OWASP Top 10 Security Reference Cheat Sheet

Key Facts

• Broken Access Control happens when users can view, change, or delete data they should not access, so every request must verify the user, role, and permission.
• Cryptographic Failures occur when sensitive data is exposed, so use HTTPS, strong encryption, secure key storage, and never store passwords in plain text.
• Injection occurs when untrusted input is treated as code, so use parameterized queries, input validation, and output encoding.
• Insecure Design means security was not built into the system plan, so threat modeling, abuse cases, and secure defaults should be used before coding.
• Security Misconfiguration happens when systems use unsafe defaults, unnecessary features, weak headers, or exposed admin tools, so hardening and regular reviews are required.
• Vulnerable and Outdated Components create risk because libraries, frameworks, and plugins may contain known flaws, so dependencies must be inventoried and patched.
• Identification and Authentication Failures include weak passwords, missing multi-factor authentication, and poor session handling, so login systems must protect identity carefully.
• Security Logging and Monitoring Failures make attacks harder to detect, so important events such as failed logins, permission changes, and suspicious requests must be logged and reviewed.

Vocabulary

OWASP

OWASP is the Open Worldwide Application Security Project, a nonprofit group that publishes free software security guidance.

Access Control

Access control is the process of deciding what actions a user or system is allowed to perform.

Injection

Injection is a vulnerability where attacker-controlled input is interpreted as a command or query by an application.

Authentication

Authentication is the process of proving a user's identity, usually with passwords, tokens, biometrics, or multi-factor methods.

Encryption

Encryption is the process of converting readable data into protected data that can only be read with the correct key.

Threat Modeling

Threat modeling is a planning process that identifies what could go wrong, who might attack, and how defenses should be designed.