TL;DR overview
- OWASP (Open Web Application Security Project) is a nonprofit organization that provides free, vendor-neutral resources—including the widely used OWASP Top 10—to help developers and organizations improve the security of their software.
- The OWASP Top 10 (2021 edition) identifies the most critical web application security risks, including broken access control, cryptographic failures, and injection flaws, and is used as a foundational reference for application security decisions worldwide.
- Additional OWASP resources include the Code Review Guide, the Application Security Verification Standard (ASVS) 4.0, and static code analysis guidance that help teams build security into the development process.
- Sonar's products map to OWASP security standards, enabling teams to detect and remediate OWASP-classified vulnerabilities automatically as part of their continuous inspection workflow.
What is OWASP?
OWASP, or the Open Web Application Security Project, is a nonprofit entity aimed at bolstering the security of software. It's a collaborative platform where security experts and developers contribute to creating open-source tools and resources for secure software development within the software development lifecycle.
Notably, OWASP offers educational materials, holds training events, and advocates for a security-centric approach to software development.
Its well-known OWASP Top 10 document highlights the most critical web application security risks, aiding developers and organizations in addressing significant threats.
With a global network of chapters, it encourages the interchange of security knowledge and the adoption of its standards to enhance the security posture of organizations.
Why is OWASP important?
OWASP is important because it offers an extensive of free and open resources to assist organizations in improving the security of their web applications.
Cyberattacks are increasingly targeting web applications.
OWASP's resources are used by organizations of all sizes, from small businesses to large corporations. They are also used by government agencies and educational institutions.
Being vendor-neutral, OWASP gives unbiased security resources, promoting a security-focused culture in software development.
Its ongoing research and readily available security resources aid in addressing emerging threats, making a significant contribution towards a more secure digital infrastructure globally.
Through these efforts, OWASP contributes significantly to the advancement of better security standards in software development and deployment
What are the OWASP Top 10?
The OWASP Top 10 is the popular fundamental document in the domain of web application security, pinpointing the most severe security risks. OWASP periodically revises the list to reflect the evolving threat landscape and makes updates to address security concerns.
Below is a detailed breakdown of each item in the 2021 edition of the OWASP Top 10:
- A01:2021 - Broken Access Control
- This refers to scenarios where users can perform actions or access data they aren't supposed to due to inadequate or entirely lacking access restrictions. It's a common issue and had more occurrences in applications than any other category.
- A02:2021 - Cryptographic Failures
- Previously termed as Sensitive Data Exposure, this item now focuses on failures related to cryptography which often lead to sensitive data exposure or system compromise.
- A03:2021 - Injection
- Injection flaws occur when untrusted data is sent as part of a command or query, tricking the interpreter into executing unintended commands or accessing unauthorized data. In this edition, Cross-site Scripting is incorporated into this category.
- A04:2021 - Insecure Design
- A new category focusing on risks associated with design flaws. It emphasizes the need for threat modeling, secure design patterns and principles, and reference architectures.
- A05:2021 - Security Misconfiguration
- This occurs when a component is susceptible due to a non-secure configuration. In this edition, the category for XML External Entities (XXE) has been included here.
- A06:2021 - Vulnerable and Outdated Components
- This item highlights the risks associated with using components that have known vulnerabilities, a common issue that the community finds challenging to test and assess.
- A07:2021 - Identification and Authentication Failures
- Previously known as Broken Authentication, this item now includes issues more related to identification failures, while still being an integral part of the Top 10.
- A08:2021 - Software and Data Integrity Failures
- This new category focuses on making unfounded assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity.
- A09:2021 - Security Logging and Monitoring Failures
- This category, which now includes more types of failures, underscores the importance of adequate logging and monitoring, which, if lacking, can impact visibility, incident alerting, and forensics.
- A10:2021 - Server-Side Request Forgery (SSRF)
- Added from the Top 10 community survey, this category represents a scenario where security community members have identified this as a significant issue, even if it's not illustrated in the data at this time.
The OWASP Top 10 serves as a vital awareness document for developers and organizations, aiming to provide a common baseline for web application security.
By addressing these top 10 risks, developers can significantly improve the security of their web applications, adhering to industry standards and best practices.
What benefits do developers gain from the OWASP top 10?
The OWASP Top 10 is a foundational resource in web application security, and developers can obtain multiple benefits from familiarizing themselves with and adhering to its guidelines. With guidance from this standard, developers can make sure that the code they develop does not violate these categories of security flaws allowing for secure code delivery.
- Identification of Common Security Risks
- The OWASP Top 10 lists the most prevalent and critical security risks in web applications, helping developers to recognize and understand common vulnerabilities.
- It serves as an educational tool, enhancing developers' security knowledge and awareness, which is crucial for building secure applications.
- The OWASP community is a substantial resource for developers. By engaging with this community while exploring the OWASP Top 10, developers can access a wealth of experience and expertise to help solve security challenges.
- Security Guidance and Best Practices
- The OWASP Top 10 provides practical guidance and recommendations on how to prevent or mitigate the listed security risks, providing a roadmap for implementing secure coding practices.
- Utilizing the OWASP Top 10 as a security baseline, developers can establish a foundational level of security in their projects, helping to prevent many common vulnerabilities from arising.
- Many regulatory frameworks and standards reference the OWASP Top 10. By adhering to it, developers can also ensure that their applications are compliant with various legal and regulatory requirements.
- Risk Mitigation
- By addressing the risks highlighted in the OWASP Top 10, developers can significantly improve the robustness and resilience of their web applications against malicious attacks.
- Identifying and fixing security issues early in the development process is usually more cost-effective than addressing them after deployment. The OWASP Top 10 helps developers do this, potentially saving time and resources later on.
- Creating secure applications in line with recognized standards like the OWASP Top 10 can enhance the trust of users and stakeholders, potentially leading to a better reputation and more business opportunities.
What is OWASP Static Code Analysis?
OWASP classifies Static Code Analysis tools as Source Code Analysis and Static Application Security Testing (SAST) tools which are typically performed as part of the Code Review (also known as white-box testing) process.
Static Code Analysis is typically defined as the method of using static code analysis tools to identify potential security vulnerability flaws or bugs in “static” (non-running) source code early in the development cycle.
OWASP stresses evaluating important criteria when selecting static code analysis tools, considerations include the supported programming languages, types of vulnerabilities it can detect, whether it requires a fully buildable set of sources, whether it can run against binaries instead of source, integration with the developer’s IDE, if it supports Object-Oriented Programming (OOP) and the cost of the tool.
What is the OWASP Code Review Guide?
OWASP has created a Code Review Guide which is a technical manual designed for individuals involved in code reviews, including management, developers, and security professionals. This guide is structured primarily into two sections, with each addressing crucial aspects of code reviewing.
The guide encompasses a wealth of information including code examples, red flags to watch for during reviews, and certain nuances related to different programming paradigms like Object-Oriented Programming (OOP).
Additionally, it contains an appendix section where useful resources like a code reviewer checklist are provided, which, while not flowing well in book form, are essential for a comprehensive understanding of code review practices
The latest version 2.0 is freely available and last updated in 2017.
What is OWASP Application Security Verification Standard (ASVS) 4.0?
The OWASP Application Security Verification Standard (ASVS) Project lays a foundational framework for scrutinizing the technical security controls of web applications, simultaneously offering developers a comprehensive checklist for secure development endeavors.
The core objective of the OWASP Application Security Verification Standard (ASVS) Project is to standardize the breadth and depth of coverage in web application security verification, aligning with a commercially viable open standard.
This standard acts as a keystone for evaluating the technical security safeguards within the application and its operational context, crucial for warding off vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection.
Employing this standard can foster a heightened level of assurance regarding the security robustness of web applications.
The conditions described in this standard were crafted with the following goals:
Metric Utilization
Affords application developers and owners a benchmark to evaluate the trustworthiness of their Web applications.
Guidance Provision
Dispenses clear directives to security control developers on the pivotal elements to be ingrained in security controls to adhere to application security mandates.
Procurement Application
Lays down a solid groundwork for articulating application security verification requisites in contractual agreements.
Sonar and OWASP
Sonar provides a comprehensive coverage of OWASP security vulnerabilities detecting a wide range of OWASP issues including those from the OWASP Top 10, ASVS 4.0, and extensive Code Reviews that align with OWASP standards.
By tracking each of these through available security reports, teams can get a big-picture view of the code’s compliance with these standards.