Kernel of Truth

Top 10 OWASP

🔟 OWASP Top 10: The Most Critical Web Application Security Risks

The OWASP Top 10 is a standard awareness document that outlines the most critical security risks to web applications. Maintained by the Open Worldwide Application Security Project (OWASP), it is widely used by developers, architects, and security professionals to guide secure software development.

The list is updated periodically based on data from vulnerability scanners, exploit reports, and industry experts.

🧱 The 2021 OWASP Top 10 List (Latest Edition)

1. Broken Access Control (A01:2021)

Description: Failures in enforcing policies restricting what authenticated users can do. This leads to privilege escalation, data exposure, and unauthorised function access.

Examples:

  • Bypassing ID checks in URLs
  • Force-browsing to admin pages
  • Modifying JWTs to escalate privileges

Detection Tips: Log 403s and 401s, test APIs for IDOR, and inspect URL paths.

Mitigation:

  • Use deny-by-default logic
  • Centralise access control checks
  • Automated security testing

References: OWASP A01

2. Cryptographic Failures (A02:2021)

Description: Failures in data encryption, insecure transmission, or poor algorithm/key management.

Examples:

  • Passwords stored in plain text
  • Using TLS 1.0 or self-signed certs
  • Hardcoded cryptographic keys

Detection Tips: Use automated scanners to identify plaintext storage and TLS issues.

Mitigation:

  • Enforce TLS 1.2+
  • Use modern algorithms like AES-256
  • Rotate and protect encryption keys

References: OWASP A02

3. Injection (A03:2021)

Description: Unsanitised input leads to execution of unintended commands or queries.

Examples:

  • SQL Injection: ' OR 1=1--
  • Command injection in OS calls
  • LDAP or XPath injection

Detection Tips: Use input fuzzing, static analysis tools, and database monitoring.

Mitigation:

  • Use parameterised queries
  • Escape input correctly
  • Whitelist input wherever possible

References: OWASP A03

4. Insecure Design (A04:2021)

Description: Flawed architecture or security missteps at the design level.

Examples:

  • No rate limiting on login forms
  • Missing threat modelling practices
  • Relying solely on client-side validation

Mitigation:

  • Use secure SDLC practices
  • Implement threat modelling (e.g. STRIDE)
  • Perform design reviews and abuse-case testing

References: OWASP A04

5. Security Misconfiguration (A05:2021)

Description: Insecure default settings, incomplete configurations, or unnecessary services.

Examples:

  • Default admin accounts enabled
  • Verbose error messages in production
  • Open S3 buckets or exposed Docker APIs

Mitigation:

  • Automate secure configurations
  • Harden deployments with security baselines
  • Disable debugging and stack traces

References: OWASP A05

6. Vulnerable and Outdated Components (A06:2021)

Description: Use of libraries, plugins, or frameworks with known flaws.

Examples:

  • jQuery or Log4j with unpatched CVEs
  • WordPress plugins with known RCE issues
  • Old versions of Java, PHP, or Python

Mitigation:

  • Maintain an SBOM
  • Use dependency scanners like Snyk, OWASP DC
  • Track CVEs and update regularly

References: OWASP A06

7. Identification and Authentication Failures (A07:2021)

Description: Broken login flows or improper session handling allow attackers to compromise identities.

Examples:

  • Brute-force login with no rate limiting
  • Session IDs not rotated after login
  • No MFA on critical systems

Mitigation:

  • Use MFA and strong password policies
  • Enforce session timeouts and reauthentication
  • Implement account lockouts

References: OWASP A07

8. Software and Data Integrity Failures (A08:2021)

Description: Lack of trust controls on software updates, libraries, or critical data.

Examples:

  • CI/CD pipeline pulls from unverified sources
  • Unsigned or tampered updates
  • Malicious packages published to open repositories

Mitigation:

  • Use signed packages and checksums
  • Secure your build pipeline (code signing, hashes)
  • Implement source validation for code and data

References: OWASP A08

9. Security Logging and Monitoring Failures (A09:2021)

Description: Inadequate logging and detection leaves attacks unnoticed and uninvestigated.

Examples:

  • No alerting for repeated login failures
  • Missing logs for sensitive operations
  • No visibility into audit trails

Mitigation:

  • Use centralised logging (e.g. SIEM)
  • Log authentication, privilege, and data access events
  • Correlate events with threat intelligence

References: OWASP A09

10. Server-Side Request Forgery (SSRF) (A10:2021)

Description: A vulnerable server is tricked into sending requests to unintended internal resources.

Examples:

  • URL parameters allow requests to localhost or metadata endpoints
  • Internal APIs exposed via proxy functions

Mitigation:

  • Block internal address ranges from external input
  • Use allowlists for outbound requests
  • Audit and limit external calls made by the server

References: OWASP A10

1. Broken Access Control (A01:2021)

What it is:
Attackers gain access to data or functions they shouldn’t—like viewing other users’ accounts or changing permissions.

Example:
URL tampering to access admin functions.

Mitigation:
Enforce role-based access controls (RBAC), deny-by-default policies, and test access controls extensively.

2. Cryptographic Failures (A02:2021)

What it is:
Weak or missing encryption, poor key management, or insecure transport layers.

Example:
Transmitting passwords in plain text or weak TLS configuration.

Mitigation:
Use strong algorithms (AES, SHA-256+), HTTPS, HSTS, and secure key storage.

3. Injection (A03:2021)

What it is:
Untrusted data is sent to an interpreter (e.g. SQL, NoSQL, OS shell) and executed.

Example:
Classic SQL injection like OR 1=1.

Mitigation:
Use parameterised queries, input validation, and ORM frameworks.

4. Insecure Design (A04:2021)

What it is:
System lacks secure architecture or threat modelling from the outset.

Example:
No rate limiting on login attempts, enabling brute force.

Mitigation:
Apply secure design patterns, threat modelling, and attack surface reduction early.

5. Security Misconfiguration (A05:2021)

What it is:
Default settings, verbose error messages, open ports, or unused features left enabled.

Example:
Exposing stack traces or running debug mode in production.

Mitigation:
Harden configurations, review defaults, and apply secure baselines regularly.

6. Vulnerable and Outdated Components (A06:2021)

What it is:
Using components (libraries, frameworks) with known vulnerabilities.

Example:
Using a web framework with an unpatched CVE.

Mitigation:
Maintain SBOMs (software bill of materials), scan dependencies, and patch regularly.

7. Identification and Authentication Failures (A07:2021)

What it is:
Improper handling of identity and session data.

Example:
Session fixation, weak password policies, or no MFA.

Mitigation:
Implement MFA, secure session tokens, and enforce strong credential policies.

8. Software and Data Integrity Failures (A08:2021)

What it is:
Lack of integrity verification for software updates or critical data.

Example:
CI/CD pipeline pulls code from an untrusted source.

Mitigation:
Use signed packages, secure your build processes, and enforce source validation.

9. Security Logging and Monitoring Failures (A09:2021)

What it is:
Failure to detect, log, or respond to suspicious behaviour.

Example:
No logging of failed login attempts or unauthorised API calls.

Mitigation:
Log critical events, centralise logs (e.g. SIEM), and enable alerting on anomalies.

10. Server-Side Request Forgery (SSRF) (A10:2021)

What it is:
The server fetches a remote resource based on untrusted input.

Example:
An attacker tricks a server into accessing internal services via crafted URLs.

Mitigation:
Sanitise and validate URLs, block internal IP ranges, and implement network-layer controls.

🛡️ Why the OWASP Top 10 Matters

  • 📌 Helps prioritise high-impact vulnerabilities
  • 🧰 Guides secure coding practices and threat modelling
  • 📋 Used in audits, compliance (e.g. PCI), and secure SDLC pipelines
  • 🧪 Supports proactive testing (DAST, SAST, penetration testing)

🧠 “You can’t fix what you don’t know. The OWASP Top 10 is your cybersecurity checklist for the web.”