Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / Website owner
Website owner: its risk register
Often one person with one hosting account and no security team: depends entirely on the host.
Kind role · Assigned here 2 · In its register 2 · the briefing for a website owner
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R01-1 Default Apache mod_php installations exploited before application code runs | 15 high | Security | bearer | ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3 |
| R01-5 Popular applications compromised before authentication | 15 high | Security | owner | OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4 |
Where its risks sit
The standards its register touches
CIS Controls (2), PCI DSS (2), ISO/IEC 27001 (1), Cyber Essentials (1), OWASP Top 10s (1)