Welcome to the OWASP Top 10
- 2017!
This major update adds several new issues, including two issues selected by the community - A8:2017-Insecure
Deserialization and A10:2017-Insufficient Logging and Monitoring. Two key differentiators from previous OWASP Top 10
releases are the substantial community feedback and extensive data assembled from dozens of organizations, possibly the
largest amount of data ever assembled in the preparation of an application security standard. This provides us with
confidence that the new OWASP Top 10 addresses the most impactful application security risks currently facing
organizations.
The OWASP Top 10 - 2017 is based primarily on 40+ data submissions from firms that specialize in application security and
an industry survey that was completed by over 500 individuals. This data spans vulnerabilities gathered from hundreds of
organizations and over 100,000 real-world applications and APIs. The Top 10 items are selected and prioritized according to
this prevalence data, in combination with consensus estimates of exploitability, detectability, and impact.
A primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the
consequences of the most common and most important web application security weaknesses. The Top 10 provides basic
techniques to protect against these high risk problem areas, and provides guidance on where to go from here.
Roadmap for future activities
Don't stop at 10. There are hundreds of issues that could
affect the overall security of a web application as discussed
in the OWASP Developer's Guide and the OWASP Cheat
Sheet Series. These are essential reading for anyone
developing web applications and APIs. Guidance on how to
effectively find vulnerabilities in web applications and APIs
is provided in the OWASP Testing Guide.
Constant change. The OWASP Top 10 will continue to
change. Even without changing a single line of your
application's code, you may become vulnerable as new
flaws are discovered and attack methods are refined.
Please review the advice at the end of the Top 10 in What's
Next For Developers, Security Testers, Organizations, and
Application Managers for more information.
Think positive. When you're ready to stop chasing
vulnerabilities and focus on establishing strong application
security controls, the OWASP Proactive Controls project
provides a starting point to help developers build security
into their application and the OWASP Application Security
Verification Standard (ASVS) is a guide for organizations
and application reviewers on what to verify.
Use tools wisely. Security vulnerabilities can be quite
complex and deeply buried in code. In many cases, the
most cost-effective approach for finding and eliminating
these weaknesses is human experts armed with advanced
tools. Relying on tools alone provides a false sense of
security and is not recommended.
Push left, right, and everywhere. Focus on making
security an integral part of your culture throughout your
development organization. Find out more in the OWASP
Software Assurance Maturity Model (SAMM).
We'd like to thank the organizations that contributed their
vulnerability data to support the 2017 update. We received
more than 40 responses to the call for data. For the first
time, all the data contributed to a Top 10 release, and the full
list of contributors is publicly available. We believe this is one
of the larger, more diverse collections of vulnerability data
ever publicly collected.
As there are more contributors than space here, we have
created a dedicated page to recognize the contributions
made. We wish to give heartfelt thanks to these
organizations for being willing to be on the front lines by
publicly sharing vulnerability data from their efforts. We hope
this will continue to grow and encourage more organizations
to do the same and possibly be seen as one of the key
milestones of evidence-based security. The OWASP Top 10
would not be possible without these amazing contributions.
A big thank you to the more than 500 individuals who took
the time to complete the industry ranked survey. Your voice
helped determine two new additions to the Top 10. The
additional comments, notes of encouragement,
and criticisms were all appreciated. We know your time is
valuable and we wanted to say thanks.
We would like to thank those individuals who have
contributed significant constructive comments and time
reviewing this update to the Top 10. As much as possible,
we have listed them on the ‘Acknowledgements’ page.
And finally, we'd like to thank in advance all the translators
out there who will translate this release of the Top 10 into
numerous different languages, helping to make the OWASP
Top 10 more accessible to the entire planet.
I
Introduction
