CYBER-02-001-P · Primer — What the OWASP Top 10 Is

The idea in one sentence

The OWASP Top 10 is a data-driven, community consensus of the ten most critical security risks to web applications — an awareness document that tells you where to look first.

Why it exists

Web apps fail in a thousand ways, and a newcomer has no way to know which failures actually get exploited in the wild versus which are theoretical. Imagine a grocery store with dozens of aisles of products; a shopper without a list will wander aimlessly, buying expensive items they don’t need while missing the staples that keep the household running. Similarly, teams left to intuition over‑invest in exotic threats and miss the boring ones that breach real companies every week. The Open Web Application Security Project — a nonprofit, vendor‑neutral foundation — solved the prioritization problem by pooling evidence: contributed data from hundreds of organizations covering hundreds of thousands of applications, plus a practitioner survey for threats too new to show up in scan data yet. The result, refreshed roughly every three to four years since 2003, is a ranked shortlist. It exists so that "secure the app" stops being infinite and becomes ten named, ordered categories you can teach, budget, and check against.

How it works

Each entry is a category of related weaknesses, not a single bug — mapped to specific CWE identifiers so it stays concrete. The 2021 list is topped by A01 Broken Access Control (users reaching data or actions they should not), then A02 Cryptographic Failures, A03 Injection (which folds in cross‑site scripting), A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components, A07 Identification and Authentication Failures, A08 Software and Data Integrity Failures, A09 Security Logging and Monitoring Failures, and A10 Server‑Side Request Forgery. Ranking blends how often a category appears, how exploitable and impactful it is, and how much of the tested population it touches. You use it as a lens: for each category, ask "how could this happen in our app, and what control blocks it?"

Concrete worked example

Consider an e‑commerce site with 10 000 daily users. The logs show that 120 users per day trigger a URL like /admin/deleteUser?id=123. The app checks the user’s role only after the SQL query runs, allowing the query DELETE FROM users WHERE id=123 to execute. This is a classic A01 Broken Access Control issue. By inserting a proper pre‑check (e.g., if (user.role != 'admin') reject) before any database call, the same 120 daily risky requests become harmless, reducing the potential breach surface by 0.0012 % of total traffic but eliminating a high‑impact vector.

See it — untrusted input reaches the app; the Top 10 tells you where the checks belong

flowchart LR
  A["Untrusted request"] --> B{"A01<br/>Access check?"}
  B -->|missing| C["Reaches data<br/>it should not"]
  B -->|enforced| D{"A03<br/>Parameterized?"}
  D -->|no| E["Injection<br/>changes the query"]
  D -->|yes| F["Handled safely"]

The one gotcha

The biggest misconception is treating the Top 10 as a complete security checklist and declaring victory once all ten items are ticked off. It is deliberately a starting point, not a finish line. That brevity means whole classes of risk—business‑logic abuse, denial‑of‑service, mobile‑specific flaws, API‑specific attacks—remain outside its scope. In practice, teams that stop at the Top 10 often discover later that a critical flaw, such as a logic bypass in a payment flow, was never covered. The Top 10 should be the floor of your security program; you must layer additional standards (e.g., OWASP ASVS) and threat models on top.

The one-line takeaway

The Top 10 is a starting line, not a finish line.

Where you'll meet it

It is baked into the tools you already touch. Framework defaults — Django's ORM and auto‑escaping templates, Rails' strong parameters, Spring Security — exist largely to knock out these categories by default. Dependency scanners like Snyk and Dependabot target A06 (vulnerable components); an SBOM inventories what you ship. Web application firewalls advertise Top 10 coverage; static and dynamic scanners map findings to it; Burp Suite is the classic tool for testing your own app against these categories. A02 and A10 show up the moment you touch TLS or let a server fetch a URL — SSRF famously reaching cloud metadata endpoints. You will see the Top 10 cited in pentest reports, compliance mappings, and secure‑coding training for the rest of your career.

Named concepts: OWASP Top 10, web application security risks, awareness document