What Is the OWASP Top 10? A Web Application Security Guide (2021)
The OWASP Top 10 is a free international reference listing the ten highest risk vulnerability categories in web applications. The full 2021 list, each category explained and defended, why Broken Access Control is first, how to use the OWASP Top 10 and its relationship with compliance standards.
Quick answer: The OWASP Top 10 is a free, internationally recognized reference listing the ten most common and highest risk security vulnerability categories in web applications. It is updated every few years based on real world data by the Open Worldwide Application Security Project (OWASP). The most current version is 2021, topped by Broken Access Control. The OWASP Top 10 is not a checklist but an awareness document: it does not prove an application is secure, but it shows an application cannot be secure without closing these ten categories. It is also the core framework for penetration test scope and secure development training.
When web application security comes up, the answer almost always starts with the OWASP Top 10. The reason is simple: in the real world, the vast majority of ways applications get compromised fall into these ten categories. This article covers the OWASP Top 10 2021 list, what each category is and how to close it.
What the OWASP Top 10 is and is not
OWASP is a non profit community producing free tools, guides and standards in application security. The Top 10 is its best known output.
An important distinction: the OWASP Top 10 is not a compliance standard. You cannot say "we passed the Top 10, our application is secure." The list shows the most common risk categories. Even an application that closes all ten may contain other flaws. Conversely, leaving even one of the Top 10 categories open means serious risk. So the Top 10 is a floor, not a ceiling.
The list is updated every few years because the threat landscape changes. The 2021 version was built from data collected from real applications and a community survey.
The OWASP Top 10 (2021)
| Rank | Category | In brief |
|---|---|---|
| A01 | Broken Access Control | A user reaching data or functions they are not authorized for |
| A02 | Cryptographic Failures | Weak or missing encryption, exposed sensitive data |
| A03 | Injection | SQL, command, LDAP injection; XSS falls here too |
| A04 | Insecure Design | Security gaps at the design stage |
| A05 | Security Misconfiguration | Default settings, verbose errors, unnecessary services |
| A06 | Vulnerable and Outdated Components | Unpatched libraries and dependencies |
| A07 | Identification and Authentication Failures | Weak session and authentication |
| A08 | Software and Data Integrity Failures | Unverified updates and supply chain |
| A09 | Security Logging and Monitoring Failures | Insufficient logging and monitoring |
| A10 | Server Side Request Forgery (SSRF) | The server tricked into requesting internal resources |
The categories explained and defended
A01 Broken Access Control
It rose to first place in 2021 as the most common and most impactful flaw. If a user can reach someone else's data by changing an ID in the URL (IDOR), or a normal user can call admin functions, access control is broken. Defense: re authorize every request server side, never leave decisions to the client, and apply deny by default. This is the application level equivalent of the Zero Trust architecture approach.
A02 Cryptographic Failures
Storing or transmitting sensitive data unencrypted, using weak algorithms, hardcoded keys. Defense: current TLS everywhere, encrypting sensitive data with strong modern algorithms, separating keys from code and using a secret management system.
A03 Injection
User input mixing directly into a query or command. The best known is SQL injection, see our article on what SQL injection is and how to prevent it. Cross Site Scripting (XSS) falls here too, covered in a separate article. Defense: parameterized queries, input validation and output encoding.
A04 Insecure Design
A flaw in the design, not the code. Business logic flaws, missing rate limiting, abusable flows belong here. Defense: threat modeling at the design stage, secure design patterns and thinking through abuse scenarios in advance.
A05 Security Misconfiguration
Default passwords, open directory listing, verbose error messages, unnecessary open ports. Defense: hardening standards, closing everything unnecessary, automated configuration auditing.
A06 Vulnerable and Outdated Components
A known flaw in a library the application uses. Most modern applications are largely third party code. Defense: a dependency inventory (SBOM), continuous vulnerability scanning and regular updates. For the supply chain dimension see our article on supply chain security.
A07 Identification and Authentication Failures
Weak password policy, login open to brute force, poor session management. Defense: multi factor authentication, phishing resistant methods and secure session management. See our article on passkeys and MFA bypass.
A08 Software and Data Integrity Failures
Unverified updates, insecure deserialization, a tampered supply chain. Defense: signed updates, integrity verification and trusted source control.
A09 Security Logging and Monitoring Failures
Failing to notice an attack usually stems not from a code flaw but from missing logging and monitoring. Defense: centralized logging, meaningful event generation and real time monitoring. This is the foundation of building a SIEM and SOC.
A10 Server Side Request Forgery (SSRF)
An attacker tricking the server into requesting resources on the internal network or a cloud metadata service. A serious escalation path in cloud environments. Defense: validating outbound requests, restricting access to internal addresses and an allow list approach.
How to use the OWASP Top 10
- Developer training. The team must recognize each category at code level. Awareness is the first step of secure code.
- Penetration test scope. An authorized penetration test begins by targeting these ten categories. See our article on the penetration test process and scope.
- Code review and automated scanning. Static and dynamic analysis tools should be tuned to look for these categories.
- Acceptance criteria. A new feature should pass the relevant Top 10 controls before release.
OWASP also publishes a list specific to APIs. If your application is API heavy, the OWASP API Security Top 10 should be studied separately.
Frequently asked questions
Is an application that passes the OWASP Top 10 secure? No. The Top 10 shows the most common risks, it does not guarantee full security. It is a floor, and other flaws may exist.
How often is the OWASP Top 10 updated? Every few years. The most current version is 2021, with a new version being developed by the community.
Is OWASP free? Yes. OWASP is non profit and all its documents, including the Top 10, are free.
Why is XSS not a separate item? In the 2021 version XSS is assessed under Injection (A03). It still has its own defense techniques.
Does a small site need the OWASP Top 10? Yes. Attacks are mostly automated and do not care about site size. The traps small sites fall into most are on this list.
Is there a relationship between the OWASP Top 10 and compliance standards? It is not a compliance standard directly, but it largely overlaps with the application security expectations of frameworks such as ISO 27001, PCI DSS and NIS2.
Sources
- OWASP Top 10 official page: https://owasp.org/www-project-top-ten/
- OWASP API Security Top 10: https://owasp.org/API-Security/
- OWASP Application Security Verification Standard (ASVS): https://owasp.org/www-project-application-security-verification-standard/
- MITRE CWE, common weakness enumeration: https://cwe.mitre.org
- NIST Secure Software Development Framework: https://csrc.nist.gov/projects/ssdf
To measure whether your application is genuinely resilient against the OWASP Top 10, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide penetration testing, secure code review and developer training.
Kimliğinizi doğrulayın
Yetkilendirilmiş erişim alanı. Tüm giriş denemeleri kayıt altına alınır.