Some Random Notes

1.0

3 min read

Test yourself

log4j dependency in code - A03 gmail login - password correct / mfa - A07 plaintext pwd, no salting - A04 logged PII - A09 exception stacktrace propagates to end user, no global exception handler - A02 , A10 acutator enabled in prod - A02 too much log - A09 missed rate limiting - A06, A07 missed patching - A02 - A03 github down due to not getting alerts for load at sidecars - A02, A09

You are mostly spot-on, but there are two subtle misclassifications based on the updated OWASP Top 10 taxonomy. Let’s do a quick audit of your list:

The Scorecard: What’s Correct vs. What Needs a Tweaking

  1. log4j dependency in code A03: Software Supply Chain Failures

    • Correct. Vulnerable third-party open-source libraries are the textbook definition of supply chain risk.

  2. gmail login - password correct / mfa A07: Identification and Authentication Failures

    • Correct. Weaknesses in authenticating users or missing multi-factor controls fall squarely here.

  3. plaintext pwd, no salting A04: Cryptographic Failures

    • Correct. Insecure handling or lack of hashing for sensitive credentials is a cryptographic failure.

  4. logged PII A09: Security Logging and Monitoring Failures

    • Correct. Writing sensitive data (PII, credentials) to logs violates secure logging standards.

  5. exception stacktrace propagates to end user, no global exception handler A02 (You put A02, but it belongs to A10: Mishandling of Exceptional Conditions)

    • Correction: While bad error handling can feel like a misconfiguration, leaking raw stack traces and failing open during exceptional states is officially categorized under A10.

  6. actuator enabled in prod A02: Security Misconfiguration

    • Correct. Leaving debug endpoints or default administrative features open in production is a classic misconfiguration.

  7. too much log A09: Security Logging and Monitoring Failures

    • Correct. Excessive, noisy logging without actionable aggregation or filtering creates blind spots and storage hazards.

  8. missed rate limiting A06 (You put A06, but it belongs to A07: Authentication Failures or A06: Insecure Design)

    • Correction: Missing rate-limiting on login/password reset endpoints is typically tracked under A07 (Authentication Failures) because it directly enables brute-force and credential stuffing attacks, or A06 (Insecure Design) if it’s an architectural omission.

  9. missed patching A02 (You put A02, but it belongs to A03: Software Supply Chain Failures or A02: Security Misconfiguration)

    • Correction: Failing to patch known vulnerabilities in third-party software packages and components is tightly coupled with A03 (Supply Chain) or outdated components management.

  10. github down due to not getting alerts for load at sidecars A02 (You put A02, but it belongs to A09: Security Logging and Monitoring Failures)

    • Correction: Missing monitoring metrics, telemetry alerts, and failing to detect infrastructure bottlenecks (like sidecar proxy load) is a classic A09 (Logging and Alerting Failure).

Quick Summary of Corrections:

  • Exception Stacktraces: Move from A02 A10

  • Missed Rate Limiting: Move from A06 A07

  • Missed Patching: Move from A02 A03

  • Sidecar Alerting Gaps: Move from A02 A09

Backlinks