text: (window.webpackJsonp=window.webpackJsonp||[]).push([[79],{r7hs:function(e,t,a){"use strict";a.r(t),a.d(t,"_frontmatter",(function(){return o})),a.d(t,"default",(function(){return l}));a("5hJT"),a("W1QL"),a("K/PF"),a("t91x"),a("75LO"),a("PJhk"),a("mXGw");var r=a("/FXl"),i=a("TjRS");a("aD51");function n(){return(n=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var a=arguments[t];for(var r in a)Object.prototype.hasOwnProperty.call(a,r)&&(e[r]=a[r])}return e}).apply(this,arguments)}var o={};void 0!==o&&o&&o===Object(o)&&Object.isExtensible(o)&&!o.hasOwnProperty("__filemeta")&&Object.defineProperty(o,"__filemeta",{configurable:!0,value:{name:"_frontmatter",filename:"src/proactive_controls/c2_leverage _security_frameworks_and_libraries.mdx"}});var s={_frontmatter:o},c=i.a;function l(e){var t=e.components,a=function(e,t){if(null==e)return{};var a,r,i={},n=Object.keys(e);for(r=0;r<n.length;r++)a=n[r],t.indexOf(a)>=0||(i[a]=e[a]);return i}(e,["components"]);return Object(r.b)(c,n({},s,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,Object(r.b)("em",{parentName:"p"},"ℹ️ This section will be part of ",Object(r.b)("a",n({parentName:"em"},{href:"https://github.com/guidesmiths/cybersecurity-handbook/issues/41"}),"1.0.0 Release"))),Object(r.b)("h1",{id:"c2-leverage-security-frameworks-and-libraries"},"C2: Leverage Security Frameworks and Libraries"),Object(r.b)("h2",{id:"description"},"Description"),Object(r.b)("p",null,"Secure coding libraries and software frameworks with embedded security help software\ndevelopers guard against security-related design and implementation flaws. A developer\nwriting an application from scratch might not have sufficient knowledge, time, or budget to\nproperly implement or maintain security features. Leveraging security frameworks helps\naccomplish security goals more efficiently and accurately."),Object(r.b)("h2",{id:"implementation"},"Implementation"),Object(r.b)("p",null,"When incorporating third party libraries or frameworks into your software, it is important to\nconsider the following best practices:\n1. Use libraries and frameworks from trusted sources that are actively maintained and\nwidely used by many applications.\n2. Create and maintain an inventory catalog of all the third party libraries.\n3. Proactively keep libraries and components up to date. Use a tool like OWASP\nDependency Check and Retire.JS to identify project dependencies and check if there\nare any known, publicly disclosed vulnerabilities for all third party code.\n4. Reduce the attack surface by encapsulating the library and expose only the required\nbehaviour into your software."),Object(r.b)("h2",{id:"vulnerabilities-prevented"},"Vulnerabilities Prevented"),Object(r.b)("p",null,"Secure frameworks and libraries can help to prevent a wide range of web application\nvulnerabilities. It is critical to keep these frameworks and libraries up to date "),Object(r.b)("h2",{id:"specific-mitigations"},"Specific Mitigations"),Object(r.b)("h3",{id:"owasp-top-10-vulnerabilities-mitigated"},"OWASP Top 10 Vulnerabilities Mitigated"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a1_injection"}),"A1:2017-Injection")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a2_broken_authentication"}),"A2:2017-Broken Authentication")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a3_sensitived_data_exposure"}),"A3:2017-Sensitive Data Exposure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a4_xml_external_entities_xxe"}),"A4:2017-XML External Entities (XXE)")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a5_broken_access_control"}),"A5:2017-Broken Access Control")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a6_security_misconfiguration"}),"A6:2017-Security Misconfiguration")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a7_cross-site_scripting_xss"}),"A7:2017-Cross-Site Scripting (XSS)")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"/cybersecurity-handbook/owasp/a8_insecure_deserialization"}),"A8:2017-Insecure Deserialization"))),Object(r.b)("h3",{id:"owasp-mobile-top-10-vulnerabilities-mitigated"},"OWASP Mobile Top 10 Vulnerabilities Mitigated"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m1-improper-platform-usage"}),"M1: Improper Platform Usage")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m2-insecure-data-storage"}),"M2: Insecure Data Storage")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication"}),"M3: Insecure Communication")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m4-insecure-authentication"}),"M4: Insecure Authentication")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography"}),"M5: Insufficient Cryptography")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m6-insecure-authorization"}),"M6: Insecure Authorization")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m7-client-code-quality"}),"M7: Client Code Quality")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m8-code-tampering"}),"M8: Code Tampering")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m9-reverse-engineering"}),"M9: Reverse Engineering")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",n({parentName:"li"},{href:"https://owasp.org/www-project-mobile-top-10/2016-risks/m10-extraneous-functionality"}),"M10: Extraneous Functionality"))))}void 0!==l&&l&&l===Object(l)&&Object.isExtensible(l)&&!l.hasOwnProperty("__filemeta")&&Object.defineProperty(l,"__filemeta",{configurable:!0,value:{name:"MDXContent",filename:"src/proactive_controls/c2_leverage _security_frameworks_and_libraries.mdx"}}),l.isMDXComponent=!0}}]);
  //# sourceMappingURL=component---src-proactive-controls-c-2-leverage-security-frameworks-and-libraries-mdx-c7617c33ffa4d8c51045.js.map