BOOT CAMP - 09/07/2025
WHAT IS CYBER SECURITY - IT IS THE PRACTICE OF PROTECTING NETWORK
CONNECTED SYSTEMS INCLUDING SOFTWARE , HARDWARE AND DATA FROM
VARIOUS CYB ATTACKS
CYB INVOLVES CREATION OF POLICIES , METHODLOGIES , TECHNIQUES
THAT ARE SAFE GUARD TO DIGITAL ASSETS FROM UNAUTHORISED ACCESS
OWASP TOP 10 - OPEN WEB APPLICATION SECURITY PROJECT
OWASP TOP 1 - BAC
IT IS THE PROCESS OF GAINING UNAUTHORISED ACCESS TO THE DEVICE OR
NETWORK WHAT IS NOT MEANT FOR THEM
EX - IDOR
OWASP TOP 2 - CRYPTOGRAPHIC FAILURES
IT OCCUR WHEN SENSITIVE DATA IS NOT PROPERLY PROTECTED THROUGH
ENCRYPTION DURING STORAGE (AT REST) OR TRANSMISSION (IN TRANSIT),
LEADING TO UNAUTHORIZED ACCESS OR EXPOSURE.
EX - A WEB APPLICATION STORES USER PASSWORDS IN PLAIN TEXT INSIDE
THE DATABASE
OWASP TOP 3 - SQL INJECTION
IT IS A WEB APPLICATION VULNERABILITY WHERE AN ATTACKER TRIES TO
INJECT MALICIOUS QUERY’S IN INPUT FILEDS OR URL PARAMETERS TO
MANIPULATE THE BACK END DATABASE
EX - CHECKING FOR 1 ‘ OR ‘1 = ‘1’ IN INPUT FIELDS
OWASP TOP 4 - INSECURE DESIGN
THE APPLICATION WAS NOT PLANNED WITH SECURITY IN MIND, WHICH
MAKES IT EASY FOR HACKERS TO ABUSE OR BREAK IT.
EX - CSRF ( CROSS SITE REQUEST FORGERY )
OWASP TOP 5 - SECURITY MISCONFIGURATIONS
SECURITY MISCONFIGURATION MEANS THE SYSTEM, SERVER, OR
APPLICATION IS NOT PROPERLY SET UP, MAKING IT EASY FOR ATTACKERS TO
EXPLOIT VULNERABILITIES.
EX - ERROR MESSAGES LEAKING SENSTIVE DATA
OWASP TOP 6 - VULNERABLE AND OUTDATED COMPONENTS
THIS RISK OCCURS WHEN APPLICATIONS USE LIBRARIES, FRAMEWORKS, OR
OTHER COMPONENTS THAT ARE KNOWN TO HAVE SECURITY
VULNERABILITIES, OR ARE OUTDATED AND NO LONGER SUPPORTED
EX - WEAK API’S AND PLUGINS
OWASP TOP 7 - IDENTITY AND AUTHENTIACTION FAILURES
THIS RISK OCCURS WHEN AUTHENTICATION AND SESSION MANAGEMENT
ARE IMPLEMENTED INCORRECTLY, ALLOWING ATTACKERS TO COMPROMISE
PASSWORDS, KEYS, OR SESSION TOKENS, OR TO ASSUME OTHER USERS’
IDENTITIES TEMPORARILY OR PERMANENTLY.
EX - WEAK PASSWORD POLICIES
OWASP TOP 8 - SOFTWARE AND DATA INTEGRITY FAILURES
WHEN APPLICATIONS TRUST UNVERIFIED UPDATES, PLUGINS, OR FILES,
HACKERS CAN INJECT MALICIOUS CODE OR DATA INTO THE SYSTEM
EX - A USER USING 3RD PARTY APP WITH OUT VERIFYING IT’S HASH
OWASP TOP 9 - SECURITY LOGGING AND MONITORING FAILURES
WHEN APPLICATIONS DO NOT RECORD IMPORTANT SECURITY EVENTS OR
DO NOT MONITOR THEM PROPERLY, MAKING IT HARD TO DETECT AND
RESPOND TO ATTACKS
EX - A ORG DOES NOT HAS A SOC ANALYST TO MONITOR THEIR ASSETS
OWASP TOP 10 - SERVER-SIDE REQUEST FORGERY
WHEN AN APPLICATION FETCHES A REMOTE RESOURCE BASED ON USER
INPUT WITHOUT PROPER VALIDATION, ALLOWING ATTACKERS TO MAKE THE
SERVER SEND UNAUTHORIZED REQUESTS.
EX - THE SERVER REQUESTS http://localhost:8080/admin — AN INTERNAL
RESOURCE THAT SHOULD NOT BE ACCESSIBLE TO USERS.