This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Projects/OWASP Mobile Security Project - Top Ten Mobile Risks"

From OWASP
Jump to: navigation, search
(Call to Action for 2015)
(Redirected page to OWASP Mobile Top 10)
 
(14 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 +
#REDIRECT [[OWASP Mobile Top 10]]
 +
 
<center><br style="clear:both" />
 
<center><br style="clear:both" />
 
{| align="center"  style="width:45%; background-color:#FFFFFF; border:1px solid #a7d7f9; -moz-border-radius: 9px;-webkit-border-radius: 9px; border-radius: 9px; padding:1px;" id="social_bookmarks" class="noprint"
 
{| align="center"  style="width:45%; background-color:#FFFFFF; border:1px solid #a7d7f9; -moz-border-radius: 9px;-webkit-border-radius: 9px; border-radius: 9px; padding:1px;" id="social_bookmarks" class="noprint"
Line 17: Line 19:
 
|}
 
|}
 
</center>
 
</center>
== About this list  ==
 
In 2013, we polled the industry for new vulnerability statistics in the field of mobile applications. What you see here is a result of that data and a representation of the mobile application threat landscape.
 
  
 +
= Updated project page =
 +
The new project page can be found at https://www.owasp.org/index.php/OWASP_Mobile_Top_10#tab=Main
  
Our goals for the 2014 list included the following:
+
= The Mobile Top Ten 2016 =
[[File:2014-01-26 20-23-29.png|right|550px]]
 
* Updates to the wiki content; including cross-linking to testing guides, more visual exercises, etc;
 
* Generation of more data; and
 
* A PDF release.
 
  
This list has been finalized after a 90-day feedback period from the community. Based on feedback, we intend on releasing a Mobile Top Ten 2015 list following a similar approach of collecting data, grouping the data in logical and consistent ways.
+
Following a 90-day review and publication of the release candidate, we determined that the release candidate was ready for final publication. The 2016 list has now been published and can be found here: [https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10 OWASP Mobile Top Ten 2016]
  
Feel free to visit [https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks the mailing list] as well!  
+
Feel free to visit [https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks the mailing list] as well!
  
== Call to Action for 2015 ==
+
== 2015 Mobile Top Ten Analysis Results ==
We are currently looking for vendors, consultants, or other industry experts within the appsec community that are willing to participate in the OWASP Mobile Top Ten 2015. Participation could include any of the following: gathering data, promoting awareness, etc.
+
Are you interested in what the data collection for the 2015 list looks like? Check out the final synthesis... [[Media:2015 Data Synthesis Results.pptx]]
  
We have published a [https://docs.google.com/viewer?a=v&pid=forums&srcid=MTM2MzA3NTkyMzA4NjgxNjcwNjQBMTU5NDg1NTE3NTg0NTgyOTMzOTgBUmEtcUZEUFNUVzRKATAuMQFvd2FzcC5vcmcBdjI Call for Data document] and have also (in the name of transparency) [https://docs.google.com/spreadsheets/d/16bW_VhEIlFU4cfN8BOOk40-XN93FM0f0Sxcx67NwPcg/edit?usp=sharing published a document] which lists which entities/vendors/individuals/etc that we have reached out to. These requests were made because we know these entities to be thought leaders in the mobile application space. If we missed you, and you have data or feedback to contribute, we apologize. Please email one of us!
+
We are fleshing out the new Mobile Top Ten at [[Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad]]. Have a look.
 
 
== Top 10 Mobile Risks - Final List 2014 ==
 
*[[Mobile_Top_10_2014-M1|M1: Weak Server Side Controls ]]
 
*[[Mobile_Top_10_2014-M2|M2: Insecure Data Storage ]]
 
*[[Mobile_Top_10_2014-M3|M3: Insufficient Transport Layer Protection ]]
 
*[[Mobile_Top_10_2014-M4|M4: Unintended Data Leakage ]]
 
*[[Mobile_Top_10_2014-M5|M5: Poor Authorization and Authentication ]]
 
*[[Mobile_Top_10_2014-M6|M6: Broken Cryptography ]]
 
*[[Mobile_Top_10_2014-M7|M7: Client Side Injection ]]
 
*[[Mobile_Top_10_2014-M8|M8: Security Decisions Via Untrusted Inputs ]]
 
*[[Mobile_Top_10_2014-M9|M9: Improper Session Handling ]]
 
*[[Mobile_Top_10_2014-M10|M10: Lack of Binary Protections ]]
 
  
 +
Here is the original raw data: [[https://www.dropbox.com/sh/d143o6tbkdx4w4l/AAAQlpmnCpHCgiBqZkgXPSTKa?dl=0 Dropbox Data]]
  
 
== Project Leads, Credit, and Contributions ==
 
== Project Leads, Credit, and Contributions ==
Line 54: Line 41:
  
  
 
+
== How Did the List Get Made? ==
== Project Methodology ==
+
# We wanted to know what the community wanted in the next Mobile Top Ten list and what they thought about the last. We published a [http://bit.ly/1sihkkE survey] and shared the [https://docs.google.com/a/owasp.org/forms/d/1WMEbjVgXU4VkjHP5AcW934D9EI0_XQ5vmjb-Y5liMQY/viewanalytics results] with everyone.
 
+
# We issued a [https://www.owasp.org/index.php/File:MobileTopTen2015-CallForData.pdf Call for Data] and aggressively pursued many different vendors and consultants for raw data.
* '''We adhered loosely to the [https://www.owasp.org/index.php/Top_10_2013/ProjectMethodology OWASP Web Top Ten Project methodology]. '''
+
# We had a huge response by vendors and consultants. We collected lots of data about the last years vulnerabilities from a number of different vendors and consultant. That raw data can be found [https://www.dropbox.com/sh/d143o6tbkdx4w4l/AAAQlpmnCpHCgiBqZkgXPSTKa?dl=0 here].
 
+
# Over the coming months, we then analyzed the data. Lots of different contributors did their own analysis and compared results. [https://www.owasp.org/index.php/Mobile2015Commentary Here] is a sample of the color commentary on the data.
 +
# Ultimately, we agreed on the findings and published [https://www.owasp.org/images/9/96/OWASP_Mobile_Top_Ten_2015_-_Final_Synthesis.pdf key findings] from the data that we all agreed upon.
 +
# Next, we started coming up with a [https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad consensus] of what we wanted in the next revision of the Mobile Top Ten.
 +
# Results were collected and a release candidate got released.
 +
# We examined the results from the release candidate and concluded that we achieved what we set out to do for 2016
 +
# We published the list officially and moved it from release to final stage
  
  

Latest revision as of 21:01, 22 July 2019


Updated project page

The new project page can be found at https://www.owasp.org/index.php/OWASP_Mobile_Top_10#tab=Main

The Mobile Top Ten 2016

Following a 90-day review and publication of the release candidate, we determined that the release candidate was ready for final publication. The 2016 list has now been published and can be found here: OWASP Mobile Top Ten 2016

Feel free to visit the mailing list as well!

2015 Mobile Top Ten Analysis Results

Are you interested in what the data collection for the 2015 list looks like? Check out the final synthesis... Media:2015 Data Synthesis Results.pptx

We are fleshing out the new Mobile Top Ten at Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad. Have a look.

Here is the original raw data: [Dropbox Data]

Project Leads, Credit, and Contributions


How Did the List Get Made?

  1. We wanted to know what the community wanted in the next Mobile Top Ten list and what they thought about the last. We published a survey and shared the results with everyone.
  2. We issued a Call for Data and aggressively pursued many different vendors and consultants for raw data.
  3. We had a huge response by vendors and consultants. We collected lots of data about the last years vulnerabilities from a number of different vendors and consultant. That raw data can be found here.
  4. Over the coming months, we then analyzed the data. Lots of different contributors did their own analysis and compared results. Here is a sample of the color commentary on the data.
  5. Ultimately, we agreed on the findings and published key findings from the data that we all agreed upon.
  6. Next, we started coming up with a consensus of what we wanted in the next revision of the Mobile Top Ten.
  7. Results were collected and a release candidate got released.
  8. We examined the results from the release candidate and concluded that we achieved what we set out to do for 2016
  9. We published the list officially and moved it from release to final stage


Archive

  • The list below is the OLD release candidate v1.0 of the OWASP Top 10 Mobile Risks.  This list was initially released on September 23, 2011 at Appsec USA.