API Academy

Sponsored by Layer7

A logo for the open web application security program.

The Open Web Application Security Project

By Bill Oakes, CISSPPosted on

The Open Web Application Security Project (OWASP) is a nonprofit foundation dedicated to improving the security of software. Founded in 1999, OWASP has grown to become a global community of security professionals, developers, and organizations.

The Origins of OWASP

OWASP was founded in 1999 by a group of security professionals, who were concerned about the growing number of web application vulnerabilities. The group’s goal was to create a resource for security professionals to share information and best practices.

The first OWASP project was the OWASP Top 10, a list of the most common web application security risks. The OWASP Top 10 has been updated several times over the years, and it is now considered to be the definitive resource for web application security.

How OWASP Has Transitioned

Over the years, OWASP has expanded its mission to include all aspects of software security. The organization now offers a variety of resources, including:

  • The OWASP Knowledge Base, a comprehensive collection of security articles, tutorials, and tools
  • The OWASP Testing Guide, a step-by-step guide to testing for security vulnerabilities
  • The OWASP Code Review Guide, a guide to conducting security reviews of code
  • The OWASP Security Champions Program, a program that helps organizations to build and maintain a security culture

The Importance of Protecting Against OWASP Top 10 Threats

The OWASP Top 10 list is updated every few years to reflect the latest security threats. The current list, published in 2021, includes the following threats:

  • Injection
  • Broken Authentication and Session Management
  • Cross-Site Scripting (XSS)
  • Sensitive Data Exposure
  • XML External Entity (XXE) Injection
  • Broken Access Control
  • Security Misconfiguration
  • Insufficient Data Protection
  • Insecure Deserialization
  • Using Components with Known Vulnerabilities
  • Unvalidated Redirects and Forwards

These threats can be exploited by attackers to gain access to sensitive data, take control of systems, or disrupt operations. It is important for organizations to protect against these threats by implementing security controls and best practices.

The OWASP Top 10 API Security Threats

In addition to the OWASP Top 10 web-based threats, there are also a number of specific threats that can impact APIs. The OWASP Top 10 API Security Risks list, updated in June 2023, includes the following threats:

  • Broken Object Level Authorization
  • Broken Authentication
  • Broken Object Property Level Authorization
  • Unrestricted Resource Consumption
  • Insufficient Output Validation
  • Broken Function Level Authorization
  • Unrestricted Access to Sensitive Business Flows
  • Server Side Request Forgery
  • Security Misconfiguration
  • Improper Inventory Management
  • Unsafe Consumption of APIs

These threats can be exploited by attackers to gain access to sensitive data, take control of systems, or disrupt operations. It is important for organizations to protect against these threats by implementing security controls and best practices specifically designed for APIs.

Conclusion

The Open Web Application Security Project (OWASP) is a valuable resource for organizations that are looking to improve their software security. The OWASP Top 10 list is a good starting point for identifying and addressing the most common security threats. Organizations should also consider the OWASP Top 10 API Security Risks list if they use APIs.

By implementing security controls and best practices, organizations can help to protect themselves from the OWASP Top 10 threats and other security risks.

To help API Academy readers, we will be publishing a series of articles over the next few months that will provide an overview of some of the Top 10 API Security Risks well as discuss the current state of API protection and what users can expect in the years ahead. and

Stay tuned!