OWASP Top 10 Reference
Reference for the OWASP Top 10 web application security risks and mitigation strategies.
2021 Top Risks
The OWASP Top 10 2021 ranks the most critical web application security risks. A01 Broken Access Control is now the top risk, up from fifth. A02 Cryptographic Failures (formerly Sensitive Data Exposure) covers weak crypto and plaintext transmission. A03 Injection includes SQLi, XSS, and command injection. A04 Insecure Design addresses architectural flaws. A05 Security Misconfiguration covers default configs and verbose errors.
- A01
- Broken Access Control
- A02
- Cryptographic Failures
- A03
- Injection
top risk 2021weak cryptoSQLi, XSS, cmdMitigation Approach
Each risk has specific mitigation: access control needs deny-by-default with checks at every layer. Cryptographic failures require strong algorithms, proper key management, and TLS everywhere. Injection is prevented with parameterized queries and output encoding. Insecure design requires threat modeling and secure design patterns. Security misconfiguration needs hardening, automated patching, and minimal attack surface. Regular testing (DAST, SAST, penetration testing) validates controls.
- access control
- Deny by default
- injection
- Parameterized queries
- testing
- DAST, SAST, pentest
check every layeroutput encodingcontinuous validation