In this talk Glenn will walk you through the OWASP top 10 published towards the end of 2021 to explain what's hot and what's hotter. He will give a brief description of each weakness and explain how these they are exploited and, more importantly, what you can do to mitigate against attackers exploiting them in your code

1. OWASP Top 10 2021
What you need to know…

2. What is the OWASP Top 10?

3. “The OWASP Top 10 is a standard awarenessdocument for developers
and webapplicationsecurity. It represents a broad consensus about
the most criticalsecurity risks to web applications.”
OWASP.ORG

4. 2003
2004
2007
2010
2013
2017
2021
First version of top 10produced byOWASP
Current version

5. A01 Broken Access Control
A02 Cryptographic Failures
A03 Injection
A04 Insecure Design
A05 Security Misconfiguration
A06 Vulnerable and Outdated Components
A07 Identification and Authentication Failures
A08 Software and Data Integrity Failures
A09 Security Logging and Monitoring Failures
A10 Server Side Request Forgery (SSRF)

6. • Data is collected from multiple organisations
• Data is mappedto CWE categories
• Select categories with highest incident rates
• Ranked by exploitability and impact

7. How do we use the OWASP Top10?

8. 1. Education programme – entry level (awareness) training
2. Minimum baseline for coding standards
3. Minimum baseline for security testing / code reviews

9. “Tools cannotcomprehensivelydetect, test, or protect against the
OWASP Top 10 due to the nature of severalof the OWASP Top 10
risks”
OWASP.ORG
WARNING

10. Go beyondthe bare minimum

11. • A basis for testing web application technical security controls
• A list of requirements for securedevelopment
Adopt the OWASP Application Security Verification Standard
(ASVS)

12. Establish an AppSecprogramme

13. 1. Identify the gaps and goals of your AppSec programme
• Use OWASP Software Assurance Security Model (SAMM)
2. Plan an AppSec programme to close the gaps
3. Implement AppSec programme with your development teams
4. Migrate all upcoming and existing applications to the AppSec
programme
5. Test that the AppSec programme road has mitigated the issues found
in the OWASP Top 10
6. Build your program into a mature AppSec programme

14. An AppSec programmeis
built on three layers

15. Questions?

16. glenn.wilson@dynaminet.co.uk
https://dynaminet.com/contact
https://www.linkedin.com/in/glennwilson
@GlennDynaminet
Find me…