应用安全（AppSec）与 OWASP Top 10

什么是应用安全？

应用安全（AppSec）涵盖了使应用程序更安全、 抵御威胁的所有措施。它涵盖从安全设计、采用 secure coding practices 的开发、安全 测试，直到部署和持续维护。

OWASP Top 10 (2021)

A01 - Broken Access Control

风险：用户访问未授权的资源

示例：IDOR、privilege escalation、forced browsing

缓解措施：在所有层级实施 access control，deny by default

A02 - Cryptographic Failures

风险：因加密不当导致敏感数据泄露

示例：plain text 密码、weak algorithms、无 TLS 的 HTTP

缓解措施：TLS everywhere，密码使用 bcrypt/Argon2，数据使用 AES-256

A03 - Injection

风险：SQL、NoSQL、OS command injection、LDAP、XPath

示例：' OR '1'='1，shell command injection

缓解措施：Prepared statements、ORMs、input validation、WAF

A04 - Insecure Design

风险：架构与威胁建模缺陷

示例：缺少 rate limiting，没有 threat modeling

缓解措施：Secure by design、threat modeling、secure design patterns

A05 - Security Misconfiguration

风险：不安全或默认的配置

示例：default 凭据、暴露的 stack traces、CORS misconfiguration

缓解措施：Hardening guides、automated configuration scanning

A06 - Vulnerable and Outdated Components

风险：使用存在已知漏洞的库

示例：Log4Shell (CVE-2021-44228)、Struts2 RCE

缓解措施：Dependabot、Snyk、OWASP Dependency-Check、SCA tools

A07 - Identification and Authentication Failures

风险：身份验证与会话方面的缺陷

示例：Credential stuffing、session fixation、weak passwords

缓解措施：MFA、rate limiting、secure session management、breach detection

A08 - Software and Data Integrity Failures

风险：CI/CD 缺少完整性校验，不安全的反序列化

示例：Unsigned updates、insecure deserialization（Java、.NET）

缓解措施：Code signing、integrity checks、secure serialization libraries

A09 - Security Logging and Monitoring Failures

风险：缺乏对攻击和入侵的可见性

示例：日志不足、无告警、日志未受保护

缓解措施：Centralized logging、SIEM integration、real-time alerting

A10 - Server-Side Request Forgery (SSRF)

风险：服务器向内部资源发起恶意请求

示例：Cloud metadata API access、internal port scanning

缓解措施：URL 白名单、network segmentation、disable unnecessary protocols

AppSec 工具

SAST (Static Application Security Testing)

  • SonarQube：Code quality 与 security vulnerabilities
  • Checkmarx：Enterprise SAST platform
  • Semgrep：Lightweight static analysis，customizable rules
  • Bandit (Python)、Brakeman (Ruby)：Language-specific scanners

DAST (Dynamic Application Security Testing)

  • OWASP ZAP：Open-source web app scanner
  • Burp Suite：Manual + automated testing
  • Acunetix、Netsparker：Enterprise DAST solutions
  • 在 runtime environment 中进行 Black-box testing

IAST & RASP

  • IAST：对代码进行插桩以实现混合分析
  • RASP：Runtime Application Self-Protection - 在生产环境中检测
  • Contrast Security、Sqreen：IAST/RASP platforms

SCA (Software Composition Analysis)

  • Snyk、WhiteSource、Mend：Dependency vulnerability scanning
  • OWASP Dependency-Check：Open-source SCA
  • 检测 third-party libraries 中的漏洞

Secure Coding Practices

  • [OK] Input validation：whitelist 优先于 blacklist
  • [OK] Output encoding：context-aware (HTML, JS, URL, CSS)
  • [OK] Parametrized queries：始终使用 prepared statements
  • [OK] Least privilege：应用程序以最低必要权限运行
  • [OK] Defense in depth：多层防护
  • [OK] Fail securely：错误不应泄露敏感信息
  • [OK] Security by design：从架构阶段就考虑安全
  • [OK] Keep it simple：复杂性会增加风险

Web Application Firewall (WAF)

  • ModSecurity：Open-source WAF engine
  • Cloudflare WAF：Cloud-based protection
  • AWS WAF、Azure WAF：Cloud-native options
  • Imperva、F5：Enterprise WAF appliances
  • 防护 OWASP Top 10、bot management、rate limiting
  • 针对关键漏洞的 Virtual patching

集成到 SDLC

Shift-Left Security：在生命周期中尽早集成安全

  • Design Phase：Threat modeling、secure architecture review
  • Development：IDE plugins (Snyk Code, SonarLint)、secure coding training
  • CI/CD：SAST、SCA、container scanning、pre-commit hooks
  • Testing：DAST、penetration testing、security regression tests
  • Deployment：IAST、infrastructure scanning、compliance checks
  • Production：RASP、WAF、monitoring、incident response