OWASP Cloud-Native Application Security Top 10

OWASP Cloud-Native Application Security Top 10 - An OWASP project

About OWASP Cloud-Native Application Security Top 10

Overview

Important Note: This project is very much alive, and was last updates in April 2022. We are currently looking for contributors willing to draft the different categories, so please feel free to drop us an email if you would like to assist. Cloud native technologies empower organizations to build and run scalable applications in modern, dynamic environments such as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs exemplify this approach. Cloud-Native applications are a fundamentally new and exciting approach to designing and building software. However, it also raises a completely new set of security challenges. For example, when you move to a microservice model, end-to-end visibility, monitoring and detection become more complex and difficult to execute. The primary goal of the OWASP Cloud-Native Application Security Top 10 document is to provide assistance and education for organizations looking to adopt Cloud-Native applications securely. The guide provides information about what are the most prominent security risks for cloud-native applications, the challenges involved, and how to overcome them.

Interim List of Risks - Currently Under Review!

The OWASP Cloud-Native Top 10 list is currently under development (July 2021). As part of our effort to collect feedback, we are presenting an interim list below. Please feel free to contact the project leaders if you have any feedback.

CNAS-1: Insecure cloud, container or orchestration configuration

Examples:

CNAS-2: Injection flaws (app layer, cloud events, cloud services)

Examples:

CNAS-3: Improper authentication & authorization

Examples:

CNAS-4: CI/CD pipeline & software supply chain flaws

Examples:

CNAS-5: Insecure secrets storage

Examples:

CNAS-6: Over-permissive or insecure network policies

Examples:

CNAS-7: Using components with known vulnerabilities

Examples:

CNAS-8: Improper assets management

Examples:

CNAS-9: Inadequate ‘compute’ resource quota limits

Examples:

CNAS-10: Ineffective logging & monitoring (e.g. runtime activity)

Examples:

Getting Involved

You do not have to be a security expert or a programmer to contribute. Contact the project leader(s) to get involved, we welcome any type of suggestion and comments. Possible ways to contribute:

Project Resources

Project Leaders

to get involved

comments

ization

Project Information

Lab Project

Classification

Standards

Language

HTML

Contributors

GitHub Stars

Downloads

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.