Introduction to the

OWASP Top 10
Austin Chamberlain, OWASP Auckland
Top 10 Background
● Started in 2003
● Awareness document, targeted
at:
○ Developers
○ Security professionals
○ Security governance and
management
● Lists the Most Critical
Security Risks to Web
Applications
● Risks - not exploits or impacts
● OWASP Flagship Project
Versions and Updates
Images: [Link]
2004, 2007, 2010, 2013

2017

2021 - current version

2025 - under development

2021 Top 10

Images: [Link]

3 new categories, 4 categories with name/scope changes, some consolidation

2025 Top 10
Methodology
Hybrid system - data and survey Community survey allows front line
experts to highlight issues not yet
● Eight categories from
in the data.
contributed data Image: DALL-E 3

● Two categories from community

survey

Why? Completeness.

Data results generally limited to

automated tests, which take time to
develop and refine.
A01: Broken Access Control
Access control failure allows a Prevention:
function outside user’s intended
Deny by default; unified access
limits.
control across application; limit
● Bypass access control metadata and rates
● Access another account
● Elevation of privilege
● Violation of least Image: “Desire Path”,
[Link]
privilege/default deny
A02: Cryptographic Failures
Causes: Prevention:

● Cleartext protocols - HTTP, FTP ● Store only required sensitive

● Old, weak, or deprecated data, and classify
algorithms - MD5 appropriately
● Default keys, weak keys, key ● Use up-to-date algorithms and
management (are your keys in protocols, and manage keys
your Git repo?) ● Encrypt data at rest and in
● Server certificate correct and transit
validated? ● Ensure cryptographic randomness
is applied where required
● DO NOT ROLL YOUR OWN CRYPTO
A03: Injection
Drops to third position, even with Prevention:
inclusion of XSS
● Safe API
Causes: ● That’s it.
● OK, server-side input
● User-supplied data is not
validation - but get it right!
validated or sanitized
● LIMIT in SQL queries
● Hostile data is directly used
Image: [Link]

Examples:

● SQL, OS Command
A04: Insecure Design
Image: @karinakovacs2

New for 2021 - design and architectural flaws.

“Shift left” beyond coding to pre-code design.

Examples:

● Bots for ticket/item scalping

● Booking/ordering system attacks

Prevention:

● Secure development life cycle

● Threat modeling
● OWASP SAMM (Security Assurance Maturity
Model)
A05: Security Misconfiguration
Causes:

● Cloud services permissions

● Unnecessary features
● Default accounts
● Verbose error messages
● Security settings not correctly applied

Prevention:

● Ongoing security testing and hardening

● Minimal platforms
● Segmented architecture - eg
Image: DALL-E 3
containerization, cloud security groups
A06: Vulnerable and Outdated Components
Qualifies for OWASP top 10 from Prevention:
both community survey and data!
● Removed unused components
Does not directly link to CVEs ● Have a software inventory and
(Common Vulnerability and Exposure) continuously update!
● Manage software updates over
Examples:
correct channels
● Unaware of supply chain or ● If old software must be used,
software bill of materials mitigate and document.
(SBOM)
● Software components vulnerable
or unsupported
● No or slow upgrades, scanning
A07: Identification and Authentication Failures
Previously Broken Authentication Prevention:

Causes - does application allow: ● MFA

● Rate-limit and monitor for
● Credential stuffing
systematic password attacks
● Brute force attacks
● Enforce strong passwords
● Weak passwords
● … and don’t allow default
Does application: creds!
● Prevent account enumeration
● Lack Multi-Factor through standard messages
Authentication (MFA)?
● Not hash stored passwords?
● Expose or reuse session ID?
A08: Software and Data Integrity Failures
Examples: Prevention:

● Application relies on plugins, ● Use signed software channels.

libraries and modules from ● Use trusted repositories, or
untrusted sources, even internal repositories.
repositories, and content ● Use a software supply chain
delivery networks (CDN) security tool - OWASP
● Insecure CI/CD pipeline Dependency Check or OWASP
● Attackers are using CycloneDX
typo-squatting attacks against ● Implement review process for
common module names code and configuration changes.
A09: Security Logging and Monitoring Failures
Would you detect an attack? With Prevention:
enough time to react? With enough
● Log access events with context
information to respond?
and good retention period.
● Are you logging and monitoring? ● Generate logs in useful format.
● What kind of events? ● Protect logs against
● Is someone actually reading the injections/attacks.
logs? ● Institute effective monitoring
● Where are the logs stored? and alerting.
● Are there alerts on the logs? ● Have an incident response plan.
● Would a pentest trigger an
alert?
A10: Server Side Request Forgery
Category from community survey. Prevention:

Low incidence rate in data, Network: segmentation, firewall

above-average Exploit/Impact “deny by default”
potential rating.
Application: sanitize
SSRF definition: when a web client-supplied data, do not send
application fetches a remote raw responses to clients
resource without validating the
user-supplied URL.

Architecture complexity and cloud

services increase SSRF severity.
OWASP Top Ten - Quick Lessons
1. OWASP Top 10 is not everything! There are other
risks.
2. Frameworks solve a lot of problems.
3. Threat modeling (especially at the start) and
testing (always).
4. Other OWASP projects provide specific guidance on
development, verification, and testing.