Cybersecurity for Critical Infrastructures (KRITIS)

The OWASP Top 10 is a list of the ten most critical security risks for web applications, which is compiled and regularly updated by the Open Web Application Security Project (OWASP) Foundation. They serve as an important document for developers and security experts to find out about the most common and most dangerous security vulnerabilities in web applications.

In a distributed denial of service (DDoS) attack, attackers direct artificial traffic to the IT infrastructures, web applications or online APIs of operators of critical infrastructures. As a result, the affected services are slowed down or fail completely. The problems continue until the attacker ends the attack or the affected organization takes appropriate countermeasures.

The systematic misuse of access data through credential stuffing is one of the most frequently used methods of attack by cybercriminals against operators of critical infrastructures. Above all, trading the stolen information is a lucrative source of income for attackers.

In an XSS attack, cybercriminals inject malicious code into web applications by exploiting security vulnerabilities. XSS attacks allow attackers to gain control of a victim's browser, steal sensitive data such as cookies or login information and potentially compromise the entire user account.

In an SQL injection attack, cybercriminals specifically exploit security vulnerabilities to inject manipulated commands or malicious code via input masks, for example. The attackers aim to manipulate the underlying database and gain unauthorized access to confidential information.

Zero-day exploits are security gaps in software or hardware that are still unknown to the manufacturer and for which there are no patches yet. These vulnerabilities are exploited by attackers to compromise systems, often before the affected companies have even found out about the gap. Nevertheless, there are suitable solutions for taking appropriate countermeasures promptly until the necessary updates are available.

Attackers trick the user's browser into sending manipulated HTTP requests to a website or web application to trigger unwanted actions. This is done, for example, by sharing manipulated links or by visiting malicious websites, which in turn execute an HTTP request in the context of the existing user session.

The OWASP Top 10 is a list of the ten most critical security risks for web applications, which is compiled and regularly updated by the Open Web Application Security Project (OWASP) Foundation. They serve as an important document for developers and security experts to find out about the most common and most dangerous security vulnerabilities in web applications.

In a distributed denial of service (DDoS) attack, attackers direct artificial traffic to the IT infrastructures, web applications or online APIs of operators of critical infrastructures. As a result, the affected services are slowed down or fail completely. The problems continue until the attacker ends the attack or the affected organization takes appropriate countermeasures.