2021 OWASP Top Ten Overview

Summary

In this video, John Wagner introduces the 2021 OWASP Top 10, a critical list of the most prominent security risks for applications. He explains the methodology behind its creation, highlighting the data-driven approach that involved over 500,000 applications and contributions from global security organizations. The video distinguishes between the OWASP Top 10 as an awareness document, not a strict security standard, and contrasts it with the OWASP ASVS. The new 2021 list includes three new categories, four renamed or redefined risks, and some consolidated vulnerabilities. The video sets the stage for deeper dives into each of the top 10 security risks in future videos.

Takeaways

• 😀 The OWASP Top 10 is a list of the most critical application security risks, updated approximately every 3-4 years. The most recent version is from 2021.
• 😀 The OWASP Top 10 is an awareness document, not a security standard. Organizations should use it for awareness, but for actual security standards, the OWASP ASVS (Application Security Verification Standard) should be followed.
• 😀 The 2021 OWASP Top 10 list is more data-driven than previous versions, incorporating over 500,000 applications from a variety of security vendors, bug bounty programs, and other contributors.
• 😀 The list is made up of 8 data-driven categories and 2 survey-based categories. The data-driven categories are based on actual vulnerabilities and weaknesses observed in the field.
• 😀 In the 2021 version, the OWASP organization collected data on almost 400 Common Weakness Enumerations (CWEs), a significant increase from the 30 CWEs used in previous versions.
• 😀 CWEs are categorized into root causes (e.g., cryptographic failures) and symptoms (e.g., sensitive data exposure or denial of service), with OWASP focusing primarily on the root causes.
• 😀 The OWASP methodology involves evaluating both the exploitability (how easy a vulnerability is to exploit) and the impact (the potential damage it could cause) of security risks.
• 😀 Compared to the 2017 version, the 2021 list introduces 3 new categories, 4 categories with renamed or adjusted scopes, and consolidates several previous categories.
• 😀 The 2021 OWASP Top 10 includes critical risks such as broken access control, cryptographic failures, injection vulnerabilities, insecure design, and security misconfigurations.
• 😀 The OWASP Top 10 2021 highlights new and evolving threats like server-side request forgery (SSRF) and emphasizes issues such as identification/authentication failures and software/data integrity failures.

Q & A

What is OWASP, and why is it important for application security?

OWASP stands for the Open Web Application Security Project. It is an online community dedicated to improving the security of software. The OWASP Top 10 list is important because it provides a comprehensive, data-driven awareness document that highlights the most critical security risks in web applications, helping organizations prioritize security efforts.

How often does OWASP release its Top 10 list, and what is its purpose?

OWASP releases its Top 10 list every three to four years. The purpose of the list is to raise awareness about the most critical application security risks, helping organizations identify and mitigate common vulnerabilities in their software.

What is the difference between the OWASP Top 10 and the OWASP ASVS?

The OWASP Top 10 is an awareness document that highlights the most critical security risks in web applications, while the OWASP ASVS (Application Security Verification Standard) is a more detailed security standard designed for verification and testing, intended to be used throughout the secure development lifecycle.

What methodology did OWASP use to create the 2021 Top 10 list?

For the 2021 Top 10 list, OWASP utilized a data-driven approach, analyzing data from over 500,000 applications. Eight of the categories in the list were derived from this data, while two categories were informed by a survey. They also focused on identifying root causes of security issues, such as cryptographic failures and misconfigurations, rather than just the symptoms.

What is the Common Weakness Enumeration (CWE), and how does it relate to OWASP Top 10?

The CWE is a community-developed list of software and hardware weaknesses managed by MITRE. In the past, OWASP used a prescribed set of approximately 30 CWEs to collect data, but for the 2021 list, they expanded this to nearly 400 CWEs, helping them identify a wider range of vulnerabilities for the Top 10 list.

What are the key factors OWASP considered when creating the 2021 Top 10 list?

OWASP considered both the exploitability and the impact of security risks when creating the 2021 Top 10 list. They analyzed how easily a vulnerability could be exploited and the potential technical impact it could have on an organization or its users.

What were some of the significant changes from the 2017 OWASP Top 10 to the 2021 version?

The 2021 OWASP Top 10 introduced three new categories, made four categories more specific with updated names and scopes, and consolidated some issues from the 2017 list. These changes reflect the evolving landscape of security risks in application development.

Can organizations directly use the OWASP Top 10 as a security standard?

No, the OWASP Top 10 is not a security standard. It is an awareness document designed to help organizations understand the most critical application security risks. To adopt a security standard, organizations should refer to the OWASP ASVS (Application Security Verification Standard).

What are the top 3 categories in the 2021 OWASP Top 10 list?

The top three categories in the 2021 OWASP Top 10 list are: 1) Broken Access Control, 2) Cryptographic Failures, and 3) Injection.

What is 'Server Side Request Forgery' (SSRF), and where does it rank in the 2021 OWASP Top 10?

Server Side Request Forgery (SSRF) is a vulnerability where an attacker can make requests to internal servers or services from a vulnerable server. It ranks 10th in the 2021 OWASP Top 10 list, reflecting its growing importance as a critical security risk.