These industries may not appear to have All network Applications Applications very much in common, but the threat actors accessible containing internal containing valuable professional, who are likely to attack organizations in this applications. information or intellectual property, segment are more likely to perform focused information about trade secrets, or attacks with more time, skill, and resources. employees that may government secrets technology, Often the sensitive information or systems be leveraged in (e.g. in the United utilities, are not easy to locate and require leveraging social engineering. States this may be insiders and social engineering techniques. Applications anything classified at and Attacks may involve insiders, outsiders, or be containing Secret or above) that defense collusion between the two. Their goals may nonessential, but is critical to the include gaining access to intellectual important survival or success of property for strategic or technological intellectual property the organization. advantage. We also do not want to overlook or trade secrets. Applications attackers looking to abuse application controlling sensitive functionality influence the behaviour of or functionality (e.g. disrupt sensitive systems. transit, manufacturing Most attackers are looking for sensitive data equipment, control that can be used to directly or indirectly systems) or that profit from to include personally identifiable have the possibility information and payment data. Often the of threatening safety data can be used for identity theft, of lif fraudulent payments, or a variety of fraud schemes. Healthcare Most attackers are looking for sensitive data All network Applications with Applications used to that can be used to directly or indirectly accessible small or moderate control medical profit from to include personally identifiable applications amounts of sensitive equipment, devices, information and payment data. Often the medical information or records that may data can be used for identity theft, (Protected Health endanger human fraudulent payments, or a variety of fraud Information), life. Payment and schemes. Personally Point of Sale systems Identifiable (POS) that contain For the US healthcare sector, the Health Information, or large amounts of Insurance Portability and payment data. transaction data that Accountability Act (HIPAA) Privacy, Security, could be used to Breach Notification commit fraud. This Rules and Patient Safety Rule (= includes any administrative interfaces for these applications
professional, technology, utilities, and defense These industries may not appear to have very much in common, but the threat actors who are likely to attack organizations in this segment are more likely to perform focused attacks with more time, skill, and resources. Often the sensitive information or systems are not easy to locate and require leveraging insiders and social engineering techniques. Attacks may involve insiders, outsiders, or be collusion between the two. Their goals may include gaining access to intellectual property for strategic or technological advantage. We also do not want to overlook attackers looking to abuse application functionality influence the behaviour of or disrupt sensitive systems. Most attackers are looking for sensitive data that can be used to directly or indirectly profit from to include personally identifiable information and payment data. Often the data can be used for identity theft, fraudulent payments, or a variety of fraud schemes. All network accessible applications. Applications containing internal information or information about employees that may be leveraged in social engineering. Applications containing nonessential, but important intellectual property or trade secrets. Applications containing valuable intellectual property, trade secrets, or government secrets (e.g. in the United States this may be anything classified at Secret or above) that is critical to the survival or success of the organization. Applications controlling sensitive functionality (e.g. transit, manufacturing equipment, control systems) or that have the possibility of threatening safety of lif Healthcare Most attackers are looking for sensitive data that can be used to directly or indirectly profit from to include personally identifiable information and payment data. Often the data can be used for identity theft, fraudulent payments, or a variety of fraud schemes. For the US healthcare sector, the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, Breach Notification Rules and Patient Safety Rule (= All network accessible applications Applications with small or moderate amounts of sensitive medical information (Protected Health Information), Personally Identifiable Information, or payment data. Applications used to control medical equipment, devices, or records that may endanger human life. Payment and Point of Sale systems (POS) that contain large amounts of transaction data that could be used to commit fraud. This includes any administrative interfaces for these applications
OWASP_Application_Security_Verification_Standard_3.0.1.docx