OWASP Top 10: Lightboard Lesson Series

John starts out by explaining what the OWASP Top 10 is. He highlights themes like risk re-orientation around symptoms and root causes, new risk categories, and modern application architectures. Follow along for a video on each of the Top 10 risks.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

94% of tested apps showed some form of broken access control. Failures can result in unauthorized disclosure, modification or destruction of data, privilege escalation and lead to account takeover (ATO), data breach, fines, and brand damage.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

Cryptographic failures, previously known as "Sensitive Data Exposure", lead to sensitive data exposure and hijacked user sessions. Despite widespread TLS 1.3 adoption, old and vulnerable protocols are still being enabled.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

Injection is a broad class of attack vectors where untrusted input alters app program execution. This can lead to data theft, loss of data integrity, denial of service, and full system compromise. Injection is no longer the top risk, but still formidable.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

Security needs to be inherent to applications. A secure design can still have implementation defects leading to vulnerabilities. An insecure design can’t be fixed by perfect implementation.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

Security Misconfiguration is a major source of cloud breaches. Learn what to do and avoid—as modern app development, software re-use, and architectural sprawl across clouds increases this risk.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

Open Source software exploits are behind many of the biggest security incidents. The recent Log4j2 vulnerability is perhaps the most serious risk in this category to date.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

It is critical to confirm identity and use strong authentication and session management to protect against business logic abuse. Most authentication attacks trace to the continued use of passwords. Compromised credentials, botnets, and sophisticated tools provide an attractive ROI for automated attacks like credential stuffing.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

Watch the other episodes of the series below.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time

This new risk category focuses on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. The SolarWinds supply-chain attack is one of the most damaging we've seen.

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Key changes including recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time.

Without properly logging and monitoring app activities, breaches cannot be detected. Not doing so directly impacts visibility, incident alerting, and forensics. The longer an attacker goes undetected, the more likely the system will be compromised.

Protect Your Web Apps from New and Critical Risks
The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open-source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.

By watching this lightboard session, your personal details will be shared with F5 and treated in accordance with the F5 Privacy Notice (https://www.f5.com/company/policies/privacy-notice). You also are signing up to be contacted about F5 products and services but you can unsubscribe at any time.

SSRF flaws occur when a web app fetches a remote resource without validating the user-supplied URL. Attackers can coerce the app to send a request to an unexpected destination—even if it’s secured by a firewall, VPN, or other network access control list (ACL).

The OWASP Top 10 is a broad consensus about the most critical security risks to web applications. The update gives guidance to help secure modern web applications and architectures from exploits, abuse, and misconfiguration, as well as recommendations for mitigating new risks involving software supply chains, CI/CD pipelines, and open source software.

Watch the OWASP Top 10 Lightboard Lesson series for a breakdown of the new OWASP Top 10 and learn:

• How OWASP creates its Top 10 list of the most critical security risks to web applications.
• Recategorization of risk to align symptoms to root causes.
• When each risk can manifest, why it matters, and how to improve your security posture.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. OWASP maintains a variety of projects, including the Top 10 web application security risks standard awareness document for developers and security practitioners.