OWASP Top 10 2021 - The List and How You Should Use It

Summary

The OWASP Top 10 is an influential international security standard that identifies the most critical web application risks. Updated in 2021, it prioritizes risks like Broken Access Control and Cryptographic Failures, reflecting a shift in cyber threats. The list is compiled through community input, surveys, and data analysis, offering unbiased, practical insights for enhancing application security. It serves as a baseline for compliance, education, and tool development, emphasizing the importance of secure coding practices and regular vulnerability assessments.

Takeaways

• 🌐 The OWASP Top 10 is an international security standard used globally to address web application security risks.
• 📈 Established in 2003, OWASP aims to enhance software security, particularly web applications, through unbiased and practical information.
• 🤝 The project is community-driven, with volunteers contributing to open source software projects, local chapters, and conferences.
• 📊 The Top 10 risks list is compiled using data from a GitHub repository, surveys, and community feedback.
• 🚀 As of the 2021 update, 'Broken Access Control' has become the top web application security risk, highlighting the importance of authorization safeguards.
• 🔐 'Cryptographic Failures', formerly 'Sensitive Data Exposure', is now the second most critical risk, emphasizing the need for robust cryptographic practices.
• 💡 'Injection', once the top vulnerability, is now third, showing that efforts to mitigate this risk have been somewhat successful.
• 🛠️ 'Insecure Design' is a new category in the 2021 list, urging developers to integrate security patterns and principles by design.
• 🔄 'Vulnerable and Outdated Components' is a challenge due to the high volume of new vulnerabilities discovered annually.
• 🔒 'Identification and Authentication Failures' has dropped in ranking, indicating that standardized frameworks like MFA are positively influencing security.
• 📈 'Server-side Request Forgery', a new addition, reflects the community's recognition of this risk despite it not being heavily represented in data.
• 📋 The OWASP Top 10 serves as a baseline for compliance, education, and tool development, and is a minimum reference for secure coding and security testing.

Q & A

What is the OWASP Top 10 and its purpose?

The OWASP Top 10 is an international security standard developed by the Open Web Application Security Project (OWASP) to represent a consensus about the most critical web application security risks. It aims to raise awareness and provide unbiased, practical, and cost-effective information about application security.

How was the OWASP Top 10 list compiled for the 2021 release?

The 2021 OWASP Top 10 list was compiled using data from open source software projects, local chapters, members, and training conferences. After a data call, industry contributors were encouraged to participate in a survey. The collected data was analyzed in a GitHub repository, and a draft list was created based on the findings. This draft was then publicly released and edited with community input on GitHub until a consensus was reached.

What is the significance of the change in the ranking of 'Broken Access Control' in the 2021 OWASP Top 10 list?

The change in ranking of 'Broken Access Control' to the top spot in the 2021 list signifies its importance as it allows attackers to bypass authorization safeguards and perform tasks as if they were privileged users, potentially leading to exposure, modification, or destruction of data, and other network functions.

What does 'Cryptographic Failures' in the OWASP Top 10 list refer to?

'Cryptographic Failures' refers to the exploitation of failures related to cryptography, which can compromise information transferred over secure communication. This can provide attackers with useful information for maintaining persistent access after exploitation.

How has the category 'Injection' evolved in the OWASP Top 10 list?

The category 'Injection' has evolved from being previously known as 'Cross-site Scripting' and has slid down to number three in the list. It exploits vulnerable computer programs by introducing code that changes program execution, potentially allowing attackers to steal authentication cookies or trick services into impersonating users.

What is the new category 'Insecure Design' in the OWASP Top 10 list, and why was it included?

'Insecure Design' is a new category for the 2021 OWASP Top 10 list. It calls for developers to include more security patterns and principles by design, especially considering the risks associated with including new applications into network infrastructures, such as the supply chain attack on SolarWinds.

What does 'Security Misconfiguration' mean in the context of the OWASP Top 10 list?

'Security Misconfiguration' refers to the failure to implement all security controls for a server or web application, or implementing them with errors. It often results from human errors such as misinterpreting system implementations, not changing default credentials, or a lack of computer skills.

How does 'Vulnerable and Outdated Components' pose a risk in the OWASP Top 10 list?

'Vulnerable and Outdated Components' include operating systems, servers, database management systems, APIs, and libraries that are vulnerable, unsupported, or out of date. An adversary only needs to find one such component to compromise a system, making it a significant risk given the high number of new vulnerabilities discovered each year.

What is the significance of the change in the category 'Identification and Authentication Failures' in the OWASP Top 10 list?

The change in the category from 'Broken Authentication' to 'Identification and Authentication Failures' at a lower position indicates that standardized frameworks like Multi-Factor Authentication (MFA) are helping to mitigate the risk of compromised user identities.

What does 'Software and Data Integrity Failures' focus on in the OWASP Top 10 list?

'Software and Data Integrity Failures' focuses on software updates, critical data, CI/CD pipelines, and includes Insecure Deserialization. It relates to code and infrastructure that does not protect against integrity violations, such as when an application relies on plugins from untrusted sources, potentially giving attackers access to the application.

How does 'Security Logging and Monitoring Failures' impact an organization according to the OWASP Top 10 list?

'Security Logging and Monitoring Failures' can seriously impact visibility and forensics within an organization. Despite being difficult to test due to a lack of representation in CVE/CSS data, it is crucial for detecting and responding to security incidents effectively.

What is 'Server-side Request Forgery' and its significance in the OWASP Top 10 list?

'Server-side Request Forgery' is a type of exploit where an attacker abuses server functionality to access or manipulate information that would otherwise not be directly accessible. Its addition to the list, based on community survey feedback, indicates that it is a significant risk, even if not always illustrated in the data collected.

Outlines

00:00

🔒 Introduction to OWASP Top 10

This paragraph introduces the OWASP Top 10, an international security standard developed by the Open Web Application Security Project (OWASP) since 2003. It highlights the purpose of OWASP, which is to enhance the security of software, particularly web applications, through unbiased, practical, and cost-effective information. The paragraph also discusses the collaborative nature of OWASP, involving volunteers, local chapters, and industry contributors. The process of compiling the Top 10 risks is explained, including data collection, analysis, and public consensus. The 2021 update is mentioned, with changes in category order and introduction of new categories, emphasizing the evolving nature of cybersecurity threats.

05:01

🛠️ Analysis of the 2021 OWASP Top 10 Risks

This paragraph delves into the specifics of the 2021 OWASP Top 10 list, providing insights into the changes and the reasons behind them. It starts by discussing the rise of 'Broken Access Control' to the top spot, highlighting its significance in allowing attackers to perform unauthorized actions. The paragraph then covers 'Cryptographic Failures', emphasizing the importance of secure data transfer. 'Injection' risks are explained, detailing how attackers can exploit vulnerabilities to steal sensitive information. 'Insecure Design' is introduced as a new category, urging developers to consider security by design. 'Security Misconfiguration' is discussed, noting its prevalence due to highly configurable software. The paragraph also touches on 'Vulnerable and Outdated Components', the challenges of maintaining up-to-date systems, and the impact of supply chain attacks. The paragraph concludes by mentioning the other categories in the list, such as 'Identification and Authentication Failures', 'Software and Data Integrity Failures', 'Security Logging and Monitoring Failures', and 'Server-side Request Forgery', and how they reflect the current cybersecurity landscape.

Keywords

💡OWASP Top 10

The OWASP Top 10 is an international security standard that outlines the most critical web application security risks. It is a consensus-based document developed by the Open Web Application Security Project (OWASP), a non-profit organization dedicated to improving software security. The list is updated periodically, with the latest version released in 2021, to reflect the evolving landscape of cyber threats. The video script discusses the importance of understanding and using the OWASP Top 10 to mitigate the risks of cyberattacks, even for organizations that are already employing security measures.

💡Cybersecurity

Cybersecurity refers to the practice of protecting systems, networks, and programs from digital attacks. It encompasses a range of security aspects, from hardware to software, and includes measures to prevent, detect, and respond to security breaches. In the context of the video, cybersecurity is crucial for organizations to safeguard their web applications against the risks highlighted in the OWASP Top 10, ensuring the integrity, confidentiality, and availability of their digital assets.

💡Broken Access Control

Broken Access Control is a security risk that occurs when an application fails to properly enforce authorization checks, allowing unauthorized users to perform actions they should not have access to. This can lead to sensitive data exposure, data tampering, and other malicious activities. In the 2021 OWASP Top 10 list, Broken Access Control has taken the top spot, indicating its significant impact on web application security.

💡Cryptographic Failures

Cryptographic Failures refer to the weaknesses or flaws in the implementation of cryptographic protocols or algorithms, which can lead to the compromise of sensitive information. This category, previously known as Sensitive Data Exposure, has been refocused by OWASP to emphasize the importance of secure data handling and communication. Cryptographic failures can result in attackers gaining access to encrypted data or intercepting secure communications.

💡Injection

Injection is a type of attack where malicious code is inserted into a vulnerable system, altering its behavior and potentially leading to unauthorized access or data theft. In the context of the OWASP Top 10, it refers to vulnerabilities like Cross-site Scripting (XSS) and SQL Injection, where attackers can manipulate web applications to execute malicious scripts or commands. Injection has been a persistent threat and is ranked third in the 2021 list, highlighting its ongoing significance in web application security.

💡Insecure Design

Insecure Design is a new category in the 2021 OWASP Top 10 that emphasizes the need for developers to incorporate security patterns and principles from the outset of software development. It highlights the risks associated with including new applications in network infrastructure without proper security considerations, especially in the context of supply chain attacks like the one on SolarWinds.

💡Security Misconfiguration

Security Misconfiguration refers to the failure to implement or incorrectly configure security controls for servers or web applications. This can result from human errors such as misinterpreting system implementations, not changing default credentials, or a lack of computer skills. The 2021 OWASP Top 10 list notes that Security Misconfiguration was present in 90% of the applications tested, indicating its widespread nature and the need for better security practices.

💡Vulnerable and Outdated Components

Vulnerable and Outdated Components is a category in the OWASP Top 10 that addresses the risks associated with using outdated or unsupported software components, including operating systems, servers, databases, APIs, and libraries. These components may contain known vulnerabilities that can be exploited by adversaries, making it critical to keep software up-to-date and secure. The category is challenging to test but is ranked highly due to community survey feedback.

💡Broken Authentication

Broken Authentication, now renamed to Identification and Authentication Failures in the 2021 OWASP Top 10, refers to the security risks associated with the compromise of authentication mechanisms, such as passwords, keys, session tokens, and user account information. This can allow attackers to assume user identities and gain unauthorized access to systems. The renaming and the shift in ranking indicate a positive trend towards the adoption of standardized frameworks like Multi-Factor Authentication (MFA), which help secure authentication processes.

💡Software and Data Integrity Failures

Software and Data Integrity Failures is a new category in the 2021 OWASP Top 10 that focuses on the protection of software updates, critical data, and CI/CD pipelines against integrity violations. It includes the risk of insecure deserialization, which was part of the 2017 list, and relates to code and infrastructure that do not adequately safeguard against unauthorized changes or tampering. This category emphasizes the need for robust security measures to maintain the integrity of applications and data.

💡Security Logging and Monitoring Failures

Security Logging and Monitoring Failures refer to the不足 in implementing effective logging and monitoring mechanisms within an IT environment. These failures can hinder visibility into system activities and impede forensic investigations in the event of a security breach. Despite the challenges in testing for this category due to underrepresentation in CVE/CSS data, its inclusion at number nine in the 2021 OWASP Top 10 list underscores the community's recognition of its significance in maintaining cybersecurity.

💡Server-side Request Forgery

Server-side Request Forgery (SSRF) is a type of exploit where an attacker manipulates a server into making requests to internal systems or external resources on behalf of the attacker. This can lead to unauthorized access, data leakage, or other malicious activities. The addition of SSRF to the OWASP Top 10 list at number 10, based on its high ranking in the community survey, indicates the security community's strong concern about this risk, even though it may not be as frequently illustrated in the data collected.

Highlights

The OWASP Top 10 is an international security standard used globally to address web application security risks.

Despite using OWASP, organizations still fall victim to cyberattacks, indicating the complexity and evolving nature of cybersecurity threats.

OWASP, or the Open Web Application Security Project, was initiated in 2003 to enhance software security, especially web applications.

The OWASP Top 10 is a consensus-driven document that outlines the most critical web application security risks.

OWASP operates without commercial influence, maintaining its commitment to providing unbiased, practical, and cost-effective application security information.

The Top 10 risks are compiled through a community effort involving open source software projects, local chapters, members, and conferences.

Data for the OWASP Top 10 is managed in a GitHub repository, incorporating contributions from industry survey participants.

The 2021 update to the OWASP Top 10 introduced changes in category order, names, and included new categories.

Broken Access Control, which allows attackers to bypass authorization, has become the top web application security risk.

Cryptographic Failures, formerly Sensitive Data Exposure, moved to the second position, emphasizing the importance of secure data transfer.

Injection,下滑至第三位, is a method used by attackers to manipulate program execution, such as stealing authentication cookies.

Insecure Design is a new category for 2021, urging developers to integrate security patterns and principles by design.

Security Misconfiguration, now at number five, reflects the challenges in implementing security controls correctly for software.

Vulnerable and Outdated Components, rising to the sixth position, highlights the risks of using outdated or unsupported software components.

Broken Authentication, now termed Identification and Authentication Failures at number seven, has seen improvement due to standardized frameworks like MFA.

Software and Data Integrity Failures, a new category at number eight, addresses the protection of software updates and critical data integrity.

Security Logging and Monitoring Failures, at number nine, underscores the importance of visibility and forensic capabilities in security.

Server-side Request Forgery, new at number ten, indicates the community's recognition of this exploit as a significant risk.

The OWASP Top 10 serves as a baseline for compliance, education, and vendor tools, and is the minimum reference for secure coding practices.

Transcripts

The OWASP Top 10 has developed into  an international security standard  

used by organizations across the globe.  But even organizations that use OWASP  

still end up as victims of cyberattack. So what  is the OWASP Top 10 and how should you be using it?

What do you need to know so it becomes your friend?

OWASP, or the Open Web Application Security  Project, was launched in 2003 to improve the  

security of software, notably web applications.  The OWASP Top 10 is a standard awareness document  

that represents a broad consensus about the  most critical security risks to web applications.  

Nearly all involved with OWASP are volunteers  and it is not affiliated with any technology  

company. This lack of commercial pressure  cements OWASP's claim of "unbiased, practical  

and cost-effective information about  application security." Or does it?

OWASP uses a community of  open source software projects,  

hundreds of local chapters worldwide, tens of  thousands of members and training conferences  

to compile their list of Top 10 risks. Data and  documentation is fed into a GitHub repository  

managed by OWASP after the Top 10 core team  release a data call. Industry contributors are  

also encouraged to participate in a survey. Once  the data is collected in GitHub, it is normalized  

and analyzed. Surveys are collected and reviewed. A  draft Top 10 list is then made using eight risks  

taken from the data and two from the survey. The  draft is released publicly and the editing process  

is recorded in GitHub. Once a public consensus  has been reached, the OWASP Top 10 is released.

Last updated in 2017, the new list  released on 24 September 2021  

featured changes in category order, category name  changes as well as some entirely new categories.  

Let's take a look at the 2021 list and explain  what the Top 10 categories actually mean.

Broken Access Control - up from number  five - has taken the top spot in 2021.  

This is an important change as it replaced  injection - largely seen as the most popular  

form of risk exploited by cybercriminals.  Broken Access Control allows attackers to  

bypass authorization safeguards and perform  tasks as if they were privileged users.  

Put simply, broken access control gives an  attacker the ability to expose sensitive data  

modify or destroy data, or perform pretty much any  network function. It is the holy grail of exploits.

Cryptographic Failures - previously called  Sensitive Data Exposure - is in at number two  

from number three. Cryptographic Failures  signifies a renewed focus by OWASP on failures  

related to cryptography. In essence, this category  exploits information transferred over secure  

communication between two parties, which often  provides an attacker with useful information  

in the post-exploitation phase, like  how to maintain persistent access.  

Injection - previously known as Cross-site Scripting  and considered the king of vulnerabilities -  

slid down to number three. Injection exploits  a vulnerable computer program by introducing  

code that changes the way a program executes. For  example, by injecting code into a web application  

an attacker can steal authentication  cookies and use them on other online  

services, tricking these services into  thinking that the attacker is you.

Insecure Design - a new category for the  2021 OWASP Top 10 - is in at number four. It  

was included as a firm call for developers to  include more security patterns and principles  

by design. This is an important consideration  when including a new application into your  

network infrastructure, especially given  the supply chain attack on SolarWinds  

and the effect it had on third-party service providers.

Security Misconfiguration - in at number five,  up from number six - was present in 90%  

of applications tested, not surprising  given the rise in highly configurable software.  

Security Misconfiguration is a failure to  implement all the security controls for a  

server or web application, or implementing  security controls but with errors. Everyone  

makes mistakes and security misconfigurations  occur through a broad range of human errors:  

misinterpreting a system implementation;  not changing default logging credentials;  

a lack of computer skills; or, mistakes  made under time pressure, for example.

Vulnerable and Outdated Components -  previously known as Using Components  

with Known Vulnerabilities - is up at number  six, from number nine. By OWASP's own admission,  

this category is difficult to test, but  featured highly in the community survey  

therefore contributing to its recent rank.  Vulnerable and Outdated Components includes  

operating systems, web or application  servers, database management systems,  

apis, and all components runtime environments  and libraries that are vulnerable,  

unsupported, or out of date. An adversary only  needs to find one vulnerable component to  

compromise a system. The problem is approximately  18,000 new vulnerabilities are found  

each year, so protecting against known  vulnerabilities is an ongoing process.

A new name given to Broken Authentication,  Identification and Authentication Failures  

comes in at number seven, down from number two - a  good sign that standardized frameworks are helping.  

broken authentication referred to the compromise of passwords,  

keys, session tokens, user account information  and other details to assume user identities.  

The new position of Identification and  Authentication Failures shows that procedures  

like MFA are integral in authenticating key  information, like usernames and passwords.

Another new category, Software and Data Integrity  Failures comes in at number eight, focusing on  

software updates, critical data, CI/CD pipelines  and includes Insecure Desterilization from 2017.  

This new category relates to code and  infrastructure that does not protect against  

integrity violations. An example of this is where  an application, like Wordpress, relies on plugins  

from untrusted sources one compromise plugin  can give an attacker access to your application.

Previously categorized as Insufficient  Logging and Monitoring, Security Logging  

and Monitoring Failures comes in at number nine,

up from number 10. Although admittedly hard to  test for due to a lack of representation in CVE/CSS data,

Security Logging and Monitoring Failures  can seriously impact visibility and forensics.

Lastly, at number 10, Server-side Request Forgery  is another new addition due to its position as  

number one in the community survey, indicating  strong feedback from the security community  

that it is an important risk but not illustrated  in the data collected. Server-side Request Forgery  

is a type of exploit where an attacker abuses the  functionality of a server causing it to access or  

manipulate information that would otherwise  not be directly accessible to the attacker.

The OWASP Top 10 is the go-to listing for anyone  concerned with raising their awareness of top  

risks. The addition of survey considerations  as well as pure statistical data means that  

OWASP does not solely rely on data collected by  automated tests. Where possible, the categories  

are ranked given three main considerations  exploitability likelihood and technical impact.

However, OWASP themselves claim that it is a  baseline - a "pseudo standard" even - for compliance,  

education and vendor tools. As an awareness  document, it is regarded as the bare minimum  

reference for standards of coding, code reviews,  peer reviews, tool support and penetration testing.  

Being focused on AppSec means that many of the Top  10 findings cannot be easily tested for in-house.  

Being a voluntary service means that participants  releasing information publicly do so theoretically,  

without the experience of a real world attack. If  you're keen to hear more about OWASP's Top 10 list, 

keep an eye out for our next video which compares  OWASP's findings with our own list of Top 10 risks.  

The risk is real. Defend with Cyber Citadel.