View source for Germany/Projekte/Top 10-2017 Details zu den Risiko-Faktoren

{{Top_10_2013:TopTemplate
    |useprev=2017PrevLink
    |prev={{Top_10:LanguageFile|text=noteAboutRisks|language=de}}
    |usenext=2017NextLink
    |next={{Top_10:LanguageFile|text=methodologyAndData|language=de}}
    |year=2017
    |language=de
}}
<!--- +RF Details About Risk Factors / +RF Details zu den Risiko-Faktoren --->
{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title=Zusammenfassung der Top 10 Risiko-Faktoren|year=2017|language=de}}
Die folgende Tabelle stellt eine Zusammenfassung der Top 10 Risiken für die Anwendungssicherheit in der Version des Jahres 2017 und der dazugehörigen Risiko-Faktoren dar. Diese Faktoren wurden durch verfügbare Statistiken und die Erfahrung des OWASP-Teams bestimmt. Um diese Risiken für eine bestimmte Anwendung oder Organisation zu verstehen, <u>muss der Leser seine eigenen, spezifischen Bedrohungsquellen und Auswirkungen auf sein Unternehmen betrachten</u>. Selbst eklatante Software-Schwachstellen müssen nicht zwangsläufig ein ernsthaftes Risiko darstellen, wenn es z.B. keine Bedrohungsquellen gibt, die den notwendigen Angriff ausführen können oder die tatsächlichen Auswirkungen auf das Unternehmen und die Geschäftsprozesse zu vernachlässigen sind.
<center>
<table style="align:center; border-collapse: collapse; text-align:center; margin: 0px 5px 0px 5px; border: 3px solid #444444; background-color: {{Top 10:BackgroundColor|year=2017 }}; padding=2;">

<tr style="background-color: {{Top 10:BorderColor|year=2017}}; height: 2em; font-size: 130%; color: #FFFFFF;  text-shadow: 2px 2px 8px #444444; ">
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=risk|language=de}}</th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=threatAgents|language=de}}</th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=attackVectors|language=de}}<div style="font-size: 80%;">({{Top_10:LanguageFile|text=exploitability|language=de}})</div></th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=securityWeakness|language=de}}<div style="font-size: 80%;">({{Top_10:LanguageFile|text=prevalence|language=de}})</div></th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=securityWeakness|language=de}}<div style="font-size: 80%;">({{Top_10:LanguageFile|text=detectability|language=de}})</div></th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=impacts|language=de}}<div style="font-size: 80%;">({{Top_10:LanguageFile|text=technical|language=de}})</div></th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=impacts|language=de}}<div style="font-size: 80%;">({{Top_10:LanguageFile|text=business|language=de}})</div></th>
     <th style="border: 3px solid #444444;">{{Top_10:LanguageFile|text=score|language=de}}</th>
</tr>
<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A1-{{Top_10_2010:ByTheNumbers|1|year=2017|language=de}} | A1:2017-{{Top_10_2010:ByTheNumbers|1|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=3|prevalence=2|detectability=3|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>8.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A2-{{Top_10_2010:ByTheNumbers|2|year=2017|language=de}} | A2:2017-{{Top_10_2010:ByTheNumbers|2|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=3|prevalence=2|detectability=2|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>7.0</b></td></tr>


<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A3-{{Top_10_2010:ByTheNumbers|3|year=2017|language=de}} | A3:2017-{{Top_10_2010:ByTheNumbers|3|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=2|prevalence=3|detectability=2|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>7.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A4-{{Top_10_2010:ByTheNumbers|4|year=2017|language=de}} | A4:2017-{{Top_10_2010:ByTheNumbers|4|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=2|prevalence=2|detectability=3|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>7.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A5-{{Top_10_2010:ByTheNumbers|5|year=2017|language=de}} | A5:2017-{{Top_10_2010:ByTheNumbers|5|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=2|prevalence=2|detectability=2|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>6.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A6-{{Top_10_2010:ByTheNumbers|6|year=2017|language=de}} | A6:2017-{{Top_10_2010:ByTheNumbers|6|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=3|prevalence=3|detectability=3|impact=2|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>6.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A7-{{Top_10_2010:ByTheNumbers|7|year=2017|language=de}} | A7:2017-{{Top_10_2010:ByTheNumbers|7|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=3|prevalence=3|detectability=3|impact=2|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>6.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A8-{{Top_10_2010:ByTheNumbers|8|year=2017|language=de}} | A8:2017-{{Top_10_2010:ByTheNumbers|8|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=1|prevalence=2|detectability=2|impact=3|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>5.0</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A9-{{Top_10_2010:ByTheNumbers|9|year=2017|language=de}} | A9:2017-{{Top_10_2010:ByTheNumbers|9|year=2017|language=de|type=short}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=2|prevalence=3|detectability=2|impact=2|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>4.7</b></td></tr>

<tr><td style="border: 3px solid #444444;"><b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|language=de|year=2017 }}_A10-{{Top_10_2010:ByTheNumbers|10|year=2017|language=de}} | A10:2017-{{Top_10_2010:ByTheNumbers|10|year=2017|language=de}}]]</u></b></td>
<td style="border: 3px solid #444444;"><b>{{Top_10:LanguageFile|text=appSpecific|language=de}}</b></td>
  {{Top_10-2017:SummaryTableTemplate|type=valueOnly|exploitability=2|prevalence=3|detectability=1|impact=2|language=de|year=2017}}
<td style="border: 3px solid #444444"><b>{{Top_10:LanguageFile|text=dataBusinessSpecific|language=de}}</b></td>
<td style="border: 3px solid #444444"><b>4.0</b></td></tr>
</table></center> <!-- End risk table -->

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=whole|title=Weitere Risiken, die man prüfen sollte|year=2017|language=de}}
Auch wenn die Top 10 bereits sehr viele Problemfelder abdecken, so gibt es dennoch weitere Risiken, die man in Betracht ziehen und im jeweiligen Unternehmen oder der Organisation evaluieren sollte. Einige waren schon in früheren Versionen der OWASP Top 10 enthalten, andere nicht - wie z.B. neue Angriffstechniken. Diese werden permanent gesucht, gefunden und weiter entwickelt. Andere wichtige Sicherheitsrisiken für Anwendungen, die man sich ebenfalls näher ansehen sollte, sind (sortiert nach CVE-ID):

* <u>[https://cwe.mitre.org/data/definitions/352.html CWE-352: Cross-Site Request Forgery (CSRF)]</u>
* <u>[https://cwe.mitre.org/data/definitions/400.html CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion', 'AppDoS')]</u>
* <u>[https://cwe.mitre.org/data/definitions/434.html CWE-434: Unrestricted Upload of File with Dangerous Type]</u>
* <u>[https://cwe.mitre.org/data/definitions/451.html CWE-451: User Interface (UI) Misrepresentation of Critical Information (Clickjacking and others)]</u>
* <u>[https://cwe.mitre.org/data/definitions/601.html CWE-601: Unvalidated Forward and Redirects]</u>
* <u>[https://cwe.mitre.org/data/definitions/799.html CWE-799: Improper Control of Interaction Frequency (Anti-Automation)]</u>
* <u>[https://cwe.mitre.org/data/definitions/829.html CWE-829: Inclusion of Functionality from Untrusted Control Sphere (3rd Party Content)]</u>
* <u>[https://cwe.mitre.org/data/definitions/918.html CWE-918: Server-Side Request Forgery (SSRF)]</u>

{{Top_10_2013:BottomAdvancedTemplate
    |type=box
    |useprev=2017PrevLink
    |prev={{Top_10:LanguageFile|text=noteAboutRisks|language=de}}
    |usenext=2017NextLink
    |next={{Top_10:LanguageFile|text=methodologyAndData|language=de}}
    |year=2017
    |language=de
}}

<!-- [[Category:OWASP Top Ten Project]] -->