Understanding the OWASP Top 10 security risks
Understanding the OWASP Top 10 security risks
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
What is OWASP?
The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.
The OWASP Top 10 (2021)
1. Broken Access Control
Access control enforces policy such that users cannot act outside of their intended permissions.
2. Cryptographic Failures
Previously "Sensitive Data Exposure," this focuses on failures related to cryptography.
3. Injection
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.
4. Insecure Design
This is a new category focusing on risks related to design flaws.
5. Security Misconfiguration
Security misconfiguration is the most commonly seen issue.
6. Vulnerable and Outdated Components
Using components with known vulnerabilities.
7. Identification and Authentication Failures
Previously "Broken Authentication," this category includes failures related to authentication.
8. Software and Data Integrity Failures
A new category focusing on assumptions about software updates and CI/CD pipelines.
9. Security Logging and Monitoring Failures
Insufficient logging and monitoring.
10. Server-Side Request Forgery (SSRF)
A new category for 2021.
Best Practices
- Regular security assessments
- Secure coding practices
- Dependency management
- Proper authentication and authorisation
- Security logging and monitoring
Conclusion
Understanding and addressing these risks is crucial for building secure web applications.