New OWASP Top Ten 2021

Every few years, the OWASP Top Ten, a popular list of ten important risks for web applications, is updated. At the moment of writing this article, the Open Web Application Security Project (OWASP) version 2021 has just been released. In this article, we give a short explanation how the OWASP Top Ten works, and what you can expect in this new version.

After a four year waiting period since the previous version, the OWASP Top Ten 2021 released on September 24 2021. In 2017, we wrote an elaborate article on the then new OWASP Top Ten 2017. For more info on OWASP and how the Top Ten works, make sure to read that article.

This time, eight out of the ten topics were chosen based on their weighed CVSS score. The other two were chosen based on answers in an OWASP community.

Using the new Top Ten

Even OWASP recommends the Top Ten as a reference, not for compliance. With the current line up of web application risks, it is impossible for a web app to “comply with the OWASP top ten” or cover all its risks. Take A04 for example, Insecure design. One might apply all nine prevention measures, but this does not guarantee a certain base level of secure design.

For those looking for more assurance, OWASP recommends their ASVS standard instead. This is a more comprehensive guide on how to test for and implement technical measures against web application risks.

This does, however, not mean that the OWASP top ten is inferior to the ASVS. While it is not designed to be a comprehensive compliance checklist, the Top Ten provides a high level overview of the risks, not just for software engineers and architects, but also for Security Officers, CISO’s and other security staff.

What has changed?

OWASP describes the changes since 2017 as follows:

A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.

A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.

A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.

A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures.

A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.

A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any CVEs mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.

A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.

A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from CVE/CVSS data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.

A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.

A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

Image credit: @dante_t via Unsplash.
Diagram credit: owasp.org/Top10/A00_2021_Introduction
Source: https://owasp.org/www-project-top-ten/