Securitybasic

OWASP Top 10

A standard awareness document listing the ten most critical web application security risks, maintained by the Open Web Application Security Project.

Also known as: OWASP Top Ten, OWASP risks, web application security risks, OWASP 2021

Description

The OWASP Top 10 is the most widely recognized reference for web application security risks, published by the Open Web Application Security Project (OWASP). Updated periodically based on data from hundreds of organizations and thousands of applications, it represents broad consensus on the most critical security risks. The current list (2021) includes: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery.

The OWASP Top 10 serves multiple purposes: it provides a starting point for security programs, a common vocabulary for discussing risks, a basis for security testing and code review checklists, and a benchmark for regulatory compliance. Many security standards and regulations reference the OWASP Top 10, including PCI DSS, which requires protection against these risks for applications handling payment data.

Beyond the Top 10, OWASP provides extensive resources including the Application Security Verification Standard (ASVS) for detailed security requirements, the Testing Guide for security testing methodologies, the Cheat Sheet Series for developer-friendly guidance on specific security topics, and tools like ZAP (Zed Attack Proxy) for security testing. Teams should use the Top 10 as a baseline but not a comprehensive security program -- it represents the minimum, not the goal.

Prompt Snippet

Use the OWASP Top 10 (2021) as the baseline security checklist for every application: verify access control on all endpoints (A01), audit cryptographic implementations for weak algorithms (A02), test all input paths for injection vulnerabilities using parameterized queries (A03), conduct threat modeling for insecure design patterns (A04), and scan for security misconfigurations using OWASP ZAP or Burp Suite (A05). Map each OWASP category to specific automated checks in your CI pipeline -- SAST tools (Semgrep, CodeQL) for injection and access control, SCA tools (Snyk) for vulnerable components (A06), and DAST tools (ZAP) for authentication and SSRF issues.