This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Risk Rating Methodology"
| Line 6: | Line 6: | ||
Security Assessment, OWASP defines the risk associated with a | Security Assessment, OWASP defines the risk associated with a | ||
security finding as a product of the impact, ease of exploitation, | security finding as a product of the impact, ease of exploitation, | ||
| − | exposure and nominal value of the asset. | + | exposure and nominal value of the asset.<BR> |
| − | + | <BR> | |
| − | Risk = Impact x Ease of Exploitation x Exposure x Nominal Value | + | '''Risk = Impact x Ease of Exploitation x Exposure x Nominal Value'''<BR> |
| − | + | <BR> | |
In breaking down the security findings in this way, they and their | In breaking down the security findings in this way, they and their | ||
| − | implications may be better evaluated, prioritised and managed. | + | implications may be better evaluated, prioritised and managed.<BR> |
Impact is taken as a measure of the implications on the discrete | Impact is taken as a measure of the implications on the discrete | ||
component should it be compromised. This is taken out of the context | component should it be compromised. This is taken out of the context | ||
of the nature of the application or host (e.g. server, firewall or | of the nature of the application or host (e.g. server, firewall or | ||
| − | workstation), and regardless of the type of data stored on it. | + | workstation), and regardless of the type of data stored on it. <BR> |
The threat component is in part measured through Ease of Exploitation | The threat component is in part measured through Ease of Exploitation | ||
which quantifies the potential of an attacker taking advantage of the | which quantifies the potential of an attacker taking advantage of the | ||
| − | flaw to violate system integrity. | + | flaw to violate system integrity.<BR> |
Exposure quantifies the likelihood that the vulnerability can be | Exposure quantifies the likelihood that the vulnerability can be | ||
| Line 30: | Line 30: | ||
facing host would be highly exposed, and therefore very likely to be | facing host would be highly exposed, and therefore very likely to be | ||
compromised. An internal host with the same vulnerability would | compromised. An internal host with the same vulnerability would | ||
| − | present a much lower threat. | + | present a much lower threat.<BR> |
The final part of the risk equation is the Nominal Value of the | The final part of the risk equation is the Nominal Value of the | ||
| Line 37: | Line 37: | ||
on information given and the context, but clients are encouraged to | on information given and the context, but clients are encouraged to | ||
consider the importance of hosts based on business criteria & asset | consider the importance of hosts based on business criteria & asset | ||
| − | value. | + | value.<BR> |
| − | Risk Categories: | + | '''Risk Categories:'''<BR> |
| + | *Impact (imp) | ||
| + | *critical | ||
| + | *high | ||
| + | *medium | ||
| + | *low | ||
| − | + | '''Ease of Exploitation (EoE)'''<BR> | |
| − | + | *Easy | |
| − | + | *Moderate | |
| − | + | *Difficult | |
| − | |||
| − | + | '''Exposure (Exp)'''<BR> | |
| − | + | *Very high | |
| − | + | *High | |
| − | + | *Medium | |
| + | *Low | ||
| − | + | '''Nominal Value (Val)'''<BR> | |
| − | + | *High | |
| − | High | + | *Medium |
| − | Medium | + | *Low |
| − | Low | ||
| − | + | Putting this into practice looks like<BR> | |
| − | |||
| − | |||
| − | |||
| − | + | Vulnerability found: Session handling inadequate<BR> | |
| + | *Imp: Medium | ||
| + | *EoE: Moderate | ||
| + | *Exp: Very High | ||
| + | *Val: High | ||
| − | + | Resulting in OWASP Risk Rating: ??? (tbd) | |
| − | |||
| − | |||
| − | |||
| − | |||
{| border=1 | {| border=1 | ||
Revision as of 19:00, 15 November 2006
[Up]
OWASP Testing Guide v2 Table of Contents
Risk is typically defined as a product of the effective Threat,
Vulnerability and associated Cost of recovery. For the purposes of a
Security Assessment, OWASP defines the risk associated with a
security finding as a product of the impact, ease of exploitation,
exposure and nominal value of the asset.
Risk = Impact x Ease of Exploitation x Exposure x Nominal Value
In breaking down the security findings in this way, they and their
implications may be better evaluated, prioritised and managed.
Impact is taken as a measure of the implications on the discrete
component should it be compromised. This is taken out of the context
of the nature of the application or host (e.g. server, firewall or
workstation), and regardless of the type of data stored on it.
The threat component is in part measured through Ease of Exploitation
which quantifies the potential of an attacker taking advantage of the
flaw to violate system integrity.
Exposure quantifies the likelihood that the vulnerability can be
compromised through its availability. For example, an easily
exploited vulnerability on an Internet facing host would be highly
exposed, and therefore very likely to be compromised. An internal
host with a vulnerability that was difficult to exploit would present
a much lower threat. For example, a vulnerability on an Internet
facing host would be highly exposed, and therefore very likely to be
compromised. An internal host with the same vulnerability would
present a much lower threat.
The final part of the risk equation is the Nominal Value of the
elements in your environment, based on the importance of the system
and its data. The testing team can estimate the importance of the host based
on information given and the context, but clients are encouraged to
consider the importance of hosts based on business criteria & asset
value.
Risk Categories:
- Impact (imp)
- critical
- high
- medium
- low
Ease of Exploitation (EoE)
- Easy
- Moderate
- Difficult
Exposure (Exp)
- Very high
- High
- Medium
- Low
Nominal Value (Val)
- High
- Medium
- Low
Putting this into practice looks like
Vulnerability found: Session handling inadequate
- Imp: Medium
- EoE: Moderate
- Exp: Very High
- Val: High
Resulting in OWASP Risk Rating: ??? (tbd)
| Category | Ref Number | Name | Finding | Affected Item | Comment/Solution | Risk Value |
| Information Gathering | Application Discovery | |||||
| Spidering and googling | ||||||
| Analisys of error code | ||||||
| SSL/TLS Testing | ||||||
| DB Listener Testing | ||||||
| File extensions handling | ||||||
| Old, backup and unreferenced files | ||||||
| Business logic testing | ||||||
| Authentication Testing | Default or guessable account | |||||
| Brute Force | ||||||
| Bypassing authentication schema | ||||||
| Directory traversal/file include | ||||||
| Vulnerable remember password and pwd reset | ||||||
| Logout and Browser Cache Management Testing | ||||||
| Session Management Testing | Session Management Schema | |||||
| Session Token Manipulation | ||||||
| Exposed Session Variables | ||||||
| Session Riding | ||||||
| HTTP Exploit | ||||||
| Data Validation Testing | Cross site scripting | |||||
| HTTP Methods and XST | ||||||
| SQL Injection | ||||||
| Stored procedure injection | ||||||
| ORM Injection | ||||||
| LDAP Injection | ||||||
| XML Injection | ||||||
| SSI Injection | ||||||
| XPath Injection | ||||||
| IMAP/SMTP Injection | ||||||
| Code Injection | ||||||
| OS Commanding | ||||||
| Buffer overflow | ||||||
| Incubated vulnerability | ||||||
| Denial of Service Testing | Locking Customer Accounts | |||||
| User Specified Object Allocation | ||||||
| User Input as a Loop Counter | ||||||
| Writing User Provided Data to Disk | ||||||
| Failure to Release Resources | ||||||
| Storing too Much Data in Session | ||||||
| Web Services Testing | XML Structural Testing | |||||
| XML content-level Testing | ||||||
| HTTP GET parameters/REST Testing | ||||||
| Naughty SOAP attachments | ||||||
| Replay Testing | ||||||
| AJAX Testing | AJAX Vulnerabilities |
OWASP Testing Guide v2
Here is the OWASP Testing Guide v2 Table of Contents
