Software Engineering Principles and Practices / Software Security & Ethics

Common Vulnerabilities (OWASP Top 10 - overview)

In Software Engineering, the OWASP Top 10 is the definitive standard awareness document for developers and web application security. It represents a broad consensus on the most critical security risks to web applications.

Understanding these vulnerabilities is essential for any engineer practicing Secure SDLC (Software Development Life Cycle).

The list is updated every few years by the Open Web Application Security Project (OWASP) based on data from thousands of applications and security experts.

1. Broken Access Control 🔑

This is currently the #1 risk. It occurs when users can access resources or perform actions outside of their intended permissions.

  • The Risk: A user changing a URL ID (e.g., app.com/user/123 to app.com/user/456) and seeing someone else's private data.

  • Prevention: Deny by default; implement strict access control checks on the server side for every single request.

2. Cryptographic Failures 🔒

Formerly known as "Sensitive Data Exposure," this relates to failures in protecting data in transit and at rest.

  • The Risk: Storing passwords in plain text or using old, weak encryption (like MD5 or SHA1).

  • Prevention: Encrypt all sensitive data; use strong, modern algorithms and ensure TLS (HTTPS) is enforced everywhere.

3. Injection 💉

This occurs when untrusted data is sent to an interpreter as part of a command or query.

  • The Risk: SQL Injection, where an attacker types ' OR 1=1 -- into a login box to bypass password checks.

  • Prevention: Use "Parameterization" (prepared statements) so the database treats user input as data, not as executable code.

4. Insecure Design 🏗️

A newer category that focuses on risks related to design and architectural flaws.

  • The Risk: Implementing a "forgot password" feature that asks a question easily found on social media, or failing to include a limit on login attempts.

  • Prevention: Use Threat Modeling and secure design patterns from the start of the project.

5. Security Misconfiguration ⚙️

This happens when security settings are defined improperly or left as "default."

  • The Risk: Leaving an administrative dashboard open with the password admin/admin, or showing detailed error messages that reveal your server version to hackers.

  • Prevention: Harden your environments and disable unnecessary features/ports.

📊 Summary of the Top 10 Categories

Rank

Category

Focus

A01

Broken Access Control

Permissions & Authorization.

A02

Cryptographic Failures

Data protection & Privacy.

A03

Injection

Sanitizing User Input.

A04

Insecure Design

Architectural Security.

A05

Security Misconfiguration

System Hardening.

A06

Vulnerable & Outdated Components

Dependency Management (Supply Chain).

A07

Identification & Authentication Failures

Logins, MFA, and Session IDs.

A08

Software & Data Integrity Failures

Updates & CI/CD pipeline security.

A09

Security Logging & Monitoring Failures

Visibility and Incident Response.

A10

Server-Side Request Forgery (SSRF)

Restricting internal server requests.

6. Vulnerable and Outdated Components 📦

Modern apps are built on thousands of "Open Source" libraries. If one of those libraries has a bug, your whole app is at risk.

  • Prevention: Use SCA (Software Composition Analysis) tools to automatically scan your package.json or requirements.txt for known vulnerabilities.

💡 The Developer's Motto: "Never Trust User Input"

If you remember one thing from the OWASP Top 10, let it be this: Everything coming from the user's browser is potentially malicious. Whether it’s a form field, a cookie, or a URL parameter, it must be validated and sanitized on the server.