OWASP: Threats Fundamentals

Explore authentication and session management as critical web security features, examine signs of secure implementations such as SSL and second-factor authentication, and recognize risks like unhashed passwords and insecure cookies.

Learn about broken authentication and session management, a high-impact OWASP top ten risk, and how threat analysis, mitigations, and ASVS guide secure authentication and session controls.

Apply the OWASP application security verification standard to probe a web application for potential risks, check all items, stay a jump ahead of attackers, and ensure your website is secure.

Explore concrete effects of the OWASP top ten risks by examining an ASP.Net sample application and analyzing broken authentication and session management issues.

Analyze a simple ASP.NET Web Forms app to understand cookieless session risks, session hijacking via session IDs, and how built-in identity plus OWASP v2 checks mitigate these threats.

Explore common broken authentication and session management issues in web apps, understand their impact, and leverage OWASP resources to improve authentication and session state security.

Explore how security misconfiguration expands the attack surface in software built with libraries and frameworks on operating systems, and learn where to lock down configurations.

Explore how security misconfiguration spans the full stack, why default settings and unpatched software create attack surfaces, and how repeatable hardening, patch management, and cross‑team collaboration mitigate risks.

Explore how security misconfiguration drives risk in the OWASP top ten and learn how to manage it using OWASP projects, and volunteer to help improve the web.

Explore how misconfigurations create security vulnerabilities in web servers and how proper settings minimize risk, with a focus on understanding your server, platform, and development tools.

Apply least privilege and keep libraries up to date to reduce misconfiguration risks. Encrypt sensitive data, limit error information, and use web.config practices and NuGet to secure ASP.NET apps.

Recognize that security misconfiguration varies across platforms and tools, there are no silver bullets, you can't set and forget, and cooperation and steady vigilance are key.

Protect sensitive data in web apps by examining how attackers target information in back-end databases and in transit between client and server, per OWASP top ten A6.

Explore sensitive data exposure risks across data at rest and in motion, emphasizing encryption, secure key management, and TLS/HTTPS protection for end-to-end security.

Treat cryptographic storage and transmission as the last line of defense, as attackers must break through multiple security layers, and implement protections that deter novel attacker methods.

Explore how data at rest needs proper cryptography to protect sensitive data, highlighting common misuse, marketing hype, and key considerations when building apps to safeguard data against attackers.

Explore secure data protection by distinguishing encryption from hashing, using salting to create salted password hashes, understand risks like rainbow tables, and learn key management across symmetric and asymmetric systems.

Evaluate threats before storing sensitive data and apply the correct cryptography with best practices to avoid making an attacker's job easier.

Identify and secure backend APIs and function level access points to prevent unauthorized use, addressing missing function level access control in web methods and urls.

Explore missing function level access control and learn how server-side authorization, a centralized module, and least privilege prevent unauthorized access to functions, APIs, and URLs.