............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ...............................................................................................................................OWASP ............................................................................................................................... ...............................................................................................................................Automated Threat Handbook ............................................................................................................................... ...............................................................................................................................Web Applications ............................................................................................................................... ............................................................................................................................... ...............................................................................................................................Version 1.2 ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... ............................................................................................................................... OWASP Automated Threat Handbook Web Applications .......................................................................................................................................... ...................................................................................................................................................... Open Web Application Security Project .......................................................................................................................................... OWASP Automated Threat Handbook Web Applications The OWASP Automated Threat Handbook provides actionable information and resources to help defend against automated threats to web applications Authors Colin Watson and Tin Zaw Project Reviewers Igor Andriushchenko, Gabriel Mendez Justiniano and Matt Tesauro Other Project Contributors Jason Chan, Mark Hall, Andrew van der Stock and Roland Weber, everyone else who contributed information anonymously, and the authors of the referenced information sources; v1.2: Sumit Agarwal and Omri Iluz Version 1.2 published 15th February 2018 ISBN 978-1-329-42709-9 © 2015-2018 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license ...................................................................................................................................................... v1.2 OWASP Automated Threat Handbook Web Applications .......................................................................................................................................... ...................................................................................................................................................... Open Web Application Security Project Contents .......................................................................................................................................... Prefaces ....................................................1 Terminology ................................................4 Introduction ................................................5 Research....................................................7 The Ontology ...............................................9 Figure 1: Threat Events, ordered by ascending name........................10 Figure 2: Subset related to Account Credentials ............................11 Figure 3: Subset related to Payment Cardholder Data .......................11 Figure 4: Subset related to Vulnerability Identification ......................11 Figure 5: Subset related to Availability of Inventory .........................11 Figure 6: WASC Threat Classification view of the Threat Events...............12 Figure 7: Mitre CAPEC view of the Threat Events ............................13 Countermeasures ..........................................19 Figure 8: Automated Threat Countermeasure Classes .......................20 Use Case Scenarios .........................................23 Project Details..............................................26 Handbook Roadmap .......................................27 Automated Threat Event Reference ..........................28