OWASP Cheat Sheet Series: IndexProactiveControls

# Proactive Controls Index

## Objective

> The OWASP Top Ten Proactive Controls 2018 is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number 1 being the most important.

This cheat sheet will help users of the [OWASP Top Ten Proactive Controls 2018](https://top10proactive.owasp.org/archive/2018/0x02-about-project/) identify which cheat sheets map to each proactive control.

## [C1. Define Security Requirements](https://top10proactive.owasp.org/archive/2018/c1-security-requirements/)

[Abuse Case Cheat Sheet](cheatsheets/Abuse_Case_Cheat_Sheet.md)

[Attack Surface Analysis Cheat Sheet](cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.md)

[Threat Modeling Cheat Sheet](cheatsheets/Threat_Modeling_Cheat_Sheet.md)

## [C2. Leverage Security Frameworks and Libraries](https://top10proactive.owasp.org/archive/2018/c2-leverage-security-frameworks-libraries/)

[Clickjacking Defense Cheat Sheet](cheatsheets/Clickjacking_Defense_Cheat_Sheet.md)

[DotNet Security Cheat Sheet (A3 Cross Site Scripting)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a3-cross-site-scripting)

[PHP Configuration Cheat Sheet](cheatsheets/PHP_Configuration_Cheat_Sheet.md)

[Ruby on Rails Cheat Sheet (Tools)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#tools)

[Ruby on Rails Cheat Sheet (XSS)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#cross-site-scripting-xss)

[Vulnerable Dependency Management Cheat Sheet](cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.md)

## [C3. Secure Database Access](https://top10proactive.owasp.org/archive/2018/c3-secure-database/)

[DotNet Security Cheat Sheet (Data Access)](cheatsheets/DotNet_Security_Cheat_Sheet.md#data-access)

[DotNet Security Cheat Sheet (A1 SQL Injection)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a1-sql-injection)

[Query Parameterization Cheat Sheet](cheatsheets/Query_Parameterization_Cheat_Sheet.md)

[Ruby on Rails Cheat Sheet (SQL Injection)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#sql-injection)

[SQL Injection Prevention Cheat Sheet](cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.md)

## [C4. Encode and Escape Data](https://top10proactive.owasp.org/archive/2018/c4-encode-escape-data/)

[AJAX Security Cheat Sheet (Client Side)](cheatsheets/AJAX_Security_Cheat_Sheet.md#client-side-javascript)

[Cross Site Scripting Prevention Cheat Sheet](cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)

[DOM based XSS Prevention Cheat Sheet](cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.md)

[Injection Prevention Cheat Sheet](cheatsheets/Injection_Prevention_Cheat_Sheet.md)

[Injection Prevention Cheat Sheet in Java](cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.md)

[LDAP Injection Prevention Cheat Sheet](cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md)

## [C5. Validate All Inputs](https://top10proactive.owasp.org/archive/2018/c5-validate-inputs/)

[Bean Validation Cheat Sheet](cheatsheets/Bean_Validation_Cheat_Sheet.md)

[Deserialization Cheat Sheet](cheatsheets/Deserialization_Cheat_Sheet.md)

[DotNet Security Cheat Sheet (HTTP Validation and Encoding)](cheatsheets/DotNet_Security_Cheat_Sheet.md#http-validation-and-encoding)

[DotNet Security Cheat Sheet (A8 Cross site request forgery)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a8-cross-site-request-forgery)

[DotNet Security Cheat Sheet (A10 Unvalidated redirects and forwards)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a10-unvalidated-redirects-and-forwards)

[Input Validation Cheat Sheet](cheatsheets/Input_Validation_Cheat_Sheet.md)

[Injection Prevention Cheat Sheet](cheatsheets/Injection_Prevention_Cheat_Sheet.md)

[Injection Prevention Cheat Sheet in Java](cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.md)

[Mass Assignment Cheat Sheet](cheatsheets/Mass_Assignment_Cheat_Sheet.md)

[OS Command Injection Defense Cheat Sheet](cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.md)

[File Upload Cheat Sheet](cheatsheets/File_Upload_Cheat_Sheet.md)

[REST Security Cheat Sheet (Input Validation)](cheatsheets/REST_Security_Cheat_Sheet.md#input-validation)

[Ruby on Rails Cheat Sheet (Command Injection)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#command-injection)

[Ruby on Rails Cheat Sheet (Mass Assignment and Strong Parameters)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#mass-assignment-and-strong-parameters)

[Unvalidated Redirects and Forwards Cheat Sheet](cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md)

[XML External Entity Prevention Cheat Sheet](cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md)

[Server Side Request Forgery Prevention Cheat Sheet](cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.md)

## [C6. Implement Digital Identity](https://top10proactive.owasp.org/archive/2018/c6-digital-identity/)

[Authentication Cheat Sheet](cheatsheets/Authentication_Cheat_Sheet.md)

[Choosing and Using Security Questions Cheat Sheet](cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.md)

[DotNet Security Cheat Sheet (Forms authentication)](cheatsheets/DotNet_Security_Cheat_Sheet.md#forms-authentication)

[DotNet Security Cheat Sheet (A2 Weak Account management)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a2-weak-account-management)

[Forgot Password Cheat Sheet](cheatsheets/Forgot_Password_Cheat_Sheet.md)

[JAAS Cheat Sheet](cheatsheets/JAAS_Cheat_Sheet.md)

[JSON Web Token Cheat Sheet for Java](cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.md)

[Password Storage Cheat Sheet](cheatsheets/Password_Storage_Cheat_Sheet.md)

[REST Security Cheat Sheet (JWT)](cheatsheets/REST_Security_Cheat_Sheet.md#jwt)

[Ruby on Rails Cheat Sheet (Sessions)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#sessions)

[Ruby on Rails Cheat Sheet (Authentication)](cheatsheets/Ruby_on_Rails_Cheat_Sheet.md#authentication)

[SAML Security Cheat Sheet](cheatsheets/SAML_Security_Cheat_Sheet.md)

[Session Management Cheat Sheet](cheatsheets/Session_Management_Cheat_Sheet.md)

[Multi-Factor Authentication Cheat Sheet](cheatsheets/Multifactor_Authentication_Cheat_Sheet.md)

## [C7. Enforce Access Controls](https://top10proactive.owasp.org/archive/2018/c7-enforce-access-controls/)

[Access Control Cheat Sheet](cheatsheets/Access_Control_Cheat_Sheet.md)

[Authorization Testing Automation](cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.md)

[Credential Stuffing Prevention Cheat Sheet](cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.md)

[Cross-Site_Request_Forgery_Prevention_Cheat_Sheet](cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md)

[DotNet Security Cheat Sheet (A4 Insecure Direct object references)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a4-insecure-direct-object-references)

[DotNet Security Cheat Sheet (A7 Missing function level access control)](cheatsheets/DotNet_Security_Cheat_Sheet.md#a7-missing-function-level-access-control)

[REST Security Cheat Sheet (Access Control)](cheatsheets/REST_Security_Cheat_Sheet.md#access-contr