The OWASP Top 10 for 2021 has been released, and Broken Access Control has risen to the top of the list.

 

 

The all-new OWASP Top 10 2021 includes three new categories and position adjustments, according to OWASP.


For every web application, the OWASP Top 10 is a minimum or basic security testing requirement.

The OWASP Top 10 was initially published in 2003, and it has undergone numerous updates since then. The draught report for 2021 is now available.

"The OWASP Top 10 2021 is a good start as a baseline for checklists and so on," OWASP noted, "but it's not sufficient in and of itself." 

OWASP Top 10 2021

 

A01:2021 – Broken Access Control

It is also known as an authorization, and it specifies how a web application allows access to material and capabilities to some users but not others. It rose to the top from fifth place in 2017.

A02:2021 – Cryptographic Failures

 

Shifted from third to the second position, previously it was called as Sensitive Data Exposure. The lack of encryption often leads to sensitive data exposure or system compromise.

 

A03:2021-Injection 

 

It is a technique in which an attacker uses non-validated input vulnerabilities to inject SQL instructions into a web application, which are then executed in the backend database. It has dropped to third place from first. 

A04:2021 Insecure Design

With the OWASP Top 2021, this is a new category that focuses on the dangers associated with design and architectural faults.


"Insecure design" is a wide term that encompasses a variety of flaws, such as absent or inefficient control design. 

A05:2021 – Incorrect Security Configuration

It has risen from sixth to fifth place, focusing on application security hardening and incorrectly configured permissions on cloud services. 

A06:2021 Vulnerable and Outdated Components

Because there isn't enough attack data, it was moved from second to sixth place. This category focuses on the vulnerable versions of all client-side and server-side components.

A07:2021 - Authentication and Identification Errors

This category, formerly known as Broken Authentication, focuses on authentication failures.It leads to automated assaults like credential stuffing, when attackers utilise a list of usernames and passwords to gain access to a system.

A08:2021 - Failures in Software and Data Integrity

This is a new category that was included in the OWASP Top 10 2021, and it focuses on software and data integrity failures related to code and infrastructure that does not guard against integrity violations.

 

A09:2021 - Failures in Security Logging and Monitoring

This category, which moves up one spot from eleventh, aids in the detection, escalation, and response to active breaches.

A10:2021 — Request Forgery on the Server (SSRF)

This category is concerned with securing a connection in which a web application is obtaining a remote resource without validating the URL provided by the user.