2021 OWASP Top 10 Lightboard Lesson Video Series
Protect Your Web Apps from New and Critical Risks
The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The 2021 update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.
Watch the 2021 OWASP Top 10 Lightboard Lesson series on F5 DevCentral for a breakdown of the new OWASP Top 10 and learn:
- How OWASP creates its Top 10 list of the most critical security risks to web applications.
- Key changes for 2021, including recategorization of risk to align symptoms to root causes.
- When each risk can manifest, why it matters, and how to improve your security posture.
The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.
OWASP Top 10 Overview
John starts out explaining what the OWASP Top 10 is. He highlights themes like risk re-orientation around symptoms and root causes, new risk categories, and modern application architectures. Follow along for a video on each of the Top 10 risks.
2021 OWASP Top 10: Broken Access Control
94% of tested apps showed some form of broken access control. Failures can result in unauthorized disclosure, modification or destruction of data, and privilege escalation—and lead to account takeover (ATO), data breach, fines, and brand damage.
2021 OWASP Top 10: Cryptographic Failures
Cryptographic failures, previously known as "Sensitive Data Exposure", lead to sensitive data exposure and hijacked user sessions. Despite widespread TLS 1.3 adoption, old and vulnerable protocols are still being enabled.
2021 OWASP Top 10: Injection
Injection is a broad class of attack vectors where untrusted input alters app program execution. This can lead to data theft, loss of data integrity, denial of service, and full system compromise. Injection is no longer the top risk, but still formidable.
2021 OWASP Top 10: Insecure Design
Security needs to be inherent to applications. A secure design can still have implementation defects leading to vulnerabilities. An insecure design can’t be fixed by perfect implementation.
2021 OWASP Top 10: Security Misconfiguration
Security Misconfiguration is a major source of cloud breaches. Learn what to do and avoid—as modern app development, software re-use, and architectural sprawl across clouds increases this risk.
2021 OWASP Top 10: Vulnerable and Outdated Components
Open Source software exploits are behind many of the biggest security incidents. The recent Log4j2 vulnerability is perhaps the most serious risk in this category to date.
2021 OWASP Top 10: Identification and Authentication Failures
It is critical to confirm identity and use strong authentication and session management to protect against business logic abuse. Most authentication attacks trace to continued use of passwords. Compromised credentials, botnets, and sophisticated tools provide an attractive ROI for automated attacks like credential stuffing.
2021 OWASP Top 10: Software and Data Integrity Failures
This new risk category focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. The SolarWinds supply-chain attack is one of the most damaging we've seen.
2021 OWASP Top 10: Security Logging and Monitoring Failures
Without properly logging and monitoring app activities, breaches cannot be detected. Not doing so directly impacts visibility, incident alerting, and forensics. The longer an attacker goes undetected, the more likely the system will be compromised.
2021 OWASP Top 10: Server Side Request Forger
SSRF flaws occur when a web app fetches a remote resource without validating the user-supplied URL. Attackers can coerce the app to send a request to an unexpected destination—even if it’s secured by a firewall, VPN, or other network access control list (ACL).