OWASP Top 10
What is the OWASP top 10?
OWASP stands for Open Worldwide Application Security Project. This non-profit foundation works to improve software security. They have published a top 10 list that acts as an awareness document for developers. It represents a broad consensus about the most critical security risks.
Our goal at Snyk Learn is to educate developers and one way we do that is by covering the OWASP top 10 list. By completing the modules below, you will have taken steps toward creating more secure applications and having a better understanding of security risks!
Save your learning progress.
- Track your learning progress
- Keep up to date with the latest vulnerabilities
- Scan your application code to stay secure
Broken access control
Access control ensures users operate only within their authorized permissions. When it fails, it can allow unauthorized data access, modification, destruction, or execution of actions beyond a user’s intended privileges.
Security misconfiguration
Security misconfiguration occurs when a system, application, or cloud service is improperly configured, resulting in security vulnerabilities.
Software Supply Chain Failures
Software supply chain failures occur when the processes used to build, distribute, or update software are disrupted or compromised. These failures often stem from vulnerabilities or malicious alterations in third-party code, tools, or other dependencies that the software depends on.
Cryptographic failures
This is a broad topic that can lead to sensitive data exposure or system compromise. We want to make sure we are always protecting data and storing it securely.
Injection
An injection vulnerability occurs when an application passes untrusted user input to an interpreter, causing the interpreter to execute that input as commands.
Insecure design
Insecure design refers to missing or ineffective security controls and is distinct from insecure implementation, as design flaws and implementation defects have different causes, occur at different stages, and require different fixes.
Authentication failures
Are you who you say you are? We need to always confirm the users’ identity, authentication, and session management.
Software and data integrity failures
Let’s not rely on plugins, libraries, or modules from untrusted sources! This includes repositories and content delivery networks (CDNs).
Logging and alerting failures
How are we supposed to detect a breach when we have no logs? Logging and monitoring are crucial for our applications.
Mishandling of exceptional conditions
Mishandling exceptional conditions occurs when software fails to properly prevent, detect, or handle unusual or unexpected situations. This can result in crashes, unpredictable behavior, or security vulnerabilities.