Understanding the OWASP Top 10: Key Web Application Security Risks for 2021
Explore the OWASP Top 10 for 2021, highlighting critical web application security risks identified by John Wagner from Dev Central. Learn about the new categories and data-driven insights.
Video Summary
In a recent video, John Wagner from Dev Central unveiled an exciting new series focused on the OWASP Top 10, a critical list that outlines the most pressing web application security risks for the year 2021. The Open Web Application Security Project (OWASP) is known for releasing this influential list approximately every three to four years, with the last update having occurred in 2017. It is important to note that the OWASP Top 10 serves primarily as an awareness document rather than a strict security standard. Organizations are encouraged to refer to the Application Security Verification Standard (ASVS) for more verifiable security benchmarks.
The 2021 iteration of the OWASP Top 10 is notably more data-driven compared to its predecessors. This updated list comprises eight categories derived from extensive data collected from various organizations, alongside two categories that emerged from surveys. The OWASP has significantly expanded its data collection efforts, increasing the number of Common Weakness Enumerations (CWEs) analyzed from around 30 in 2017 to nearly 400 in 2021. This shift reflects a focused effort on identifying the root causes of security issues, with data sourced from over 500,000 applications, marking it as the most comprehensive dataset that OWASP has ever analyzed.
The methodology employed in this analysis includes a thorough assessment of both the exploitability and the potential impact of various security risks. The final list for 2021 introduces three new categories, modifies the names of four existing categories, and consolidates some elements from the previous list. The ten categories that comprise the 2021 OWASP Top 10 are as follows: 1) Broken Access Control, 2) Cryptographic Failures, 3) Injection, 4) Insecure Design, 5) Security Misconfiguration, 6) Vulnerable and Outdated Components, 7) Identification and Authentication Failures, 8) Software and Data Integrity Failures, 9) Security Logging and Monitoring Failures, and 10) Server-Side Request Forgery (SSRF).
Looking ahead, viewers can anticipate a series of upcoming videos that will delve deeper into each of these categories, providing valuable insights and guidance on how to address these critical security risks effectively.
Click on any timestamp in the keypoints section to jump directly to that moment in the video. Enhance your viewing experience with seamless navigation. Enjoy!
Keypoints
00:00:08
Introduction to OWASP
John Wagner introduces a new video series on the OWASP Top 10, which is the Open Web Application Security Project's list of the most critical security risks for 2021. This list is updated approximately every three to four years, with the last update occurring in 2017.
Keypoint ads
00:01:04
Purpose of OWASP Top 10
Wagner emphasizes that the OWASP Top 10 serves primarily as an awareness document rather than a strict security standard. He advises organizations to use it as a guideline while noting that their specific security concerns may differ. For a more rigorous security standard, he recommends the Application Security Verification Standard (ASVS), also provided by OWASP.
Keypoint ads
00:02:10
Methodology of OWASP Top 10
In discussing the methodology behind the 2021 OWASP Top 10, Wagner notes that this version is more data-driven than previous iterations, with eight of the ten categories based on data collected from various organizations and two derived from surveys. This approach marks a shift from past methods where a fixed set of approximately 30 Common Weakness Enumerations (CWEs) was used.
Keypoint ads
00:03:24
Common Weakness Enumeration (CWE)
Wagner explains that the CWE, managed by the MITRE organization, is a community-developed list of software and hardware weakness types. In previous iterations, OWASP would solicit feedback on a prescribed set of CWEs, but for the 2021 version, they opened the data collection process to allow for a broader range of CWEs to be considered, reflecting a more comprehensive view of application security risks.
Keypoint ads
00:04:36
CWE Growth
The number of Common Weakness Enumerations (CWEs) increased significantly from about 30 to nearly 400 in the 2021 version, indicating a substantial expansion in the scope of vulnerabilities that need to be analyzed.
Keypoint ads
00:04:57
Root Cause vs. Symptoms
The discussion distinguishes between root cause CWEs, such as cryptographic failures and security misconfigurations, and symptom CWEs, like sensitive data exposure and denial of service issues. OWASP aimed to focus on identifying and addressing root causes whenever possible.
Keypoint ads
00:05:36
Data Collection
OWASP published a call for data and received contributions from various organizations involved in security testing, including bug bounty vendors. This collaboration resulted in a comprehensive dataset encompassing over 500,000 applications, marking it as the largest application security dataset OWASP has ever analyzed.
Keypoint ads
00:06:20
Analysis Process
In generating the top ten list, OWASP analyzed the collected data by examining the exploitability of security risks and their potential impacts. This involved assessing how easily vulnerabilities could be exploited and the technical consequences of these security risks.
Keypoint ads
00:07:11
Top Ten Changes
The 2021 OWASP Top Ten list introduced three new categories compared to the 2017 version, along with four categories that underwent naming and scoping changes. Additionally, some categories from the 2017 list were consolidated in the 2021 update.
Keypoint ads
00:07:49
Top Ten List
The top ten vulnerabilities identified in the 2021 OWASP list are: 1) Broken Access Control, 2) Cryptographic Failures, 3) Injection, 4) Insecure Design, 5) Security Misconfiguration, 6) Vulnerable and Outdated Components, 7) Identification and Authentication Failures, 8) Software and Data Integrity Failures, 9) Security Logging and Monitoring Failures, and 10) Server-Side Request Forgery (SSRF).
Keypoint ads