Application security

What’s new in the OWASP Top 10 for 2023?

Drew Robb
November 24, 2023 by
Drew Robb

Security is top of mind in a lot of businesses. The threat landscape is so dangerous that everyone is looking for some way to lower their risk profile. That's one of the reasons why the OWASP Top 10 list is greeted with such enthusiasm — it lays out the most significant threats based on an assessment across many enterprises.

TheOpen Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software through community-led open-source software projects. It periodically releases the OWASP Top 10 list, which outlines the 10 most critical security concerns for web application security.

So what’s new on the OWASP Top 10 list for 2023? Well, the last update was in 2021, and it’s typically updated every three to four years. So the next update isn’t expected around 2025.

 

However, the 2021 list had significant changes. Instead of focusing squarely on vulnerability classification, the newest version introduces broader categories with more attention given to the degree of exploitability and the overall impact of a potential threat.

  1. Broken access control 

  1. Cryptographic Failures 

  1. Injection 

  1. Insecure design 

  1. Security misconfiguration 

  1. Vulnerable and outdated components 

  1. Identification and authentication failures 

  1. Software and cata integrity failures 

  1. Security logging and monitoring failures  

  1. Server-side request forgery 

Infosec Skills author John Wagnon spoke about the list on a recent Cyber Work Podcast.

"The top 10 list covers the biggest risks in the world of web applications today," said Wagnon. "When you look at the newest list, it's a bit broader, and they've really gone after the root cause rather than the symptom."

OWASP Top 10 changes

A new item on the list is cryptographic failures. It encompasses items that were part of the previous top 10 list, such as sensitive data exposure. Why? The reason that sensitive data is being exposed everywhere is usually because of underlying cryptography problems.

In the top position on the list is broken access control. Wagnon explained that the modern network deals with applications that are available to people working from home, operating in a coffee shop, doing tasks mid-flight or traveling to different customer sites, often internationally. That brings about countless access control challenges. Hence, broken access control has moved to the top of the chart.

"Number one is the most critical as the items of the OWASP list are in a criticality ranked order," said Wagnon. "However, it is important to understand that what comes up as the top 10 is based on input from companies around the world and may not necessarily be your organization's top 10."

Cryptographic failure is number two on the OWASP list, but it may be number one in a specific organization. Thus, the OWASP Top 10 list should be viewed as an awareness document that gives organizations an idea of the state of application security today.

Legacy applications

Several items from the list have been there for a great many years. After all, there are a great many applications out there that have been around for decades. Among web applications, for example, some were developed around the year 2000 that are still in use. They were created well before the advent of the cloud, virtualization, multi-core processors, containers and other modern innovations.

However, a surprising number of organizations still use these legacy web applications. They haven't gotten around to updating them for a variety of reasons. Some may even be critical to the business, such as a billing or inventory control application.

At the time they were created, security best practices for developers were poorly known. Thus, certain vulnerabilities are present that aren't going away anytime soon. That is one of the reasons why certain items on the OWASP list remain year after year.

Another reason for items persisting on the list is unchanging user behavior. Despite steadily improving user education on security and widespread implementation of security awareness training, some users continue to misbehave, are lax about security policy and remain susceptible to phishing scams that trick them into clicking on malicious links and attachments.

"One of the top attack vectors that attackers use is phishing, as it still works," said Wagnon. "People are taught not to use a weak password and not leave their computer unattended, but some still do."

He urged developers to adopt secure coding practices and standards. If each coder writes secure code, they do their part to make the world safer.

Career opportunities

Cybersecurity offers almost limitless job opportunities. But for new people, it may seem like a daunting place. They may need help figuring out where to start.

There are opportunities in patch management, secure coding, DevSecOps and many others. Within software development, there are opportunities in just about every vertical, every cloud platform and every category of application. The possibilities can range from apps for farming equipment companies to banks, insurance, retail and more.

"With broken access control as the number one security risk, access management experts should be able to write their own tickets," said Wagnon.

To learn more about the OWASP Top 10, check out John Wagnon’s OWASP Top Ten Learning Path in Infosec Skills. 

Drew Robb
Drew Robb

Drew Robb has been writing about IT, engineering and cybersecurity for more than 25 years. He's been published in numerous outlets and resides in Florida.