Table of Contents
What is OWASP Top 10?
The Open Web Application Security Project (OWASP) is a worldwide not-for-profit organization focused on improving the security of software. The OWASP Top Ten is a listing of the top ten risk categories for web applications security.
OWASP is in a unique position to provide impartial, practical information about web application security to individuals, corporations, universities, government agencies, and other organizations worldwide. The OWASP Top Ten provides as a way to clarify and communicate the types of security risks faced by many web applications. This has helped shift the web application security conversation to focus on common risk areas.
The OWASP Top Ten is a major industry component, cited by other standards, such as PCI-DSS, DISA STIG, and MITRE. The OWASP list is based on observations from many security professionals across many companies discussing the types of attack and defense techniques most relevant to in web applications. In-depth analytics on telemetry data shared from real-world web applications also is used in the formulation of the OWASP Top Ten. The list is updated approximately every three years when new vulnerabilities can be added, consolidated, or removed.
Since the OWASP Top Ten first launched in 2003, organizations rely on OWASP to assess the completeness of their web application security efforts—and implications for compliance and risk management.
How important is OWASP Top 10?
Anyone developing apps should adopt the OWASP Top 10 to ensure their apps minimize the listed risks. With the OWASP Top 10 you can ensure your code will be more secure.
Who contributes to OWASP Top 10 data?
Verified data contribution where the submitted is identified is preferred by the OWASP Top 10 but if unverified data is contributed, OWASP Top 10 will analyze the data with a careful distinction.
What are the current OWASP Top 10 categories?
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery
