OWASP Top 10 2021 - The List and How You Should Use It
Summary
TLDRThe OWASP Top 10 is an influential international security standard that identifies the most critical web application risks. Updated in 2021, it prioritizes risks like Broken Access Control and Cryptographic Failures, reflecting a shift in cyber threats. The list is compiled through community input, surveys, and data analysis, offering unbiased, practical insights for enhancing application security. It serves as a baseline for compliance, education, and tool development, emphasizing the importance of secure coding practices and regular vulnerability assessments.
Takeaways
- 🌐 The OWASP Top 10 is an international security standard used globally to address web application security risks.
- 📈 Established in 2003, OWASP aims to enhance software security, particularly web applications, through unbiased and practical information.
- 🤝 The project is community-driven, with volunteers contributing to open source software projects, local chapters, and conferences.
- 📊 The Top 10 risks list is compiled using data from a GitHub repository, surveys, and community feedback.
- 🚀 As of the 2021 update, 'Broken Access Control' has become the top web application security risk, highlighting the importance of authorization safeguards.
- 🔐 'Cryptographic Failures', formerly 'Sensitive Data Exposure', is now the second most critical risk, emphasizing the need for robust cryptographic practices.
- 💡 'Injection', once the top vulnerability, is now third, showing that efforts to mitigate this risk have been somewhat successful.
- 🛠️ 'Insecure Design' is a new category in the 2021 list, urging developers to integrate security patterns and principles by design.
- 🔄 'Vulnerable and Outdated Components' is a challenge due to the high volume of new vulnerabilities discovered annually.
- 🔒 'Identification and Authentication Failures' has dropped in ranking, indicating that standardized frameworks like MFA are positively influencing security.
- 📈 'Server-side Request Forgery', a new addition, reflects the community's recognition of this risk despite it not being heavily represented in data.
- 📋 The OWASP Top 10 serves as a baseline for compliance, education, and tool development, and is a minimum reference for secure coding and security testing.
Q & A
What is the OWASP Top 10 and its purpose?
-The OWASP Top 10 is an international security standard developed by the Open Web Application Security Project (OWASP) to represent a consensus about the most critical web application security risks. It aims to raise awareness and provide unbiased, practical, and cost-effective information about application security.
How was the OWASP Top 10 list compiled for the 2021 release?
-The 2021 OWASP Top 10 list was compiled using data from open source software projects, local chapters, members, and training conferences. After a data call, industry contributors were encouraged to participate in a survey. The collected data was analyzed in a GitHub repository, and a draft list was created based on the findings. This draft was then publicly released and edited with community input on GitHub until a consensus was reached.
What is the significance of the change in the ranking of 'Broken Access Control' in the 2021 OWASP Top 10 list?
-The change in ranking of 'Broken Access Control' to the top spot in the 2021 list signifies its importance as it allows attackers to bypass authorization safeguards and perform tasks as if they were privileged users, potentially leading to exposure, modification, or destruction of data, and other network functions.
What does 'Cryptographic Failures' in the OWASP Top 10 list refer to?
-'Cryptographic Failures' refers to the exploitation of failures related to cryptography, which can compromise information transferred over secure communication. This can provide attackers with useful information for maintaining persistent access after exploitation.
How has the category 'Injection' evolved in the OWASP Top 10 list?
-The category 'Injection' has evolved from being previously known as 'Cross-site Scripting' and has slid down to number three in the list. It exploits vulnerable computer programs by introducing code that changes program execution, potentially allowing attackers to steal authentication cookies or trick services into impersonating users.
What is the new category 'Insecure Design' in the OWASP Top 10 list, and why was it included?
-'Insecure Design' is a new category for the 2021 OWASP Top 10 list. It calls for developers to include more security patterns and principles by design, especially considering the risks associated with including new applications into network infrastructures, such as the supply chain attack on SolarWinds.
What does 'Security Misconfiguration' mean in the context of the OWASP Top 10 list?
-'Security Misconfiguration' refers to the failure to implement all security controls for a server or web application, or implementing them with errors. It often results from human errors such as misinterpreting system implementations, not changing default credentials, or a lack of computer skills.
How does 'Vulnerable and Outdated Components' pose a risk in the OWASP Top 10 list?
-'Vulnerable and Outdated Components' include operating systems, servers, database management systems, APIs, and libraries that are vulnerable, unsupported, or out of date. An adversary only needs to find one such component to compromise a system, making it a significant risk given the high number of new vulnerabilities discovered each year.
What is the significance of the change in the category 'Identification and Authentication Failures' in the OWASP Top 10 list?
-The change in the category from 'Broken Authentication' to 'Identification and Authentication Failures' at a lower position indicates that standardized frameworks like Multi-Factor Authentication (MFA) are helping to mitigate the risk of compromised user identities.
What does 'Software and Data Integrity Failures' focus on in the OWASP Top 10 list?
-'Software and Data Integrity Failures' focuses on software updates, critical data, CI/CD pipelines, and includes Insecure Deserialization. It relates to code and infrastructure that does not protect against integrity violations, such as when an application relies on plugins from untrusted sources, potentially giving attackers access to the application.
How does 'Security Logging and Monitoring Failures' impact an organization according to the OWASP Top 10 list?
-'Security Logging and Monitoring Failures' can seriously impact visibility and forensics within an organization. Despite being difficult to test due to a lack of representation in CVE/CSS data, it is crucial for detecting and responding to security incidents effectively.
What is 'Server-side Request Forgery' and its significance in the OWASP Top 10 list?
-'Server-side Request Forgery' is a type of exploit where an attacker abuses server functionality to access or manipulate information that would otherwise not be directly accessible. Its addition to the list, based on community survey feedback, indicates that it is a significant risk, even if not always illustrated in the data collected.
Outlines
🔒 Introduction to OWASP Top 10
This paragraph introduces the OWASP Top 10, an international security standard developed by the Open Web Application Security Project (OWASP) since 2003. It highlights the purpose of OWASP, which is to enhance the security of software, particularly web applications, through unbiased, practical, and cost-effective information. The paragraph also discusses the collaborative nature of OWASP, involving volunteers, local chapters, and industry contributors. The process of compiling the Top 10 risks is explained, including data collection, analysis, and public consensus. The 2021 update is mentioned, with changes in category order and introduction of new categories, emphasizing the evolving nature of cybersecurity threats.
🛠️ Analysis of the 2021 OWASP Top 10 Risks
This paragraph delves into the specifics of the 2021 OWASP Top 10 list, providing insights into the changes and the reasons behind them. It starts by discussing the rise of 'Broken Access Control' to the top spot, highlighting its significance in allowing attackers to perform unauthorized actions. The paragraph then covers 'Cryptographic Failures', emphasizing the importance of secure data transfer. 'Injection' risks are explained, detailing how attackers can exploit vulnerabilities to steal sensitive information. 'Insecure Design' is introduced as a new category, urging developers to consider security by design. 'Security Misconfiguration' is discussed, noting its prevalence due to highly configurable software. The paragraph also touches on 'Vulnerable and Outdated Components', the challenges of maintaining up-to-date systems, and the impact of supply chain attacks. The paragraph concludes by mentioning the other categories in the list, such as 'Identification and Authentication Failures', 'Software and Data Integrity Failures', 'Security Logging and Monitoring Failures', and 'Server-side Request Forgery', and how they reflect the current cybersecurity landscape.
Mindmap
Keywords
💡OWASP Top 10
💡Cybersecurity
💡Broken Access Control
💡Cryptographic Failures
💡Injection
💡Insecure Design
💡Security Misconfiguration
💡Vulnerable and Outdated Components
💡Broken Authentication
💡Software and Data Integrity Failures
💡Security Logging and Monitoring Failures
💡Server-side Request Forgery
Highlights
The OWASP Top 10 is an international security standard used globally to address web application security risks.
Despite using OWASP, organizations still fall victim to cyberattacks, indicating the complexity and evolving nature of cybersecurity threats.
OWASP, or the Open Web Application Security Project, was initiated in 2003 to enhance software security, especially web applications.
The OWASP Top 10 is a consensus-driven document that outlines the most critical web application security risks.
OWASP operates without commercial influence, maintaining its commitment to providing unbiased, practical, and cost-effective application security information.
The Top 10 risks are compiled through a community effort involving open source software projects, local chapters, members, and conferences.
Data for the OWASP Top 10 is managed in a GitHub repository, incorporating contributions from industry survey participants.
The 2021 update to the OWASP Top 10 introduced changes in category order, names, and included new categories.
Broken Access Control, which allows attackers to bypass authorization, has become the top web application security risk.
Cryptographic Failures, formerly Sensitive Data Exposure, moved to the second position, emphasizing the importance of secure data transfer.
Injection,下滑至第三位, is a method used by attackers to manipulate program execution, such as stealing authentication cookies.
Insecure Design is a new category for 2021, urging developers to integrate security patterns and principles by design.
Security Misconfiguration, now at number five, reflects the challenges in implementing security controls correctly for software.
Vulnerable and Outdated Components, rising to the sixth position, highlights the risks of using outdated or unsupported software components.
Broken Authentication, now termed Identification and Authentication Failures at number seven, has seen improvement due to standardized frameworks like MFA.
Software and Data Integrity Failures, a new category at number eight, addresses the protection of software updates and critical data integrity.
Security Logging and Monitoring Failures, at number nine, underscores the importance of visibility and forensic capabilities in security.
Server-side Request Forgery, new at number ten, indicates the community's recognition of this exploit as a significant risk.
The OWASP Top 10 serves as a baseline for compliance, education, and vendor tools, and is the minimum reference for secure coding practices.
Transcripts
The OWASP Top 10 has developed into an international security standard
used by organizations across the globe. But even organizations that use OWASP
still end up as victims of cyberattack. So what is the OWASP Top 10 and how should you be using it?
What do you need to know so it becomes your friend?
OWASP, or the Open Web Application Security Project, was launched in 2003 to improve the
security of software, notably web applications. The OWASP Top 10 is a standard awareness document
that represents a broad consensus about the most critical security risks to web applications.
Nearly all involved with OWASP are volunteers and it is not affiliated with any technology
company. This lack of commercial pressure cements OWASP's claim of "unbiased, practical
and cost-effective information about application security." Or does it?
OWASP uses a community of open source software projects,
hundreds of local chapters worldwide, tens of thousands of members and training conferences
to compile their list of Top 10 risks. Data and documentation is fed into a GitHub repository
managed by OWASP after the Top 10 core team release a data call. Industry contributors are
also encouraged to participate in a survey. Once the data is collected in GitHub, it is normalized
and analyzed. Surveys are collected and reviewed. A draft Top 10 list is then made using eight risks
taken from the data and two from the survey. The draft is released publicly and the editing process
is recorded in GitHub. Once a public consensus has been reached, the OWASP Top 10 is released.
Last updated in 2017, the new list released on 24 September 2021
featured changes in category order, category name changes as well as some entirely new categories.
Let's take a look at the 2021 list and explain what the Top 10 categories actually mean.
Broken Access Control - up from number five - has taken the top spot in 2021.
This is an important change as it replaced injection - largely seen as the most popular
form of risk exploited by cybercriminals. Broken Access Control allows attackers to
bypass authorization safeguards and perform tasks as if they were privileged users.
Put simply, broken access control gives an attacker the ability to expose sensitive data
modify or destroy data, or perform pretty much any network function. It is the holy grail of exploits.
Cryptographic Failures - previously called Sensitive Data Exposure - is in at number two
from number three. Cryptographic Failures signifies a renewed focus by OWASP on failures
related to cryptography. In essence, this category exploits information transferred over secure
communication between two parties, which often provides an attacker with useful information
in the post-exploitation phase, like how to maintain persistent access.
Injection - previously known as Cross-site Scripting and considered the king of vulnerabilities -
slid down to number three. Injection exploits a vulnerable computer program by introducing
code that changes the way a program executes. For example, by injecting code into a web application
an attacker can steal authentication cookies and use them on other online
services, tricking these services into thinking that the attacker is you.
Insecure Design - a new category for the 2021 OWASP Top 10 - is in at number four. It
was included as a firm call for developers to include more security patterns and principles
by design. This is an important consideration when including a new application into your
network infrastructure, especially given the supply chain attack on SolarWinds
and the effect it had on third-party service providers.
Security Misconfiguration - in at number five, up from number six - was present in 90%
of applications tested, not surprising given the rise in highly configurable software.
Security Misconfiguration is a failure to implement all the security controls for a
server or web application, or implementing security controls but with errors. Everyone
makes mistakes and security misconfigurations occur through a broad range of human errors:
misinterpreting a system implementation; not changing default logging credentials;
a lack of computer skills; or, mistakes made under time pressure, for example.
Vulnerable and Outdated Components - previously known as Using Components
with Known Vulnerabilities - is up at number six, from number nine. By OWASP's own admission,
this category is difficult to test, but featured highly in the community survey
therefore contributing to its recent rank. Vulnerable and Outdated Components includes
operating systems, web or application servers, database management systems,
apis, and all components runtime environments and libraries that are vulnerable,
unsupported, or out of date. An adversary only needs to find one vulnerable component to
compromise a system. The problem is approximately 18,000 new vulnerabilities are found
each year, so protecting against known vulnerabilities is an ongoing process.
A new name given to Broken Authentication, Identification and Authentication Failures
comes in at number seven, down from number two - a good sign that standardized frameworks are helping.
broken authentication referred to the compromise of passwords,
keys, session tokens, user account information and other details to assume user identities.
The new position of Identification and Authentication Failures shows that procedures
like MFA are integral in authenticating key information, like usernames and passwords.
Another new category, Software and Data Integrity Failures comes in at number eight, focusing on
software updates, critical data, CI/CD pipelines and includes Insecure Desterilization from 2017.
This new category relates to code and infrastructure that does not protect against
integrity violations. An example of this is where an application, like Wordpress, relies on plugins
from untrusted sources one compromise plugin can give an attacker access to your application.
Previously categorized as Insufficient Logging and Monitoring, Security Logging
and Monitoring Failures comes in at number nine,
up from number 10. Although admittedly hard to test for due to a lack of representation in CVE/CSS data,
Security Logging and Monitoring Failures can seriously impact visibility and forensics.
Lastly, at number 10, Server-side Request Forgery is another new addition due to its position as
number one in the community survey, indicating strong feedback from the security community
that it is an important risk but not illustrated in the data collected. Server-side Request Forgery
is a type of exploit where an attacker abuses the functionality of a server causing it to access or
manipulate information that would otherwise not be directly accessible to the attacker.
The OWASP Top 10 is the go-to listing for anyone concerned with raising their awareness of top
risks. The addition of survey considerations as well as pure statistical data means that
OWASP does not solely rely on data collected by automated tests. Where possible, the categories
are ranked given three main considerations exploitability likelihood and technical impact.
However, OWASP themselves claim that it is a baseline - a "pseudo standard" even - for compliance,
education and vendor tools. As an awareness document, it is regarded as the bare minimum
reference for standards of coding, code reviews, peer reviews, tool support and penetration testing.
Being focused on AppSec means that many of the Top 10 findings cannot be easily tested for in-house.
Being a voluntary service means that participants releasing information publicly do so theoretically,
without the experience of a real world attack. If you're keen to hear more about OWASP's Top 10 list,
keep an eye out for our next video which compares OWASP's findings with our own list of Top 10 risks.
The risk is real. Defend with Cyber Citadel.
تصفح المزيد من مقاطع الفيديو ذات الصلة
![](https://i.ytimg.com/vi/znF3NKr65Ls/hq720.jpg?sqp=-oaymwEmCIAKENAF8quKqQMa8AEB-AH-CYAC0AWKAgwIABABGDsgRih_MA8=&rs=AOn4CLBqP9hh0upJdBIR21OPSaE2KL2MbQ)
SMT 1-2 Web Security Overview
![](https://i.ytimg.com/vi/OL0t-UJXCMc/hq720.jpg)
1.2.2 "A Flaw in the System's Design..."
![](https://i.ytimg.com/vi/7rCmtfK7gnU/hq720.jpg)
CompTIA Security+ SY0-701 Course - 2.3 Explain Various Types of Vulnerabilities
![](https://i.ytimg.com/vi/WEbsYRlwR38/hq720.jpg)
CompTIA Security+ SY0-701 Course - 4.3 Activities Associated With Vulnerability Management. - PART A
![](https://i.ytimg.com/vi/npZxgobbLN4/hq720.jpg?sqp=-oaymwEmCIAKENAF8quKqQMa8AEB-AH-CYAC0AWKAgwIABABGDsgRih_MA8=&rs=AOn4CLCYf8-NsNXwc6p-CKZwQRVU6lU87g)
SMT 2-4 Plaintext Communication Vulnerability
![](https://i.ytimg.com/vi/H5ifNVeDXkg/hq720.jpg)
Security Mechanisms
5.0 / 5 (0 votes)