OWASP Top 10 Web Application Security Risks
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
3 slides · 1 min read · Domain 8
At the time of this writing, the Top 10 Web Application Security Risks included the following
2021-Broken Access Control
Thirty-four CWEs mapped to Broken Access Control were the most prevalent defect.
2021-Injection
Thirty-three CWEs mapped to injection represent the second most frequent defect. Cross-site scripting is now included.
2021-Cryptographic Failures
Failures related to cryptography can lead to sensitive data exposure or system compromise.
2021-Insecure Design
New in 2021, this focuses on risks related to design flaws and highlights the importance of software security throughout the life cycle.
2021-Security Misconfiguration
Most applications tested suffered from misconfiguration that correlates with business drivers for configurability and reuse of modern software. XML External Entities (XXE) are now included in this category.
2021-Identification and Authentication Failures
This is changed from "Broken Authentication" and now includes CWEs that are related to identification failures.
2021-Security Logging and Monitoring Failures
Changed from "Insufficient Logging & Monitoring" this now includes types of failures which directly impact visibility, incident alerting, and forensics.
2021-Vulnerable and Outdated Components
This has changed from "Using Components with Known Vulnerabilities" and is a known issue that security practitioners struggle to test and assess risk.
2021-Software and Data Integrity Failures
New in 2021, this focuses on assumptions related to software updates and CI/CD pipelines without guaranteeing integrity.
2021-Server-Side Request Forgery
This was included based on member surveys indicating importance despite data indicating low incidence rate and above average test coverage.