This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Consumer Best Practices"

From OWASP
Jump to: navigation, search
m (Updated email address)
 
(28 intermediate revisions by 3 users not shown)
Line 1: Line 1:
= Potential OWASP Consumer Top Ten =
 
  
Safe practices for consumers on the web
+
'''OWASP Consumer Top Ten Safe Web Habits'''
  
== Weak Password Handling ==
+
''Safe practices for consumers on the web''  
'''Description:'''
 
Passwords are the most common way to authenticate to systems, applications, services, etc. Authentication is how a person or system proves their identity. Three methods of authentications are: provide something you know, something you have, or something you are. Passwords fulfill the first condition, something you know. People and systems authenticate by providing something only they should know, therefore proving their identity. Weak password handling vulnerabilities are weaknesses in the handling, storage, and use of passwords. 
 
  
'''Threats:'''
+
How can you stay safe on the Internet? Surprisingly much the same you do in the real world. In this list, targeted for technical and less-technically minded users (Hi dad!), general habits are covered, as well as some specific steps you can take to increase your security and privacy and decrease your risk online.  
The exposure of passwords through mishandling or improper storage could allow discovery and use by a third party.  
 
  
'''Impact:'''
+
= Introduction =
Weak password handling can result in the unauthorized access and compromise of data or systems.
 
  
'''Recommendations:'''
+
Today, more and more of our personal lives are spent connected to the Internet. We spend a significant amount of time checking email, looking at social media, logging into our financial accounts, shopping, and more. These activities expose our private lives to the internet where potential predators are stalking. Our personal computers are often connected to the internet 24/7 via high-speed data lines, wireless connections extend the boundaries of our houses, and now our home appliances are even exposed to the Internet through web interfaces.
* Use Multi-factor Authentication, especially on important accounts
 
* Use a Password Manager
 
* Use Strong Passwords
 
* Avoid using the same password across different accounts
 
* Do not answer security questions with easily identifiable or enumerable answers
 
* Do not allow browsers to store passwords
 
* Do not share your passwords
 
* Change default passwords
 
  
==Information Disclosure/Sensitive Data Exposure==
+
We use these systems because it makes life easier. Where we once had to go to a bank to make financial transactions, they can all be done from the comfort of our home. We used to program our VCRs manually to record our favorite shows. Now we can simply open an application remotely and configure our TV or DVR to automatically record programs whenever we want. The internet has provided so many more conveniences to our lives but they don’t come without risks.
'''Description:'''
 
Information disclosure vulnerabilities are when...
 
  
'''Threats:'''
+
These new technologies can also make life easier for the bad guys. Instead of breaking into your house, reading through your trash, or spying on you through an open window, tech-savvy bad guys can effectively invade your privacy, steal from you, and generally make your life miserable from anywhere in the world. We often think that the danger is somehow different because it is computer based and not face-to-face; however, this is simply not true. How do we protect ourselves from tech-savvy intruders? How do we protect our privacy and the privacy of our loved ones?
Information and data can be exposed when...
 
  
Include: Social media, exif data in documents or pictures, geo locations, etc.
+
Guiding principles used to keep us safe in the physical world can also guide us in the computer world. We may not be aware of how computer attacks occur but we can look at “physical world” habits, which we apply without thinking because they’re habits, and see how they apply to computers.
  
'''Impact:'''
+
This document will cover ten habits we can use on our computers and provide recommendations to safeguard against common attacks. Each habit will provide a recommendation for all users and some recommendations for more experienced users. While the recommendations are specific ways the habits can be exercised, the habit themselves should remain valid, even when the computing landscape changes.
The disclosure of personal information can...
 
  
'''Recommendations:'''
+
=The Habits=
* Be aware of the information being posted in public forums
+
[[H1. Protect your secrets]]
* Understand "metadata" in electronic documents, images and files
+
[[H2. Guard your privacy]]
* Understand the implications of broadcasting your location, even if accidently
+
[[H3. Use security software and services]]
 +
[[H4. Secure your environment]]
 +
[[H5. Perform routine maintenance]]
 +
[[H6. Think twice before trusting]]
 +
[[H7. Plan for the worst]]
 +
[[H8. Clean up your devices and accounts]]
 +
[[H9. Avoid unnecessary risks]]
 +
[[H10. Be vigilant and on alert]]
  
==Trusting Untrusted Sources==
+
= Documents (Presentations, PDFs, etc.) =
'''Description'''
+
[[:File:OWASP_Consumer_Top_Ten_Safe_Web_Habits.pdf |PDF File of the Online Content]]
  
'''Threats'''
+
[[:File:OWASP_Consumer_Top_10_Safe_Habits.pptx |Presentation Slide Deck]]
  
'''Impact'''
+
[[:File:OWASP Consumer Top 10 Safe Habits PDF.pdf |PDF File of the Presentation Slide Deck]]
  
'''Recommendations'''
+
=Authors and primary editors=
  
Notes:
+
Todd Benson - [email protected]
* Untrusted Sources
 
* Untrusted WiFi, computers, or email
 
* Downloading files from untrusted sources
 
* Clicking on links from unknown or unverified sources
 
* Review credit reports
 
* Review unknown uses of online accounts
 
* Subscribe to a credit monitoring service
 
* Freeze credit
 
  
==Lack of Proper Encryption in Transit==
+
Martin Stemplinger - [email protected]
'''Description'''
 
  
'''Threats'''
+
Andrew van der Stock - [email protected]
  
'''Impact'''
+
Pax Whitmore - [email protected]
  
'''Recommendations'''
+
David Holmes - [email protected]
  
Notes:
+
Anthony.Lee - Anthony.[email protected]
* Do not ignore SSL warnings
 
* Use Encryption
 
 
 
==Lack of Proper Encryption at Rest==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Encrypt PII
 
* Don't store sensitive information unencrypted
 
* Includes physical info - do not write down passwords, shred sensitive documents, protect your SSN, etc.
 
 
 
==Using Components with Known Vulnerabilities==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Patch
 
 
 
==Lack of Secure Configuration==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Configure application settings for security
 
* Do not configure devices to automatically connect to wifi access points
 
 
 
==Running Unnecessary Software or Services==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Do not install unneeded software
 
* Remove software not in use
 
* Do not enable services you don't use
 
 
 
==Poor Physical Security==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Encrypt devices and drives
 
* Do not leave mobile devices unattended
 
* Use an inactivity lockout
 
* Password protect all devices
 
 
 
==Lack of Proper Defense==
 
'''Description'''
 
 
 
'''Threats'''
 
 
 
'''Impact'''
 
 
 
'''Recommendations'''
 
 
 
Notes:
 
* Use Personal Firewalls
 
* Properly Secure Wireless Access Points
 
* Use Intrusion Detection Services
 
* Use anti-virus
 
* Backup important data
 
* Learn to recognize threats?
 

Latest revision as of 18:17, 23 May 2019

OWASP Consumer Top Ten Safe Web Habits

Safe practices for consumers on the web

How can you stay safe on the Internet? Surprisingly much the same you do in the real world. In this list, targeted for technical and less-technically minded users (Hi dad!), general habits are covered, as well as some specific steps you can take to increase your security and privacy and decrease your risk online.

Introduction

Today, more and more of our personal lives are spent connected to the Internet. We spend a significant amount of time checking email, looking at social media, logging into our financial accounts, shopping, and more. These activities expose our private lives to the internet where potential predators are stalking. Our personal computers are often connected to the internet 24/7 via high-speed data lines, wireless connections extend the boundaries of our houses, and now our home appliances are even exposed to the Internet through web interfaces.

We use these systems because it makes life easier. Where we once had to go to a bank to make financial transactions, they can all be done from the comfort of our home. We used to program our VCRs manually to record our favorite shows. Now we can simply open an application remotely and configure our TV or DVR to automatically record programs whenever we want. The internet has provided so many more conveniences to our lives but they don’t come without risks.

These new technologies can also make life easier for the bad guys. Instead of breaking into your house, reading through your trash, or spying on you through an open window, tech-savvy bad guys can effectively invade your privacy, steal from you, and generally make your life miserable from anywhere in the world. We often think that the danger is somehow different because it is computer based and not face-to-face; however, this is simply not true. How do we protect ourselves from tech-savvy intruders? How do we protect our privacy and the privacy of our loved ones?

Guiding principles used to keep us safe in the physical world can also guide us in the computer world. We may not be aware of how computer attacks occur but we can look at “physical world” habits, which we apply without thinking because they’re habits, and see how they apply to computers.

This document will cover ten habits we can use on our computers and provide recommendations to safeguard against common attacks. Each habit will provide a recommendation for all users and some recommendations for more experienced users. While the recommendations are specific ways the habits can be exercised, the habit themselves should remain valid, even when the computing landscape changes.

The Habits

H1. Protect your secrets
H2. Guard your privacy
H3. Use security software and services
H4. Secure your environment
H5. Perform routine maintenance
H6. Think twice before trusting
H7. Plan for the worst
H8. Clean up your devices and accounts
H9. Avoid unnecessary risks
H10. Be vigilant and on alert

Documents (Presentations, PDFs, etc.)

PDF File of the Online Content

Presentation Slide Deck

PDF File of the Presentation Slide Deck

Authors and primary editors

Todd Benson - [email protected]

Martin Stemplinger - [email protected]

Andrew van der Stock - [email protected]

Pax Whitmore - [email protected]

David Holmes - [email protected]

Anthony.Lee - [email protected]