OWASP Top 10: Web Application
Security Threats 2021–2025
Your Handy Security Checklist
https://gitprotect.io
About OWASP
• OWASP (Open Worldwide Application Security
Project) is a non-profit organization focused
on improving software security.
• The OWASP Top 10 is a standard awareness
document that highlights the most critical
security risks to web applications.
Why This Matters
• The OWASP Top 10 helps developers,
architects, and security teams prioritize and
mitigate the most impactful web
vulnerabilities.
• It promotes secure coding practices and better
design decisions.
How to Use This Checklist
• • Identify vulnerable areas in your applications
• • Educate development and security teams
• • Integrate into secure SDLC practices
• • Use as an audit and compliance reference
A01:2021 - Broken Access Control
• Description and Real-world Examples
• • Deny access by default
• • Implement access controls across the app
• • Restrict access to APIs and controllers
A01:2021 - Broken Access Control -
Prevention Techniques
• • Deny access by default
• • Implement access controls across the app
• • Restrict access to APIs and controllers
A02:2021 - Cryptographic Failures
• Description and Real-world Examples
• • Classify data properly
• • Use strong encryption
• • Encrypt all sensitive stored data
A02:2021 - Cryptographic Failures -
Prevention Techniques
• • Classify data properly
• • Use strong encryption
• • Encrypt all sensitive stored data
A03:2021 - Injection
• Description and Real-world Examples
• • Use secure APIs
• • Enforce whitelist validation
• • Apply SQL controls like LIMIT
A03:2021 - Injection - Prevention
Techniques
• • Use secure APIs
• • Enforce whitelist validation
• • Apply SQL controls like LIMIT
A04:2021 - Insecure Design
• Description and Real-world Examples
• • Use secure SDLC
• • Apply threat modeling
• • Integrate security into user stories
A04:2021 - Insecure Design -
Prevention Techniques
• • Use secure SDLC
• • Apply threat modeling
• • Integrate security into user stories
A05:2021 - Security
Misconfiguration
• Description and Real-world Examples
• • Automate hardening
• • Remove unused features/files
• • Review security settings regularly
A05:2021 - Security
Misconfiguration - Prevention
Techniques
• • Automate hardening
• • Remove unused features/files
• • Review security settings regularly
A06:2021 - Vulnerable & Outdated
Components
• Description and Real-world Examples
• • Remove unnecessary libraries
• • Maintain inventory of components
• • Monitor for unsupported software
A06:2021 - Vulnerable & Outdated
Components - Prevention
Techniques
• • Remove unnecessary libraries
• • Maintain inventory of components
• • Monitor for unsupported software
A07:2021 - Identification &
Authentication Failures
• Description and Real-world Examples
• • Implement MFA
• • Avoid default credentials
• • Limit account enumeration
A07:2021 - Identification &
Authentication Failures -
Prevention Techniques
• • Implement MFA
• • Avoid default credentials
• • Limit account enumeration
A08:2021 - Software and Data
Integrity Failures
• Description and Real-world Examples
• • Use digital signatures
• • Validate sources of third-party components
• • Implement secure deserialization
A08:2021 - Software and Data
Integrity Failures - Prevention
Techniques
• • Use digital signatures
• • Validate sources of third-party components
• • Implement secure deserialization
A09:2021 - Logging & Monitoring
Failures
• Description and Real-world Examples
• • Implement complete logging
• • Log user-context events
• • Create incident response plans
A09:2021 - Logging & Monitoring
Failures - Prevention Techniques
• • Implement complete logging
• • Log user-context events
• • Create incident response plans
A10:2021 - Server-Side Request
Forgery (SSRF)
• Description and Real-world Examples
• • Use network segmentation
• • Deny by default
• • Sanitize user inputs
• • Disable HTTP redirects
A10:2021 - Server-Side Request
Forgery (SSRF) - Prevention
Techniques
• • Use network segmentation
• • Deny by default
• • Sanitize user inputs
• • Disable HTTP redirects
Summary of OWASP Top 10
• A01:2021 - Broken Access Control
• A02:2021 - Cryptographic Failures
• A03:2021 - Injection
• A04:2021 - Insecure Design
• A05:2021 - Security Misconfiguration
• A06:2021 - Vulnerable & Outdated
Components
• A07:2021 - Identification & Authentication
Failures
Common Security Themes
• • Default configurations are dangerous
• • Validate all inputs
• • Monitor and log everything
• • Keep software and libraries up to date
Secure SDLC Integration
• • Integrate security from design to
deployment
• • Apply threat modeling early
• • Automate security testing in CI/CD
Recommended Tools & Practices
• • Use SAST/DAST tools
• • Apply security headers
• • Enforce principle of least privilege
• • Educate developers on secure coding
Security Checklist for Teams
• • Are access controls enforced?
• • Is sensitive data encrypted?
• • Are components up to date?
• • Are logs monitored?
• • Is SSRF protection in place?
Closing Thoughts
• Security is not a feature—it’s a mindset.
• Secure your codebase. Train your team.
Monitor everything.
• More at: https://owasp.org |
https://gitprotect.io
