2021 OWASP Top Ten: Software and Data Integrity Failures

A new category for 2021, this risk focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. An example of this is where an application relies upon plugins, libraries, or modules from untrusted sources, repositories, and content delivery networks (CDNs). An insecure CI/CD pipeline can introduce the potential for unauthorized access, malicious code, or system compromise. Lastly, many applications now include auto-update functionality, where updates are downloaded without sufficient integrity verification and applied to the previously trusted application. Attackers could potentially upload their own updates to be distributed and run on all installations. Another example is where objects or data are encoded or serialized into a structure that an attacker can see and modify is vulnerable to insecure deserialization.
#OWASPTOP10
Video 9 / 11

⬇️⬇️⬇️ JOIN THE COMMUNITY! ⬇️⬇️⬇️

DevCentral is an online community of technical peers dedicated to learning, exchanging ideas, and solving problems - together.

Find all our platform links ⬇️ and follow our Community Evangelists! 👋

Your Community Evangelists:

[KapitanZbik]

I have enjoyed the whole playlist of OWASP top ten. This + Owasp's description on their site provides actually a great understanding of those concepts. Everyone involved in IT should watch and read this imo. Thank You!

[VyshfulThinking]

Amazing Videos. Got detailed understand about the recent OWASP. Keep posting, loving the learning.

[olaf]

Love these videos. Keep up the good work. You make a pretty dry topic very entertaining

[Chagarumagala]

i dont get how this is different from vulnerable components

[taiiff]

Amazing video! But I have a question..
What is cd/ci pipeline?