Top 10 2010-Notes About Risk - Revision history

Neil Smithline at 02:56, 29 April 2010

2010-04-29T02:56:11Z

Wichers at 03:11, 26 April 2010

2010-04-26T03:11:01Z

Wichers at 03:10, 26 April 2010

2010-04-26T03:10:19Z

Neil Smithline at 04:25, 24 April 2010

2010-04-24T04:25:26Z

Neil Smithline at 04:08, 24 April 2010

2010-04-24T04:08:11Z

Neil Smithline at 04:06, 24 April 2010

2010-04-24T04:06:52Z

Neil Smithline at 03:59, 24 April 2010

2010-04-24T03:59:34Z

Neil Smithline at 02:29, 24 April 2010

2010-04-24T02:29:04Z

Wichers at 17:40, 22 April 2010

2010-04-22T17:40:42Z

Wichers at 17:10, 22 April 2010

2010-04-22T17:10:04Z

@@ Line 54: / Line 54: @@
+|
+|
-| colspan=3 | '''Risk Ranking:''' <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
+| colspan=3 | '''Risk Ranking''' = <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
 |}
 </center>

@@ Line 38: / Line 38: @@
 |-style="text-align: center; border: 2px solid #FFFFFF;"
+|
-| colspan=3 |  '''Step 1:''' Average Exploitability, Prevalence and Detectability ((2 + 0 + 1) / 3)
+| colspan=3 |  '''Step 1:''' Average Exploitability, Prevalence and Detectability - ((2 + 0 + 1) / 3)
+|
 |-style="text-align: center; border: 2px solid #FFFFFF;"
@@ Line 50: / Line 50: @@
+|
+|
-| colspan=3 |  '''Step 2:''' Multiply Average by Impact (1 * 2)
+| colspan=3 |  '''Step 2:''' Multiply Average by Impact - (1 * 2)
 |-style="text-align: center; border: 2px solid #FFFFFF; "
+|

@@ Line 38: / Line 38: @@
 |-style="text-align: center; border: 2px solid #FFFFFF;"
+|
-| colspan=3 |  '''Step 1:''' Average Exploitability, Prevalence and Detectability
+| colspan=3 |  '''Step 1:''' Average Exploitability, Prevalence and Detectability ((2 + 0 + 1) / 3)
+|
 |-style="text-align: center; border: 2px solid #FFFFFF;"
@@ Line 50: / Line 50: @@
+|
+|
-| colspan=3 |  '''Step 2:''' Multiply Average by Impact
+| colspan=3 |  '''Step 2:''' Multiply Average by Impact (1 * 2)
 |-style="text-align: center; border: 2px solid #FFFFFF; "
+|

@@ Line 38: / Line 38: @@
 |-style="text-align: center; border: 2px solid #FFFFFF;"
+|
-| colspan=3 |  '''Step 1:''' Calculate Average of Exploitability, Prevalence and Detectability
+| colspan=3 |  '''Step 1:''' Average Exploitability, Prevalence and Detectability
+|
 |-style="text-align: center; border: 2px solid #FFFFFF;"
+|
+|
-| Average = <span style="font-weight: bold; font-size: 150%; color: red;">1</span>
+| '''Likelihood Rating''' = <span style="font-weight: bold; font-size: 150%; color: red;">1</span>
+|
+|
@@ Line 54: / Line 54: @@
+|
+|
-| colspan=3 | '''Risk Value:''' <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
+| colspan=3 | '''Risk Ranking:''' <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
 |}
 </center>

@@ Line 54: / Line 54: @@
+|
+|
-| colspan=3 | Risk Value: <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
+| colspan=3 | '''Risk Value:''' <span style="font-weight: bold; font-size: 150%; color: red;">2</span>
 |}
 </center>

@@ Line 36: / Line 36: @@
 | 2
+|
-|-style="text-align: center; border: 2px solid #FFFFFF; font-weight: bold; font-size: 100%;"
+|-style="text-align: center; border: 2px solid #FFFFFF;"
+|
-| colspan=3 |  --- Calculate Average of Exploitability, Prevalence and Detectability ---
+| colspan=3 |  '''Step 1:''' Calculate Average of Exploitability, Prevalence and Detectability
+|
-|-style="text-align: center; border: 2px solid #FFFFFF; font-weight: bold; font-size: 150%;"
+|-style="text-align: center; border: 2px solid #FFFFFF;"
+|
+|
-| Average: 1
+| Average = <span style="font-weight: bold; font-size: 150%; color: red;">1</span>
+|
+|
 |-
-|-style="text-align: center; border: 2px solid #FFFFFF; font-weight: bold; font-size: 100%;"
+|-style="text-align: center; border: 2px solid #FFFFFF;"
+|
+|
-| colspan=3 |  ------------ Multiply Average by Impact ------------
+| colspan=3 |  '''Step 2:''' Multiply Average by Impact
-|-style="text-align: center; border: 2px solid #FFFFFF; font-weight: bold; font-size: 150%;"
+|-style="text-align: center; border: 2px solid #FFFFFF; "
-−
+|
-| colspan=2 | Final Calculated Risk Value: <span style="color: red;">2</span
 |}
 </center>

@@ Line 29: / Line 29: @@
 | style="background-color: #D9D9D9; color: #000000;" | ______
 |-
-| style="text-align: left; border: 2px solid #FFFFFF;" |
+|-style="text-align: center; border: 2px solid #FFFFFF; font-weight: bold; font-size: 150%;"
-| style="text-align: left; border: 2px solid #FFFFFF;" | 2
-| colspan="2" style="text-align: left;border: 2px solid #FFFFFF;" | TODO
-| style="text-align: left; border: 2px solid #FFFFFF;" | 2
+| VVVVVVVVVV
-| style="text-align: left; border: 2px solid #FFFFFF;" |
 |}
 </center>

← Older revision		Revision as of 17:40, 22 April 2010
Line 38:		Line 38:
	</center>		</center>
	{{Top_10_2010:BottomTemplate\|useprev=2010PrevLink\|usenext=2010NextLink\|prev=What's Next For Organizations\|next=Details About Risk Factors}}		{{Top_10_2010:BottomTemplate\|useprev=2010PrevLink\|usenext=2010NextLink\|prev=What's Next For Organizations\|next=Details About Risk Factors}}
		+
		+	[[Category:OWASP Top Ten Project]]

@@ Line 11: / Line 11: @@
 Note that this approach does not take the likelihood of the threat agent into account. Nor does it account for any of the various technical details associated with your particular application. Any of these factors could significantly affect the overall likelihood of an attacker finding and exploiting a particular vulnerability. This rating also does not take into account the actual impact on your business. <u>Your organization</u> will have to decide how much security risk from applications <u>the organization</u> is willing to accept. The purpose of the OWASP Top 10 is not to do this risk analysis for you.
-The following illustrates our calculation of the risk for A2: Cross-Site Scripting, as an example. Note that XSS is so prevalent that it warranted the only ‘VERY WIDESPREAD’ prevalence value. All other risks ranged from widespread to uncommon (values 1 to 3).
+The following illustrates our calculation of the risk for [[Top_10_2010-A2 | A2: Cross-Site Scripting]], as an example. Note that XSS is so prevalent that it warranted the only ‘VERY WIDESPREAD’ prevalence value. All other risks ranged from widespread to uncommon (values 1 to 3).
 }}
@@ Line 19: / Line 19: @@
 ! Threat Agents !! Attack Vectors
 ! colspan="2" | Security Weakness
-! Technical Impact
+! Technical Impacts
 ! Business Impacts
 |-
 | style="background-color: #D9D9D9; color: #000000;" | ______
-| style="background-color: #FFB200; color: #000000;" | Exploitability<br>AVERAGE
+| style="background-color: #FFB200; color: #000000;" | '''Exploitability<br>AVERAGE
-| style="background-color: #FF00FF; color: #000000;" | Prevalence<br>VERY WIDESPREAD
+| style="background-color: #FF00FF; color: #000000;" | '''Prevalence<br>VERY WIDESPREAD
-| style="background-color: #FF0000; color: #000000;" | Detectability<br>EASY
+| style="background-color: #FF0000; color: #000000;" | '''Detectability<br>EASY
-| style="background-color: #FFB200; color: #000000;" | Impact<br>MODERATE
+| style="background-color: #FFB200; color: #000000;" | '''Impact<br>MODERATE
 | style="background-color: #D9D9D9; color: #000000;" | ______
 |-
-| style="text-align: left; border: 2px solid #FFFFFF;" | TODO
+| style="text-align: left; border: 2px solid #FFFFFF;" |
-| style="text-align: left; border: 2px solid #FFFFFF;" | TODO
+| style="text-align: left; border: 2px solid #FFFFFF;" | 2
 | colspan="2" style="text-align: left;border: 2px solid #FFFFFF;" | TODO
-| style="text-align: left; border: 2px solid #FFFFFF;" | TODO
+| style="text-align: left; border: 2px solid #FFFFFF;" | 2
-| style="text-align: left; border: 2px solid #FFFFFF;" | TODO
+| style="text-align: left; border: 2px solid #FFFFFF;" |
 |}
 </center>
 {{Top_10_2010:BottomTemplate|useprev=2010PrevLink|usenext=2010NextLink|prev=What's Next For Organizations|next=Details About Risk Factors}}