We all provide our personal data in web applications to order products online, chat with friends or conduct online searches. Privacy risks come along with many of those web applications and, unfortunately, the situation becomes more challenging with cloud computing, big data and business models heavily dependent on analyzing personal data. For a long time, there was no comprehensive solution or framework addressing these privacy risks in web applications.

That is why I started a new project for the Open Web Application Security Project (OWASP) initiative about a year ago.

The goal of this open-source project was to identify the most important technical and organizational risks in web applications. To keep it simple we decided to focus on the top 10 risks in line with other successful OWASP projects that established top-10 lists. Consequently, our project is called OWASP Top 10 Privacy Risks. The list has been created by performing a classical risk assessment, multiplying the impact with the likelihood. Due to a lack of statistical data, the likelihood was determined in a survey asking privacy and security experts how frequently certain risks appear in web applications.

The results showed that technical topics ranked highest.

The most critical risks are web application vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection, followed by data leakage at the operator, which is also caused by a lack of technical safeguards in many cases, e.g., weak authentication or anonymization. Another technical issue is that developers often do not enable privacy flags or use privacy-friendly ways to implement third-party content like social network buttons or videos in websites.

The full Top 10 Privacy Risk list is described on our project website. I am currently on my way to Washington, DC, where I will present these identified risks at the IAPP Global Privacy Summit on Thursday at 4:30 pm. My talk will include practical countermeasures for lawyers and technicians to remediate these risks. I also have some printouts of our latest info brochure with me that luckily made it through secondary security screening at Munich airport.

I look forward to a great Summit and inspiring talks.