8 9 10 J Cornucopia Cornucopia Cornucopia Cornucopia David can bypass the application Michael can bypass the Xavier can circumvent the Roman can exploit the to gain access to data because the application to gain access to data application's controls because application because it was network and host infrastructure, because administrative tools or code frameworks, libraries and compiled using out-of-date tools, and supporting administrative interfaces are not components contain malicious or its configuration is not secure services/applications, have not secured adequately code or vulnerabilities (e.g. by default, or security been securely configured, the commercial off the shelf, information was not documented configuration rechecked outsourced, open source, and passed on to operational periodically and security patches externally-located) teams applied, or the data is stored locally, or the data is not physically protected Q K Joker Joker Cornucopia Cornucopia Wild Wild Jim can undertake malicious, Gareth can utilize the application Alice can utilize the application Bob can influence, alter or affect non-normal, actions without to deny service to some or all of Card to attack users' systems and data Card the application so that it no detection and response by its users longer complies with legal, the application regulatory, contractual or other organizational mandates Have you thought about Examine vulnerabilities and becoming an individual discover how they can be fixed OWASP member? All tools, using training applications in guidance and local meetings the free OWASP Broken are free for everyone, but Web Applications VM, or individual membership helps using the online challenges in support OWASP’s work the free Hacking Lab
Cornucopia 8 Cornucopia 9 Cornucopia 10 Cornucopia J David can bypass the application to gain access to data because the network and host infrastructure, and supporting services/applications, have not been securely configured, the configuration rechecked periodically and security patches applied, or the data is stored locally, or the data is not physically protected Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately Xavier can circumvent the application's controls because code frameworks, libraries and components contain malicious code or vulnerabilities (e.g. commercial off the shelf, outsourced, open source, externally-located) Roman can exploit the application because it was compiled using out-of-date tools, or its configuration is not secure by default, or security information was not documented and passed on to operational teams Cornucopia Q Cornucopia K Wild Card Joker Wild Card Joker Jim can undertake malicious, non-normal, actions without detection and response by the application Gareth can utilize the application to deny service to some or all of its users Alice can utilize the application to attack users' systems and data Bob can influence, alter or affect the application so that it no longer complies with legal, regulatory, contractual or other organizational mandates Have you thought about becoming an individual OWASP member? All tools, guidance and local meetings are free for everyone, but individual membership helps support OWASP’s work Examine vulnerabilities and discover how they can be fixed using training applications in the free OWASP Broken Web Applications VM, or using the online challenges in the free Hacking Lab
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx