Toshiba UK, ICO and OWASP Top 10 A4 error

The UK Information Commissioner's Office (ICO) has ruled that Toshiba UK breached the UK Data Protection Act by publishing the personal details of 20 competition entrants on its website. According to The Register:

• "A security fault with the incremental numbering of the competition entrants registration URL created the potential for access to other customers' personal data for a two-month period," the regulator said.

By changing the values in the URL, it was possible to see the details of other users. It looks like this was an OWASP Top 10 2010-A4-"Insecure Direct Object References" issue.

When designing your own application you need to perform authorization checks to ensure that the user has permission to access the requested resource. The OWASP Top 10 gives more guidance on how to implement this.

It's surprising how few of the ICO undertakings are related to web site issues. You can look at the ICO's "Taking Action" page to get a feel for what type of issues cause problems.

Useful Links on this blog:

• Analysis of ICO "Taking Actions" for 2011 
• ICO Data Protection Principles and Online Application Design

Useful Links:

• OWASP Top 10 2010-A4-Insecure Direct Object References 
• The Register: Tosh UK rewards competition hopefuls by exposing their privates
• ICO Press Release
• Undertaking signed by Toshiba UK (PDF)
• ICO Taking Action Page 

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

XSS , OWASP Top 10, Verizon DBIR 2012

Last week, Verizon released their annual Verizon Data Breach Investigation Report (DBIR) 2012.

This report investigated 855 incidents involving "174 million compromised records".

XSS (Cross Site Scripting) is not mentioned in the document. (The 2011 edition at least mentioned it). This implies that Verizon has not found XSS to be a significant cause of the incidents that it investigated.

The conclusion seems to be that while XSS is regularly found in online applications, it does not seem to be exploited very much, so the risk associated with XSS is (relatively) low.

According to OWASP:

The OWASP Top 10 "presents a more concise risk focused list of the Top 10 Most Critical Web Application Security Risks."

The OWASP Top 10 currently has XSS as the number 2 risk, ahead of such issues related to credentials (passwords etc). The potential problem with this ranking is that organisations will prioritize their application security programs based on the OWASP Top 10. This means they could be placing too much emphasis on topics such as XSS and not enough emphasis on topics such as credential management.

It will be interesting to see the rankings in the next edition of the  OWASP Top 10 201?

Useful Links

• Verizon DBIR 2012 
•  OWASP Top 10 2010

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot