterprise Application Security Project/Roadmp

2012-12-26T16:37:40Z

Alexander:

*'''Primary goals''':
#Aware people about EA security vulnerabilities by releasing annual (later, quarterly) statistics of enterprise application security vulnerabilities,
#Help companies to begin EA assessment by creating a guideline for assessing EA security,
#Create a report of top 10 vulnerabilities or a similar report for EA,
#Publish a free tools for EA assessment.

*'''Project Roadmap''' (as mentioned above):
#Create a dashboard with high level overview,
#Create a dashboard about security assessment,
#Create links to other guidelines,
#Publish statistical reports annually,
#Create OWASP EAS Top 10 vulnerabilities page,
#Finish our first security assessment tool.

OWASP Enterprise Application Security Project

2012-12-17T17:03:51Z

Alexander:

=== Main ===

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (i.e. 'Enterprise') applications.

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

=== Statistics ===

== Objective ==

This document is the first statistics report which will be repeated annually including tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show the results of statistical research in the Business Application security area made by ERPscan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM, and others are one of the major topics within the field of computer security as these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still do not pay much attention to Enterprise Business Application, judging by our and our collegues' research and assessment data.
Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities.
Overall security of an Enterprise Business Application consist of different layers, such as: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 

Every described layer may have its own vulnerabilities that can give attacker full access to business data even if other layers are completely secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin, Dmitry Evdokimov (ERPScan Research Group)

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS 
2 Improper Access Control 
3 Information disclosure 
4 Command/code injection in proprietary language 
5 SQL Injection 
6 Missing Encryption of Sensitive Data 
7 Buffer overflows 
8 Path traversal 
9 CSRF 
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX) 
2 Exposed Dangerous Method or Function (ActiveX) 
3 Insecure scripting server access 
4 File handling Frontend vulnerabilities 
5 Use of a Broken or Risky Cryptographic Algorithm 
6 Cleartext Storage of Sensitive Information 
7 Use of hard-coded password 
8 Lack of integrity checking for front-end application 
9 Cleartext Transmission of Sensitive Information 
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group) 
Mikhail Markevich 
Dmitry Evdokimov (ERPScan Research Group) 
Alexey Sintsov (ERPScan Research Group)

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including: 
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 
2 Lack or vulnerable encryption between corp net and EA Network 
3 Lack of separation between Test, Dev, and Prod system< 
4 Lack of encryption inside EA Network 
5 Insecure trusted relations between components 
6 Insecurely configured Internet facing applications 
7 Vulnerable / default configuration of routers 
8 Lack of frontend access filtration 
9 Lack or misconfigured monitoring IDS/IPS 
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services 
2 Missing 3rd party software patches 
3 Insecure trust relations 
4 Universal OS passwords 
5 Missing OS patches 
6 Lacking or misconfigured network access control 
7 Lacking or misconfigured monitoring 
8 Insecure internal acces control 
9 Unencrypted remote access 
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access 
2 Lack of DB patch management 
3 Unnecessary enabled DB features 
4 Lack of password lockout/complexity checks 
5 Unencrypted sensitive data transport / data 
6 Lack or misconfigured network acess control 
7 Extensive user and group privileges 
8 Lacking or misconfigured audit 
9 Insecure trust relations 
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management 
2 Default passwords for application access 
3 SoD conficts 
4 Unnecessary enabled application features 
5 Open remote management interfaces 
6 Lack of password lockout/complexity checks 
7 Insecure options 
8 Unecrypted communications 
9 Insecure trust relations 
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications 
2 Lack of server trust check 
3 Lack of encryption 
4 Autocomplete enabled in the browser 
5 Insecure browser scripting options 
6 Insecure configuration 
7 Insecure sortware distribution service 
8 Lack of AV software 
9 Password stored in configuration file 
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

OWASP Enterprise Application Security Project

2012-12-17T17:02:04Z

Alexander:

=== Main ===

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (i.e. 'Enterprise') applications.

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

=== Statistics ===

== Objective ==

This document is the first statistics report which will be repeated annually including tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show the results of statistical research in the Business Application security area made by ERPscan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM, and others are one of the major topics within the field of computer security as these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still do not pay much attention to Enterprise Business Application, judging by our and our collegues' research and assessment data.
Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities.
Overall security of an Enterprise Business Application consist of different layers, such as:
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 

Every described layer may have its own vulnerabilities that can give attacker full access to business data even if other layers are completely secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin, Dmitry Evdokimov (ERPScan Research Group)

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS
2 Improper Access Control
3 Information disclosure
4 Command/code injection in proprietary language
5 SQL Injection
6 Missing Encryption of Sensitive Data
7 Buffer overflows
8 Path traversal
9 CSRF
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX )
2 Exposed Dangerous Method or Function (ActiveX)
3 Insecure scripting server access
4 File handling Frontend vulnerabilities
5 Use of a Broken or Risky Cryptographic Algorithm
6 Cleartext Storage of Sensitive Information
7 Use of Hard-coded Password
8 Lack of integrity checking for front-end application
9 Cleartext Transmission of Sensitive Information
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich
Dmitry Evdokimov (ERPScan Research Group)
Alexey Sintsov (ERPScan Research Group)

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network
2 Lack or vulnerable encryption between corp net and EA Network
3 Lack of separation between Test, Dev, and Prod system<
4 Lack of encryption inside EA Network
5 Insecure trusted relations between components
6 Insecurely configured Internet facing applicatins
7 Vulnerable / default configuration of routers
8 Lack of frontend access filtration
9 Lack or misconfigured monitoring IDS/IPS
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services
2 Missing 3rd party software patches
3 Insecure trust relations
4 Universal OS passwords
5 Missing OS patches
6 Lacking or misconfigured network access control
7 Lacking or misconfigured monitoring
8 Insecure internal acces control
9 Unencrypted remote access
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access
2 Lack of DB patch management
3 Unnecessary enabled DB features
4 Lack of password lockout/complexity checks
5 Unencrypted sensitive data transport / data
6 Lack or misconfigured network acess control
7 Extensive user and group privileges
8 Lacking or misconfigured audit
9 Insecure trust relations
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management
2 Default passwords for application access
3 SoD conficts
4 Unnecessary enabled application features
5 Open remote management interfaces
6 Lack of password lockout/complexity checks
7 Insecure options
8 Unecrypted communications
9 Insecure trust relations
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications
2 Lack of server trust check
3 Lack of encryption
4 Autocomplete enabled in the browser
5 Insecure browser scripting options
6 Insecure configuration
7 Insecure sortware distribution service
8 Lack of AV software
9 Password stored in configuration file
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

OWASP Enterprise Application Security Project

2012-12-17T17:01:45Z

Alexander:

=== Main ===

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (i.e. 'Enterprise') applications.

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

=== Statistics ===

== Objective ==

This document is the first statistics report which will be repeated annually including tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show the results of statistical research in the Business Application security area made by ERPscan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM, and others are one of the major topics within the field of computer security as these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still do not pay much attention to Enterprise Business Application, judging by our and our collegues' research and assessment data.
Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities.
Overall security of an Enterprise Business Application consist of different layers, such as:
• Network architecture security 
• OS security 
• Database security 
• Application security 
• Front-end security 

Every described layer may have its own vulnerabilities that can give attacker full access to business data even if other layers are completely secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin, Dmitry Evdokimov (ERPScan Research Group)

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS
2 Improper Access Control
3 Information disclosure
4 Command/code injection in proprietary language
5 SQL Injection
6 Missing Encryption of Sensitive Data
7 Buffer overflows
8 Path traversal
9 CSRF
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX )
2 Exposed Dangerous Method or Function (ActiveX)
3 Insecure scripting server access
4 File handling Frontend vulnerabilities
5 Use of a Broken or Risky Cryptographic Algorithm
6 Cleartext Storage of Sensitive Information
7 Use of Hard-coded Password
8 Lack of integrity checking for front-end application
9 Cleartext Transmission of Sensitive Information
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich
Dmitry Evdokimov (ERPScan Research Group)
Alexey Sintsov (ERPScan Research Group)

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network
2 Lack or vulnerable encryption between corp net and EA Network
3 Lack of separation between Test, Dev, and Prod system<
4 Lack of encryption inside EA Network
5 Insecure trusted relations between components
6 Insecurely configured Internet facing applicatins
7 Vulnerable / default configuration of routers
8 Lack of frontend access filtration
9 Lack or misconfigured monitoring IDS/IPS
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services
2 Missing 3rd party software patches
3 Insecure trust relations
4 Universal OS passwords
5 Missing OS patches
6 Lacking or misconfigured network access control
7 Lacking or misconfigured monitoring
8 Insecure internal acces control
9 Unencrypted remote access
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access
2 Lack of DB patch management
3 Unnecessary enabled DB features
4 Lack of password lockout/complexity checks
5 Unencrypted sensitive data transport / data
6 Lack or misconfigured network acess control
7 Extensive user and group privileges
8 Lacking or misconfigured audit
9 Insecure trust relations
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management
2 Default passwords for application access
3 SoD conficts
4 Unnecessary enabled application features
5 Open remote management interfaces
6 Lack of password lockout/complexity checks
7 Insecure options
8 Unecrypted communications
9 Insecure trust relations
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications
2 Lack of server trust check
3 Lack of encryption
4 Autocomplete enabled in the browser
5 Insecure browser scripting options
6 Insecure configuration
7 Insecure sortware distribution service
8 Lack of AV software
9 Password stored in configuration file
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

OWASP Enterprise Application Security Project

2012-12-17T17:00:07Z

Alexander:

=== Main ===

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (i.e. 'Enterprise') applications.

== The purpose of the project ==

Enterprise applications security is one of the major topics in overall security area because those applications control money and resources, and any security violation can result in significant money loss. The purpose of this project is to aware people about enterprise application security problems and create guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise application security vulnerabilities by releasing annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

=== Statistics ===

== Objective ==

This document is the first statistics report which will be repeated annually including tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document will show the results of statistical research in the Business Application security area made by ERPscan Research Group and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical those are and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM, and others are one of the major topics within the field of computer security as these applications store business data, and any vulnerability in these applications will cause a significant monetary loss. Nonetheless, people still do not pay much attention to Enterprise Business Application, judging by our and our collegues' research and assessment data.
Business applications are very large and complex systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities.
Overall security of an Enterprise Business Application consist of different layers, such as:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security

Every described layer may have its own vulnerabilities that can give attacker full access to business data even if other layers are completely secured. In this document, all the popular applications from described levels and their vulnerabilities will be shown. The purpose of this document is to increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmitry Chastukhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tyurin, Dmitry Chastukhin, Dmitry Evdokimov (ERPScan Research Group)

=== Development of guides ===

== Objective ==

This document will describe different areas of program vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document is to increase awareness of the developers of Enterprise Business software. Here, we will collect top software vulnerabilities in server side and frontend side that can exist in Business Applications.

== Intro ==

There are many different languages and technologies that can be used to develop business applications and write costom code. Here, we will try to categorize it first by dividing into Server and Client side. Top 10 list of vulnerabilities for both areas will be shown.

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

1 XSS
2 Improper Access Control
3 Information disclosure
4 Command/code injection in proprietary language
5 SQL Injection
6 Missing Encryption of Sensitive Data
7 Buffer overflows
8 Path traversal
9 CSRF
10 Use of a Broken or Risky Cryptographic Algorithm

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX )
2 Exposed Dangerous Method or Function (ActiveX)
3 Insecure scripting server access
4 File handling Frontend vulnerabilities
5 Use of a Broken or Risky Cryptographic Algorithm
6 Cleartext Storage of Sensitive Information
7 Use of Hard-coded Password
8 Lack of integrity checking for front-end application
9 Cleartext Transmission of Sensitive Information
10 Vulnerable remote services

== Links ==

coming soon

 

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich
Dmitry Evdokimov (ERPScan Research Group)
Alexey Sintsov (ERPScan Research Group)

=== Implementation guides ===

== Objective ==

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

== Purpose ==

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start a self-assessment of their systems and find the most critical violations.

== Intro ==

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are completely secured.

All the data was collected and categorized during our big practice of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

== Main ==

Overall security of Enterprise Business Application consists of different layers, including:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security
In this document, we will describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network
2 Lack or vulnerable encryption between corp net and EA Network
3 Lack of separation between Test, Dev, and Prod system<
4 Lack of encryption inside EA Network
5 Insecure trusted relations between components
6 Insecurely configured Internet facing applicatins
7 Vulnerable / default configuration of routers
8 Lack of frontend access filtration
9 Lack or misconfigured monitoring IDS/IPS
10 Insecure/unappropriate wireless comunications

== Top 10 OS issues ==

1 Unnecessary enabled services
2 Missing 3rd party software patches
3 Insecure trust relations
4 Universal OS passwords
5 Missing OS patches
6 Lacking or misconfigured network access control
7 Lacking or misconfigured monitoring
8 Insecure internal acces control
9 Unencrypted remote access
10 Lack of password lockout/complexity checks 

== Top 10 Database issues ==

1 Default passwords for DB access
2 Lack of DB patch management
3 Unnecessary enabled DB features
4 Lack of password lockout/complexity checks
5 Unencrypted sensitive data transport / data
6 Lack or misconfigured network acess control
7 Extensive user and group privileges
8 Lacking or misconfigured audit
9 Insecure trust relations
10 Open additional interfaces

== Top 10 Application issues ==

1 Lack of patch management
2 Default passwords for application access
3 SoD conficts
4 Unnecessary enabled application features
5 Open remote management interfaces
6 Lack of password lockout/complexity checks
7 Insecure options
8 Unecrypted communications
9 Insecure trust relations
10 Guest access

== Top 10 Frontend issues ==

1 Vulnerable frontend applications
2 Lack of server trust check
3 Lack of encryption
4 Autocomplete enabled in the browser
5 Insecure browser scripting options
6 Insecure configuration
7 Insecure sortware distribution service
8 Lack of AV software
9 Password stored in configuration file
10 Sensitive information storage

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovsky

== Authors ==

Alexander Polyakov (ERPScan Research Group)
Mikhail Markevich

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

User:Alexander

2012-12-15T13:10:56Z

Alexander:

A father of ERPScan Security Scanner for SAP. Organizer of ZeroNights deep-technical security conference. His expertise covers security of enterprise business-critical software like ERP, CRM, SRM, banking and processing software. He is the manager of OWASP-EAS (OWASP subproject), a well-known security expert of the enterprise applications of such vendors as SAP and Oracle, who published a significant number of the vulnerabilities found in the applications of these vendors with acknowledgements from SAP. He is the writer of multiple whitepapers and surveys devoted to information security research in SAP like "SAP Security in figures". Alexander were invited to speak and train at international conferences such as BlackHat, RSA, HITB and 30 others around globe as well as in internal workshops for SAP and fortune 500 companies.

OWASP Enterprise Application Security Project

2012-12-15T13:02:13Z

Alexander:

==== Main ====

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (ie 'Enterprise') applications.

== Project purpose ==

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise applicatio security vulnerabilities by making an Annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating a

Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating a

Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop a free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tuyrin, Dmitriy Chastuhin, Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

==== Development guides ====

== Objective ==

This document we will describe different areas of programm vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document to Increase awareness for Developers of Enterprise business application software. Here we will collect top software vulnerabilities in server site and frontend side that can exist in Business applications.

== Intro ==

There are many different languages and technologies that can be used for developing business applications and writing a costom code. Here we will try to categorize it firstly by dividing into Server and Client site. Top 10 list of vulnerabilities for both areas will be shown.

 

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

 1 XSS 2 Improper Access Control 3 Information disclosure 4 Command/code injection in proprietary language 5 SQL Injection 6 Missing Encryption of Sensitive Data 7 Buffer overflows 8 Path traversal 9 CSRF 10 Use of a Broken or Risky Cryptographic Algorithm 

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX ) 2 Exposed Dangerous Method or Function (ActiveX) 3 Insecure scripting server access 4 File handling Frontend vulnerabilities 5 Use of a Broken or Risky Cryptographic Algorithm 6 Cleartext Storage of Sensitive Information 7 Use of Hard-coded Password 8 Lack of integrity checking for front-end application 9 Cleartext Transmission of Sensitive Information 10 Vulnerable remote services 

 

== Links ==

cooming soon

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich Dmitriy Evdokimov (DSecRG) Alexey Sintsov (DSecRG)

 

== Contributors ==

==== Implementation guides ====

== Objective ==

This document we will describe different areas of Secure implementation of g Enterprise Business Applications and ERP systems. Here we will mainly focus on security architecture and configuration threads because pragramm errors are well described in "Software vulnerabilities" topic

== Purpose ==

The purpose of this document to Increase awareness for Administrators of Business Application security and help them to start a beginning self-assessment of their systems and find a most critical violations.

== Intro ==

Enterprise Business Applications (Like ERP - is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consists of different components such as database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Every described layer may have their own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are fully secured.

All information was collected and catecorized during our big practice of security assessing Popular business applications Like in SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

 

== Main ==

Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security In this document we will Describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

 

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 2 Lack or vulnerable encryption between corp net and EA Network 3 Lack of separation between Test Dev and Prod system 4 Lack of encryption inside EA Network 5 Insecure trusted realations between components 6 Insecure configured Internet facing applicatins 7 Vulnerable / default configured Routers 8 lack of frontend access filtration 9 Lack or misconfigured monitoring IDS/IPS 10 Insecure/unappropriate wireless comunications 

== Top 10 OS issues ==

1 Unnecessary Enabled services 2 Missing 3rd party software patches 3 Insecure trust relations 4 Universal OS passwords 5 Missing OS patches 6 Lack or misconfigured network acess control 7 Lack or misconfigured monitoring 8 Insecure internal acces control 9 Unencrypted remote access 10 Lack of password lockout/complexiry checks 

== Top 10 Database issues ==

1 Default passwords for DB access 2 Lack of DB patch management 3 unnecessary Enabled DB features 4 lack of password lockout/complexiry checks 5 Unencrypted sensitive data transport / data 6 Lack or misconfigured network acess control 7 Extensive user and group privileges 8 lack or misconfigured audit 9 Insecure trust relations 10 Open additional interfaces 

== Top 10 Application issues ==

1 Lack of patch management 2 Default Passwords for application access 3 SOD conficts 4 Unnecessary Enabled Application features 5 Open Remote mngmt interfaces 6 lack of password lockout/complexity checks 7 Insecure options 8 Unecrypted cominications 9 Insecure trust relations 10 Guest access 

== Top 10 Frontend issues ==

1 Vulnerable Frontend applications 2 Lack of server trust check 3 Lack of encryption 4 Aotocomplete browser 5 Insecure Browser scripting options 6 Insecure configuration 7 Insecure sortware distribution service 8 Lack of AV software 9 Password storing in configuration file 10 Sensitive information storage 

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovskiy

 

== Authors ==

Alexander Polyakov (DSecRG)

 

Mikhail Markevich

 

== Contributors ==

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

Enterprise Business Application Security Software

2012-12-15T13:01:09Z

Alexander:

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

 [http://online.erpscan.com test SAPGUI Security Online]
 [http://erpscan.com/products/erpscan-pentesting-tool/ SAP Pentesting Tool by ERPScan]
 [http://erpscan.com/products/erpscan-webxml-checker/ ERPScan's web.xml checker]
 [http://www.metasploit.com/modules/auxiliary/scanner/sap Metasploit modules for SAP Pentesting]

== Links ==

 

== Authors ==

Enterprise Business Application Security Software

2012-12-15T13:00:03Z

Alexander:

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

 [http://online.erpscan.com test SAPGUI Security Online]
 [http://erpscan.com/products/erpscan-pentesting-tool/ test SAP Pentesting Tool by ERPScan]
 [http://erpscan.com/products/erpscan-webxml-checker/ test SAP web.xml with ERPScan webxml checker]
 [http://www.metasploit.com/modules/auxiliary/scanner/sap Metasploit modules for SAP Pentesting]

== Links ==

 

== Authors ==

Enterprise Business Application Security Software

2012-12-15T12:53:29Z

Alexander: Created page with "==== Software ==== == Objective == Here will be given information on a tools and services that can be used for assessment of business applications == Purpose == The pu..."

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

 [http://erpscan.com You can help us to test ERPSCAN Online]

== Links ==

[http://erpscan.com]

 

== Authors ==

Alexander Polyakov
Alexey Sintsov
Dmitriy Evdokimov
Dmitriy Chastuhin

Enterprise Business Application Vulnerability Statistics

2012-12-15T12:51:01Z

Alexander: Created page with "==== Statistics ==== == Objective == This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Busines..."

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tuyrin, Dmitriy Chastuhin, Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

OWASP Enterprise Application Security Project

2012-12-15T12:48:52Z

Alexander:

==== Main ====

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (ie 'Enterprise') applications.

== Project purpose ==

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise applicatio security vulnerabilities by making an Annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating a

Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating a

Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop a free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[https://www.owasp.org/images/6/6b/SAP_Security_in_figures_-_a_global_survey_2007-2011._OWASP-EAS.pdf SAP Security In Figures – A Global Survey 2007-2011]

Links:
[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tuyrin, Dmitriy Chastuhin, Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

==== Development guides ====

== Objective ==

This document we will describe different areas of programm vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document to Increase awareness for Developers of Enterprise business application software. Here we will collect top software vulnerabilities in server site and frontend side that can exist in Business applications.

== Intro ==

There are many different languages and technologies that can be used for developing business applications and writing a costom code. Here we will try to categorize it firstly by dividing into Server and Client site. Top 10 list of vulnerabilities for both areas will be shown.

 

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

 1 XSS 2 Improper Access Control 3 Information disclosure 4 Command/code injection in proprietary language 5 SQL Injection 6 Missing Encryption of Sensitive Data 7 Buffer overflows 8 Path traversal 9 CSRF 10 Use of a Broken or Risky Cryptographic Algorithm 

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX ) 2 Exposed Dangerous Method or Function (ActiveX) 3 Insecure scripting server access 4 File handling Frontend vulnerabilities 5 Use of a Broken or Risky Cryptographic Algorithm 6 Cleartext Storage of Sensitive Information 7 Use of Hard-coded Password 8 Lack of integrity checking for front-end application 9 Cleartext Transmission of Sensitive Information 10 Vulnerable remote services 

 

== Links ==

cooming soon

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich Dmitriy Evdokimov (DSecRG) Alexey Sintsov (DSecRG)

 

== Contributors ==

==== Implementation guides ====

== Objective ==

This document we will describe different areas of Secure implementation of g Enterprise Business Applications and ERP systems. Here we will mainly focus on security architecture and configuration threads because pragramm errors are well described in "Software vulnerabilities" topic

== Purpose ==

The purpose of this document to Increase awareness for Administrators of Business Application security and help them to start a beginning self-assessment of their systems and find a most critical violations.

== Intro ==

Enterprise Business Applications (Like ERP - is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consists of different components such as database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Every described layer may have their own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are fully secured.

All information was collected and catecorized during our big practice of security assessing Popular business applications Like in SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

 

== Main ==

Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security In this document we will Describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

 

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 2 Lack or vulnerable encryption between corp net and EA Network 3 Lack of separation between Test Dev and Prod system 4 Lack of encryption inside EA Network 5 Insecure trusted realations between components 6 Insecure configured Internet facing applicatins 7 Vulnerable / default configured Routers 8 lack of frontend access filtration 9 Lack or misconfigured monitoring IDS/IPS 10 Insecure/unappropriate wireless comunications 

== Top 10 OS issues ==

1 Unnecessary Enabled services 2 Missing 3rd party software patches 3 Insecure trust relations 4 Universal OS passwords 5 Missing OS patches 6 Lack or misconfigured network acess control 7 Lack or misconfigured monitoring 8 Insecure internal acces control 9 Unencrypted remote access 10 Lack of password lockout/complexiry checks 

== Top 10 Database issues ==

1 Default passwords for DB access 2 Lack of DB patch management 3 unnecessary Enabled DB features 4 lack of password lockout/complexiry checks 5 Unencrypted sensitive data transport / data 6 Lack or misconfigured network acess control 7 Extensive user and group privileges 8 lack or misconfigured audit 9 Insecure trust relations 10 Open additional interfaces 

== Top 10 Application issues ==

1 Lack of patch management 2 Default Passwords for application access 3 SOD conficts 4 Unnecessary Enabled Application features 5 Open Remote mngmt interfaces 6 lack of password lockout/complexity checks 7 Insecure options 8 Unecrypted cominications 9 Insecure trust relations 10 Guest access 

== Top 10 Frontend issues ==

1 Vulnerable Frontend applications 2 Lack of server trust check 3 Lack of encryption 4 Aotocomplete browser 5 Insecure Browser scripting options 6 Insecure configuration 7 Insecure sortware distribution service 8 Lack of AV software 9 Password storing in configuration file 10 Sensitive information storage 

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovskiy

 

== Authors ==

Alexander Polyakov (DSecRG)

 

Mikhail Markevich

 

== Contributors ==

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

 [http://erpscan.com You can help us to test ERPSCAN Online]

== Links ==

[http://erpscan.com]

 

== Authors ==

Alexander Polyakov
Alexey Sintsov
Dmitriy Evdokimov
Dmitriy Chastuhin

 

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

File:SAP Security in figures - a global survey 2007-2011. OWASP-EAS.pdf

2012-12-15T12:46:17Z

Alexander: The purpose of this report. is to show a high level view of SAP Security in figures so that the problem area is not just theoretically comprehensible but based on actual numbers and metrics – from the information about the number of found issues and the

The purpose of this report. is to show a high level view of SAP Security in figures so that the problem area is not just theoretically comprehensible but based on actual numbers and metrics – from the information about the number of found issues and their popularity to the number of vulnerable systems, all acquired as a result of a global scan.

OWASP Enterprise Application Security Project

2012-12-15T11:44:46Z

Alexander:

==== Main ====

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (ie 'Enterprise') applications.

== Project purpose ==

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise applicatio security vulnerabilities by making an Annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating a

Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating a

Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop a free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

Surveys:

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[http://erpscan.com/wp-content/uploads/2012/06/SAP-Security-in-figures-a-global-survey-2007-2011-final.pdfSAP Security In Figures – A Global Survey 2007-2011]

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

== Authors ==

Alexander Polyakov, Alexey Tuyrin, Dmitriy Chastuhin, Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

==== Development guides ====

== Objective ==

This document we will describe different areas of programm vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document to Increase awareness for Developers of Enterprise business application software. Here we will collect top software vulnerabilities in server site and frontend side that can exist in Business applications.

== Intro ==

There are many different languages and technologies that can be used for developing business applications and writing a costom code. Here we will try to categorize it firstly by dividing into Server and Client site. Top 10 list of vulnerabilities for both areas will be shown.

 

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

 1 XSS 2 Improper Access Control 3 Information disclosure 4 Command/code injection in proprietary language 5 SQL Injection 6 Missing Encryption of Sensitive Data 7 Buffer overflows 8 Path traversal 9 CSRF 10 Use of a Broken or Risky Cryptographic Algorithm 

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX ) 2 Exposed Dangerous Method or Function (ActiveX) 3 Insecure scripting server access 4 File handling Frontend vulnerabilities 5 Use of a Broken or Risky Cryptographic Algorithm 6 Cleartext Storage of Sensitive Information 7 Use of Hard-coded Password 8 Lack of integrity checking for front-end application 9 Cleartext Transmission of Sensitive Information 10 Vulnerable remote services 

 

== Links ==

cooming soon

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich Dmitriy Evdokimov (DSecRG) Alexey Sintsov (DSecRG)

 

== Contributors ==

==== Implementation guides ====

== Objective ==

This document we will describe different areas of Secure implementation of g Enterprise Business Applications and ERP systems. Here we will mainly focus on security architecture and configuration threads because pragramm errors are well described in "Software vulnerabilities" topic

== Purpose ==

The purpose of this document to Increase awareness for Administrators of Business Application security and help them to start a beginning self-assessment of their systems and find a most critical violations.

== Intro ==

Enterprise Business Applications (Like ERP - is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consists of different components such as database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Every described layer may have their own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are fully secured.

All information was collected and catecorized during our big practice of security assessing Popular business applications Like in SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

 

== Main ==

Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security In this document we will Describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

 

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 2 Lack or vulnerable encryption between corp net and EA Network 3 Lack of separation between Test Dev and Prod system 4 Lack of encryption inside EA Network 5 Insecure trusted realations between components 6 Insecure configured Internet facing applicatins 7 Vulnerable / default configured Routers 8 lack of frontend access filtration 9 Lack or misconfigured monitoring IDS/IPS 10 Insecure/unappropriate wireless comunications 

== Top 10 OS issues ==

1 Unnecessary Enabled services 2 Missing 3rd party software patches 3 Insecure trust relations 4 Universal OS passwords 5 Missing OS patches 6 Lack or misconfigured network acess control 7 Lack or misconfigured monitoring 8 Insecure internal acces control 9 Unencrypted remote access 10 Lack of password lockout/complexiry checks 

== Top 10 Database issues ==

1 Default passwords for DB access 2 Lack of DB patch management 3 unnecessary Enabled DB features 4 lack of password lockout/complexiry checks 5 Unencrypted sensitive data transport / data 6 Lack or misconfigured network acess control 7 Extensive user and group privileges 8 lack or misconfigured audit 9 Insecure trust relations 10 Open additional interfaces 

== Top 10 Application issues ==

1 Lack of patch management 2 Default Passwords for application access 3 SOD conficts 4 Unnecessary Enabled Application features 5 Open Remote mngmt interfaces 6 lack of password lockout/complexity checks 7 Insecure options 8 Unecrypted cominications 9 Insecure trust relations 10 Guest access 

== Top 10 Frontend issues ==

1 Vulnerable Frontend applications 2 Lack of server trust check 3 Lack of encryption 4 Aotocomplete browser 5 Insecure Browser scripting options 6 Insecure configuration 7 Insecure sortware distribution service 8 Lack of AV software 9 Password storing in configuration file 10 Sensitive information storage 

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovskiy

 

== Authors ==

Alexander Polyakov (DSecRG)

 

Mikhail Markevich

 

== Contributors ==

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

 [http://erpscan.com You can help us to test ERPSCAN Online]

== Links ==

[http://erpscan.com]

 

== Authors ==

Alexander Polyakov
Alexey Sintsov
Dmitriy Evdokimov
Dmitriy Chastuhin

 

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

OWASP Enterprise Application Security Project/Roadmp

2012-11-09T09:18:47Z

Alexander:

*'''Primary goals''':
#Aware people about EA security vulnerabilities by releasing annual (later, quarterly) statistics of enterprise application security vulnerabilities,
#Help companies to begin EA assessment by creating a guideline for assessing EA security,
#Create a report of top 10 vulnerabilities or a similar report for EA,
#Publish a free tools for EA assessment,

*'''Project Roadmap''' (as mentioned above):
#Create a dashboard with high level overview,
#Create a dashboard about security assessment,
#Create links to other guidelines,
#Publish statistical reports annually,
#Create OWASP EAS Top 10 vulnerabilities page,
#Finish our first security assessment tool.

User:Alexander

2012-11-09T09:02:20Z

Alexander:

Alexander Polyakov aka @sh2kerr, CTO at ERPSCAN, head of DSecRG and architect of ERPSCAN Security scanner for SAP. His expertise covers security of enterprise business-critical software like ERP, CRM, SRM, RDBMS, banking and processing software. He is the manager of OWASP-EAS (OWASP subproject), a well-known security expert of the enterprise applications of such vendors as SAP and Oracle, who published a significant number of vulnerabilities found in the applications of these vendors. He is the author of multiple whitepapers devoted to information security research, and the author of the book "Oracle Security Through the Eyes of the Auditor: Attack and Defense" (in Russian). He is also one of the contributors to Oracle with Metasploit project. Alexander spoke at the international conferences like BlackHat, RSA, Defcon, HITB, InfoSecurity. Co-organizer of the ZeroNights conference and the PCI DSS Russia conference, held in Moscow, Russia.

OWASP Enterprise Application Security Project

2010-10-12T12:57:35Z

Alexander:

==== Main ====

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (ie 'Enterprise') applications.

== Project purpose ==

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise applicatio security vulnerabilities by making an Annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics 2009]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating a

Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating a

Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop a free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report comming soon...

== Authors ==

Alexander Polyakov (DSecRG) Dmitriy Chastuhin (DSecRG) Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

Leodid Kats (dsec.ru) Olga Yurova (dsec.ru)

==== Development guides ====

== Objective ==

This document we will describe different areas of programm vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document to Increase awareness for Developers of Enterprise business application software. Here we will collect top software vulnerabilities in server site and frontend side that can exist in Business applications.

== Intro ==

There are many different languages and technologies that can be used for developing business applications and writing a costom code. Here we will try to categorize it firstly by dividing into Server and Client site. Top 10 list of vulnerabilities for both areas will be shown.

 

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Dev1.png|484x290px]] 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities (EASAD) ==

 1 XSS 2 Improper Access Control 3 Information disclosure 4 Command/code injection in proprietary language 5 SQL Injection 6 Missing Encryption of Sensitive Data 7 Buffer overflows 8 Path traversal 9 CSRF 10 Use of a Broken or Risky Cryptographic Algorithm 

== Top 10 Frontend vulnerabilities (EASFD) ==

1 Buffer overflows (ActiveX ) 2 Exposed Dangerous Method or Function (ActiveX) 3 Insecure scripting server access 4 File handling Frontend vulnerabilities 5 Use of a Broken or Risky Cryptographic Algorithm 6 Cleartext Storage of Sensitive Information 7 Use of Hard-coded Password 8 Lack of integrity checking for front-end application 9 Cleartext Transmission of Sensitive Information 10 Vulnerable remote services 

 

== Links ==

cooming soon

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich Dmitriy Evdokimov (DSecRG) Alexey Sintsov (DSecRG)

 

== Contributors ==

==== Implementation guides ====

== Objective ==

This document we will describe different areas of Secure implementation of g Enterprise Business Applications and ERP systems. Here we will mainly focus on security architecture and configuration threads because pragramm errors are well described in "Software vulnerabilities" topic

== Purpose ==

The purpose of this document to Increase awareness for Administrators of Business Application security and help them to start a beginning self-assessment of their systems and find a most critical violations.

== Intro ==

Enterprise Business Applications (Like ERP - is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consists of different components such as database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Every described layer may have their own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are fully secured.

All information was collected and catecorized during our big practice of security assessing Popular business applications Like in SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

 

== Main ==

Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security In this document we will Describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

 

[[Image:Dev2.png]]

== Top 10 Network/Architecture issues ==

1 Lack of proper network filtration between EA and Corporate network 2 Lack or vulnerable encryption between corp net and EA Network 3 Lack of separation between Test Dev and Prod system 4 Lack of encryption inside EA Network 5 Insecure trusted realations between components 6 Insecure configured Internet facing applicatins 7 Vulnerable / default configured Routers 8 lack of frontend access filtration 9 Lack or misconfigured monitoring IDS/IPS 10 Insecure/unappropriate wireless comunications 

== Top 10 OS issues ==

1 Unnecessary Enabled services 2 Missing 3rd party software patches 3 Insecure trust relations 4 Universal OS passwords 5 Missing OS patches 6 Lack or misconfigured network acess control 7 Lack or misconfigured monitoring 8 Insecure internal acces control 9 Unencrypted remote access 10 Lack of password lockout/complexiry checks 

== Top 10 Database issues ==

1 Default passwords for DB access 2 Lack of DB patch management 3 unnecessary Enabled DB features 4 lack of password lockout/complexiry checks 5 Unencrypted sensitive data transport / data 6 Lack or misconfigured network acess control 7 Extensive user and group privileges 8 lack or misconfigured audit 9 Insecure trust relations 10 Open additional interfaces 

== Top 10 Application issues ==

1 Lack of patch management 2 Default Passwords for application access 3 SOD conficts 4 Unnecessary Enabled Application features 5 Open Remote mngmt interfaces 6 lack of password lockout/complexity checks 7 Insecure options 8 Unecrypted cominications 9 Insecure trust relations 10 Guest access 

== Top 10 Frontend issues ==

1 Vulnerable Frontend applications 2 Lack of server trust check 3 Lack of encryption 4 Aotocomplete browser 5 Insecure Browser scripting options 6 Insecure configuration 7 Insecure sortware distribution service 8 Lack of AV software 9 Password storing in configuration file 10 Sensitive information storage 

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovskiy

 

== Authors ==

Alexander Polyakov (DSecRG)

 

Mikhail Markevich

 

== Contributors ==

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free and commercial tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

Currently we are on the beta testing stage of free online service that cen be used to assess security of SAP Frontend.

 [http://erpscan.com You can help us to test ERPSCAN Online]

== Links ==

[http://erpscan.com] - by DSECRG

 

== Authors ==

Alexander Polyakov (DSecRG)

Alexey Sintsov (DSecRG)

Dmitriy Evdokimov (DSecRG) Dmitriy Chastuhin (DSecRG)

 

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

OWASP Enterprise Application Security Project

2010-10-12T12:46:31Z

Alexander:

==== Main ====

== Objective ==

The OWASP Enterprise Application Security Project (OWASP-EAS) exists to provide guidance to people involved in the procurement, design, implementation or sign-off of large scale (ie 'Enterprise') applications.

== Project purpose ==

Enterprise applications security is one of the major topics in overall security area because those applications controls money and resources and every security violation can result a significant money loss. Purpose of this project is to aware people about enterprise application security problems and create a guidelines and tools for enterprise application security assessment.

== Our Subprojects ==

Here are our primary goals:

1 Aware people about enterprise applicatio security vulnerabilities by making an Annual statistics of enterprise business application security vulnerabilities.

Subproject [[Enterprise Business Application Vulnerability Statistics 2009]]

[[Projects/OWASP Enterprise Application Security Project|Statistics]]

2 Help companies to begin assessment of enterprise applicatios by creating a

Subproject [[Enterprise Business Application Security Implementation Assessment Guide]]

3 Help software companies to improve security of their solutions by creating a

Subproject [[Enterprise Business Application Security Vulnerability Testing Guide v1]]

4 Develop a free tools for Enterprise business applicatioons assessment

Subproject [[Enterprise Business Application Security Software]]

 

== Project Roadmap ==

Have a look at the [[OWASP Enterprise Application Security Project/Roadmp]]

==== Statistics ====

== Objective ==

This document is the first statistics report which will be repeated annually with showing tendencies and changes in Enterprise Business Application Security area.

== Purpose ==

This document we will show a result of statistical research in the Business Application security area made by DSECRG and OWASP-EAS project. The purpose of this document is to raise awareness about Enterprise Business Application security by showing the current number of vulnerabilities found in those applications, how critical are those and what tendences we see.

== Intro ==

Business applications like ERP, CRM, SRM and others are one of the major topics within the field of computer security as these applications store business data and any vulnerability in these applications will cause a significant monetary loss. Nonetheless people still don’t pay much attention to Enterprise Business Application area as we see during our and our collegues research and audit data. Business applications are very large and complex systems that consists of different components such as Database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security

Every described layer may have their own vulnerabilities that can give attacker full access to business data even if other layers are fully secured. In this document all the popular applications from described levels and their vulnerabilities vill be shown. The purpose of this document to Increase awareness of Business Application security.

== Links ==

[http://dsecrg.com Business applications vulnerability statistics 2009 and future trends] - Presentation by Dmitry Evdokimov and Dmityy Chastuhin

[http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a SAP SDN page with latest vulnerabilities]

[http://www.oracle.com/security/critical-patch-update.html Oracle Secalert CPU page with latest vulnerabilities]

Annual report comming soon...

== Authors ==

Alexander Polyakov (DSecRG) Dmitriy Chastuhin (DSecRG) Dmitriy Evdokimov (DSecRG)

 

== Contributors ==

Leodid Kats (dsec.ru) Olga Yurova (dsec.ru)

==== Development guides ====

== Objective ==

This document we will describe different areas of programm vulnerabilities that can be found in Enterprise Business applications and ERP systems.

== Purpose ==

The purpose of this document to Increase awareness for Developers of Enterprise business application software. Here we will collect top software vulnerabilities in server site and frontend side that can exist in Business applications.

== Intro ==

There are many different languages and technologies that can be used for developing business applications and writing a costom code. Here we will try to categorize it firstly by dividing into Server and Client site. Top 10 list of vulnerabilities for both areas will be shown.

 

== Main ==

Crosslinks to CWE SANS OWASP and risks with descriptions will be added soon.

[[Image:Vulns1]][[File:Dev1.png]]
 

 

 

 

 

 

 

 

== Top 10 Server vulnerabilities ==

 1 XSS 2 Improper Access Control 3 Information disclosure 4 Command/code injection in proprietary language 5 SQL Injection 6 Missing Encryption of Sensitive Data 7 Buffer overflows 8 Path traversal 9 CSRF 10 Use of a Broken or Risky Cryptographic Algorithm 

== Top 10 Frontend vulnerabilities ==

1 Buffer overflows (ActiveX ) 2 Exposed Dangerous Method or Function (ActiveX) 3 Insecure scripting server access 4 File handling Frontend vulnerabilities 5 Use of a Broken or Risky Cryptographic Algorithm 6 Cleartext Storage of Sensitive Information 7 Use of Hard-coded Password 8 Lack of integrity checking for front-end application 9 Cleartext Transmission of Sensitive Information 10 Vulnerable remote services 

 

== Links ==

cooming soon

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich Dmitriy Evdokimov (DSecRG) Alexey Sintsov (DSecRG)

 

== Contributors ==

==== Implementation guides ====

== Objective ==

This document we will describe different areas of Secure implementation of g Enterprise Business Applications and ERP systems. Here we will mainly focus on security architecture and configuration threads because pragramm errors are well described in "Software vulnerabilities" topic

== Purpose ==

The purpose of this document to Increase awareness for Administrators of Business Application security and help them to start a beginning self-assessment of their systems and find a most critical violations.

== Intro ==

Enterprise Business Applications (Like ERP - is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consists of different components such as database server, Front-end, Web server, Application server and other parts. Also those systems lay on different Hardware and software that can have their own vulnerabilities. Every described layer may have their own vulnerabilities and misconfigurations that can give attacker full access to business data even if other layers are fully secured.

All information was collected and catecorized during our big practice of security assessing Popular business applications Like in SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

 

== Main ==

Overall security of Enterprise Business Application consists of different layers such as: • Network architecture security • Os security • Database security • Application security • Front-end security In this document we will Describe top 10 violations on every layer of Enterprise Business Application that can be easily assessed and mitigated.

 

[[Image:Vulns1]][[File:Dev2.png]]

== Top 10 Network/Architecture issues ==

== Top 10 OS issues ==

== Top 10 Database issues ==

== Top 10 Application issues ==

== Top 10 Frontend issues ==

== Links ==

[http://dsecrg.com ERP Security:Myths Problems Solutions] - by Alexander Polyakov and Ilya Medvedovskiy

 

== Authors ==

Alexander Polyakov (DSecRG) Mikhail Markevich

 

== Contributors ==

==== Software ====

== Objective ==

Here will be given information on a tools and services that can be used for assessment of business applications

== Purpose ==

The purpose of this area is to provide free and commercial tools that can help companies to assess security of their business applications.

 

== Intro ==

== Main ==

Currently we are on the beta testing stage of free online service that cen be used to assess security of SAP Frontend.

 [http://erpscan.com You can help us to test ERPSCAN Online]

== Links ==

[http://erpscan.com] - by DSECRG

 

== Authors ==

Alexander Polyakov (DSecRG)

Alexey Sintsov (DSecRG)

Dmitriy Evdokimov (DSecRG) Dmitriy Chastuhin (DSecRG)

 

==== Project About ====

{{:Projects/OWASP Enterprise Application Security Project | Project About}}

 

__NOTOC__ <headertabs />

[[Category:OWASP_Project|Enterprise Application Security Project]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]

File:Dev2.png

2010-10-12T12:44:16Z

Alexander:

File:Dev1.png

2010-10-12T12:43:43Z

Alexander: