Skip to content

OWASP Top 10#

Problem statement (interviewer prompt)

Name the categories of vulnerabilities a web application must defend against by default, and for each give a concrete attack scenario and the standard mitigation. Use the 2021 OWASP Top 10 as your framework.

The OWASP Top 10 is a community-driven list of the most impactful application security risks. Treat it as the floor of secure design, not the ceiling.

OWASP logo, the Open Worldwide Application Security Project
OWASP logo, © OWASP Foundation, via Wikimedia Commons. CC BY-SA 4.0.
flowchart TB
  A01[A01 Broken Access Control]
  A02[A02 Cryptographic Failures]
  A03[A03 Injection]
  A04[A04 Insecure Design]
  A05[A05 Security Misconfiguration]
  A06[A06 Vulnerable & Outdated Components]
  A07[A07 Identification & Authentication Failures]
  A08[A08 Software & Data Integrity Failures]
  A09[A09 Security Logging & Monitoring Failures]
  A10[A10 Server-Side Request Forgery]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class A01,A02,A03,A04,A05,A06,A07,A08,A09,A10 datastore;

Updated every 3-4 years; 2021 is current. Each item is a category with many concrete CVE patterns underneath.

The 2021 Top 10 in order, with what each category covers and how to defend.

A01 - Broken Access Control#

Authorisation gaps: users access resources or operations they shouldn't.

  • IDOR (Insecure Direct Object Reference): GET /orders/12345 lets one user view another's order because the server only checks login, not ownership.
  • Forced browsing: /admin accessible without checks.
  • Missing function-level access control: every endpoint must verify role and resource ownership.

Mitigations: - Deny-by-default; explicit allow per route + per resource. - Use a policy engine (OPA, Casbin, Cedar). - Test for IDOR in CI.

A02 - Cryptographic Failures#

Data not encrypted at rest/in transit, weak algorithms, hardcoded keys.

  • Storing passwords with SHA1.
  • Hardcoded API keys in source.
  • Plaintext PII in DB.

Mitigations: - TLS everywhere. - argon2id for passwords. - KMS / Vault for secrets.

A03 - Injection#

User input executed as code.

  • SQL injection: ' OR 1=1 --.
  • Command injection: ; rm -rf /.
  • NoSQL: {"$ne": null}.
  • LDAP, XPath, ORM injection.

Mitigations: - Parameterised queries always. - Allowlist input validation. - Use ORMs that parameterise by default.

A04 - Insecure Design#

Architectural flaws that no amount of patching fixes.

  • No rate limit on password reset.
  • Credit-limit logic that allows negative balances.
  • Skipping threat modelling.

Mitigations: - Threat-model new features (STRIDE). - Misuse-case stories alongside user stories. - Security review at design time, not at deploy.

A05 - Security Misconfiguration#

Default credentials, verbose errors, open buckets.

  • S3 bucket world-readable.
  • Debug stack trace in production response.
  • kubectl exposed to internet.

Mitigations: - IaC with secure defaults. - Continuous configuration scanning (Checkov, kube-bench, ScoutSuite). - CIS benchmarks.

A06 - Vulnerable and Outdated Components#

Old libraries with known CVEs.

  • Log4Shell (CVE-2021-44228) - log4j RCE.
  • Heartbleed (CVE-2014-0160) - OpenSSL.

Mitigations: - SCA tools (Snyk, Dependabot, Trivy). - SBOM in build pipeline. - Patch SLA per severity.

A07 - Identification and Authentication Failures#

Weak login, session, or credential handling.

  • No rate limit on login (credential stuffing).
  • Predictable session ids.
  • Allowing password reuse / no MFA.

Mitigations: - MFA mandatory for sensitive roles. - Rate-limit auth endpoints. - Argon2id passwords, secure session cookies.

A08 - Software and Data Integrity Failures#

Trusting code or data that wasn't verified.

  • Unsigned third-party CI dependencies.
  • Insecure deserialization (Java ObjectInputStream, pickle).
  • npm package compromised in supply chain (event-stream, ua-parser-js).

Mitigations: - Signed releases (Sigstore, in-toto). - Subresource Integrity for CDN scripts. - Avoid deserialising untrusted data.

A09 - Security Logging and Monitoring Failures#

Attacks not detected because logs don't capture, or no one looks.

  • Login failures not logged.
  • No alert on privilege escalation.
  • Logs purged before review.

Mitigations: - Audit log every security-relevant event. - SIEM with detection rules. - Test detection during chaos / GameDay.

A10 - Server-Side Request Forgery (SSRF)#

Server makes outbound requests an attacker controls.

  • ?url=http://169.254.169.254/latest/meta-data/ to steal cloud creds.
  • Internal port scanning.

Mitigations: - Allowlist outbound destinations. - Block link-local / loopback / private IPs in URL fetchers. - Use a dedicated fetcher service in a sandbox VPC.

Where this fits#

flowchart TB
  Design[Threat model<br/>A04] --> Build[Build secure components<br/>A06 A08]
  Build --> Deploy[Configure safely<br/>A05]
  Deploy --> Runtime[Runtime defences<br/>A01 A02 A03 A07 A10]
  Runtime --> Detect[Detect & respond<br/>A09]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class Design,Build,Deploy,Runtime,Detect service;

How OWASP maps to fundamentals#

flowchart TB
  OW((OWASP Top 10))
  SEC[Security fundamentals<br/>parent framing]
  WEB[Web security<br/>CSRF, XSS, CORS, SOP]
  JWT[JWT internals<br/>A07 auth failures]
  CRY[Crypto primitives<br/>A02 mitigation]
  SEC --> OW
  OW --> WEB
  OW --> JWT
  OW --> CRY

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class OW service;
    class SEC,WEB,JWT,CRY datastore;

Glossary & fundamentals#

Tag Concept What it is Page
HLD Security fundamentals parent topic security-fundamentals
HLD Web Security CSRF/XSS/CORS specifics web-security
HLD JWT internals A07 covers JWT failures jwt-internals
HLD Cryptography primitives A02 mitigation cryptography-primitives

Quick reference#

# Category Example Mitigation
A01 Broken Access Control IDOR Deny-by-default, policy engine
A02 Cryptographic Failures SHA1 passwords argon2id + KMS
A03 Injection SQLi Parameterised queries
A04 Insecure Design No rate limit on reset Threat modelling
A05 Security Misconfig Open S3 bucket IaC scanners, CIS
A06 Vulnerable Components Log4Shell SCA + SBOM
A07 Auth Failures No MFA, weak session MFA, argon2id
A08 Integrity Failures Unsigned deps Sigstore, SRI
A09 Logging Failures No login-fail log SIEM + alerts
A10 SSRF ?url=169.254.169.254 Allowlist outbound

Cycle#

Threat-model (A04) → secure build (A06, A08) → secure config (A05) → runtime defences (A01/A02/A03/A07/A10) → detect (A09).

Tools#

  • SCA: Snyk, Dependabot, Trivy
  • SAST: SonarQube, Semgrep, CodeQL
  • DAST: ZAP, Burp
  • IaC: Checkov, kube-bench, ScoutSuite
  • SBOM: syft, CycloneDX

Refs#

  • owasp.org/Top10
  • OWASP Cheat Sheet Series
  • NIST SP 800-53

FAQ#

What is the OWASP Top 10?#

The OWASP Top 10 is a community-maintained list of the most impactful web application security risks, refreshed every few years, and used as the baseline of secure design.

What is broken access control?#

Broken access control is when users can read or modify resources they should not. The fix is server-side authorization on every endpoint, never trusting client supplied IDs.

How do you prevent SQL injection?#

Use parameterized queries or an ORM. Never concatenate user input into SQL. Add input validation, least-privilege DB accounts, and detection rules at the WAF as defence in depth.

What is SSRF?#

Server-side request forgery tricks a server into making outbound requests to internal targets like the metadata service. Block link-local IPs, use an egress proxy, and validate URLs.

How is OWASP Top 10 different from a full security program?#

It is the floor, not the ceiling. A real program adds threat modeling, secrets management, dependency scanning, secure SDLC, and incident response on top of these ten categories.

Further reading#