INFRA - OWASP TOP 10 (Internal Infrastructure Security Risks)
Infrastructure security risks are the weaknesses an attacker meets after the perimeter, once a phishing mail, a stolen laptop or a single exposed service has bought them a foothold inside. This section follows the OWASP Top 10 Infrastructure Security Risks 2024, published by the OWASP Infrastructure Security Risks Project, and turns each risk into work you can carry out against a real internal estate: domains, hypervisors, switches, appliances, file shares, backup systems and the monitoring that is supposed to be watching all of it.
The list exists because internal defence is routinely thinner than external defence. A hardened edge and a flat, unpatched, unmonitored interior is the shape of most breaches that reach the news, and every category below describes one reason the interior stays soft.
What you’ll find here:
- A description of each risk grounded in the official OWASP text, restated for the systems a tester actually touches
- Three hands-on pages under every category, each anchored to a concrete surface: internal services and firmware, EDR and SIEM coverage, host baselines, privilege and account lifecycle, internal protocols and TLS, segmentation and admission control, credentials and second factors, disclosure channels, management planes, and the asset inventory itself
- Commands and evidence you can reproduce safely in an authorised test estate
- Prioritized remediation and prevention checklists
The 2024 Categories
- ISR01: Outdated Software - missing patches, unsupported versions and firmware nobody owns.
- ISR02: Insufficient Threat Detection - the dwell time you are actually buying an attacker.
- ISR03: Insecure Configurations - hardening drift on hosts and the services running on them.
- ISR04: Insecure Resource and User Management - who holds which rights on which machine, and whether anyone still tracks it.
- ISR05: Insecure Use of Cryptography - cleartext protocols and unvalidated TLS inside the perimeter.
- ISR06: Insecure Network Access Management - who can attach to the network, and how far they get once attached.
- ISR07: Insecure Authentication Methods and Default Credentials - vendor defaults, guessable passwords and single-factor remote access.
- ISR08: Information Leakage - the channels by which internal data leaves without anyone deciding it should.
- ISR09: Insecure Access to Resources and Management Components - the consoles and shares that run and hold the estate.
- ISR10: Insufficient Asset Management and Documentation - the coverage denominator every other control is measured against.
How This List Differs From The Web And Cloud Lists
- The threat model starts inside. The Web Top 10 assumes an anonymous attacker at the edge; this list assumes one workstation is already lost and asks what that costs.
- Several categories are about absence of a control, not a flaw in one. Insufficient threat detection and insufficient asset management produce no scanner finding at all - they are proven by reconciliation, not by an exploit.
- The affected components are mostly things that are bought rather than built: switches, hypervisors, backup appliances, printers, out-of-band controllers. Their patch and configuration lifecycle usually sits outside whatever process governs the application estate.
- ISR10 is the multiplier. Every other category has a denominator - “what fraction of the estate is patched, monitored, hardened, segmented” - and an inaccurate inventory silently corrupts all of them.
Directory-specific attack paths - Kerberoasting, delegation abuse, AD CS, DCSync, NTLM relay - live in the Active Directory Vulnerabilities section, and provider-specific control-plane issues live under Cloud Vulnerabilities. Use these pages for internal penetration tests, assumed-breach exercises, segmentation reviews, purple-team detection validation, and infrastructure hardening programmes.
In this section
- ISR01: Outdated SoftwareOutdated software is any host in the internal estate running a version with published, vendor-patched flaws that were never applied.
- ISR02: Insufficient Threat DetectionInsufficient threat detection is the gap between what happens on an internal estate and what its monitoring stack actually records and alerts on.
- ISR03: Insecure ConfigurationsInsecure configurations are hosts and services that ship or drift into a weaker state than the documented baseline.
- ISR04: Insecure Resource and User ManagementInsecure resource and user management is the drift between who actually holds rights on a host and who still needs them.
- ISR05: Insecure Use of CryptographyInternal traffic and storage go unencrypted or weakly encrypted, so anyone already on the network or holding a disk can read credentials and data.
- ISR06: Insecure Network Access ManagementInsecure network access management is the failure to control which devices can attach to the internal network…
- ISR07: Insecure Authentication Methods and Default CredentialsInsecure authentication is where an internal system accepts a weak, guessable or vendor-set secret as sufficient proof of identity.
- ISR08: Information LeakageInformation leakage is sensitive data reaching people or places it should not through the estate's own internal channels.
- ISR09: Insecure Access to Resources and Management ComponentsInsecure access to resources and management components is unrestricted reach to the planes that run the estate and the data they hold.
- ISR10: Insufficient Asset Management and DocumentationInsufficient asset management is the gap between what is actually connected to an estate and what any inventory records.
Last updated
