Tim's Wiki

OWASP Top 10

Properties2
descriptionThe ten most critical web application security risks as defined by OWASP, with prevention strategies for each.
tagssecurity, engineering, reference, mature

4 min read

OWASP Top 10

Definition

The OWASP (Open Web Application Security Project) Top 10 is a standard awareness document representing the most critical security risks to web applications. Updated periodically (latest: 2021), it serves as a baseline for security testing, code review, and secure development practices.

The 2021 List

A01 — Broken Access Control

Risk: Users bypass access restrictions — viewing other accounts, modifying data, escalating privileges via URL parameters, session states, or metadata manipulation.

Prevention:

  • Deny by default
  • Enforce access control in domain models (single reusable implementation)
  • Record ownership verification
  • Minimize CORS usage
  • Properly invalidate tokens/sessions
  • Log failures, alert admins, rate-limit APIs
  • Use SAST and DAST tools

A02 — Cryptographic Failures

Risk: Sensitive data (credentials, health records, credit cards) transmitted or stored unencrypted or with weak algorithms.

Prevention:

  • Avoid storing sensitive data unnecessarily
  • Use TLS everywhere, enforce encryption
  • Strong password hashing: Argon2, PBKDF2, scrypt, bcrypt
  • Avoid: SHA1, MD5, SHA256 for passwords
  • Audit data in transit, processing, and storage

A03 — Injection

Risk: SQL injection, XSS, NoSQL injection, OS command injection via unsanitized user input.

Prevention:

  • Use safe APIs, ORMs, parameterized queries
  • Validate and sanitize all input; use allowlists
  • Escape dynamic queries and special characters
  • Framework XSS escaping + supplemental defense
  • SAST/DAST in CI/CD pipeline

A04 — Insecure Design (New in 2021)

Risk: Fundamental design flaws — not fixable by perfect implementation. Missing threat modeling, no security requirements.

Prevention:

  • Threat modeling for every feature
  • Secure design patterns library
  • Use cases AND misuse cases
  • Segregate tier layers
  • Limit resource consumption per user/service
  • Leverage SAMM (Software Assurance Maturity Model)

A05 — Security Misconfiguration

Risk: Default configs, open ports, overly permissive accounts, verbose error messages, outdated software, missing security headers, XXE.

Prevention:

  • Automated, repeatable configuration processes
  • Minimal platform — remove unused features
  • Different credentials per environment
  • Regular patching; check bulletins and settings
  • Segment application architecture
  • Disable XXE/DTD processing; use SOAP 1.2+; prefer JSON

A06 — Vulnerable and Outdated Components

Risk: Relying on unpatched OS, frameworks, libraries, APIs with known vulnerabilities.

Prevention:

  • Maintain inventory; monitor NVD and MITRE
  • Use dependency check tools (OWASP Dependency-Check, Retire.js)
  • Only use official/signed packages
  • Regular scanning and compatibility testing

A07 — Identification and Authentication Failures

Risk: Brute force, default credentials, weak passwords, missing MFA, insecure session management.

Prevention:

  • No default credentials; enforce strong passwords
  • Rate-limit failed logins; alert admins
  • Implement MFA
  • Server-side session generation using industry standards
  • Securely store and invalidate session IDs
  • Detail-free error messages on auth failures

A08 — Software and Data Integrity Failures (New in 2021)

Risk: CI/CD pipeline compromises, untrusted plugins/CDNs, deserialization attacks, unsigned updates.

Prevention:

  • Digital signatures on code and data
  • Trusted repositories only; verify no known vulnerabilities
  • Segregation and access control in CI/CD pipeline
  • Integrity checks to detect tampering or replay
  • Supply chain security tooling

Example: SolarWinds hack (2021)

A09 — Security Logging and Monitoring Failures

Risk: Insufficient logging means attacks go undetected; logs stored locally can be modified by attackers.

Prevention:

  • Log all actions with sufficient detail
  • Centralized, separately stored, easily parsed logs
  • Integrity controls on high-value transactions
  • Monitor for suspicious activity; tune alerting
  • Define incident response and recovery plan
  • Examine after pen testing or DAST scans

A10 — Server-Side Request Forgery (SSRF) (New in 2021)

Risk: Application fetches user-provided URLs without validation, enabling access to internal services, cloud metadata, etc.

Prevention:

  • Network layer: isolate remote access, deny by default
  • Application layer: sanitize URLs, validate schema/port/host against allowlist
  • Never return raw response body to client
  • Disable HTTP redirection
  • Disable unused URL schemas
  • Authenticate internal services

Key Tools and Resources

ToolPurpose
SASTStatic analysis of source code for vulnerabilities
DASTDynamic “black-box” testing of running applications
OWASP ASVSApplication Security Verification Standard
NVDNational Vulnerability Database
CVECommon Vulnerabilities and Exposures catalog
CIS BenchmarksPrescriptive configuration recommendations

Source References

Graph View

Backlinks