OWASP Top 10
Quick Definition
A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project.
What is OWASP Top 10?
The OWASP Top 10 is a standard awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications, based on data from hundreds of organizations and over 100,000 real-world applications and APIs.
The 2021 OWASP Top 10 includes:
- A01:2021 - Broken Access Control: Restrictions on authenticated users are not properly enforced
- A02:2021 - Cryptographic Failures: Failures related to cryptography leading to exposure of sensitive data
- A03:2021 - Injection: SQL, NoSQL, OS, and LDAP injection vulnerabilities
- A04:2021 - Insecure Design: Missing or ineffective security controls
- A05:2021 - Security Misconfiguration: Missing security hardening or improperly configured permissions
- A06:2021 - Vulnerable and Outdated Components: Using components with known vulnerabilities
- A07:2021 - Identification and Authentication Failures: Weaknesses in authentication mechanisms
- A08:2021 - Software and Data Integrity Failures: Code and infrastructure without integrity verification
- A09:2021 - Security Logging and Monitoring Failures: Insufficient logging and monitoring
- A10:2021 - Server-Side Request Forgery (SSRF): Applications fetching remote resources without validating URLs
Most WAFs include rule sets specifically designed to protect against OWASP Top 10 vulnerabilities.
Frequently Asked Questions
How often is the OWASP Top 10 updated?
The OWASP Top 10 is typically updated every 3-4 years. Major releases were in 2013, 2017, and 2021. The update frequency depends on significant changes in the threat landscape and data availability.