OWASP

OWASP is a non-profit organization that provides freely available standards, tools, and knowledge around application security. Best known are the OWASP Top 10, the list of the most critical risks for web applications.

Hardly any document is cited as often in security discussions about web applications as the OWASP Top 10. Tenders demand protection against them, auditors test along the list, vendors advertise coverage. Behind it stands an organization that offers far more than a list.

What is OWASP?

OWASP stands for Open Worldwide Application Security Project, a non-profit organization that has been developing knowledge, standards, and tools for secure software since 2001. All materials are freely available and vendor-neutral; the work is carried by a worldwide community of security professionals and local chapters.

The name usually comes up in connection with one of the projects. The most important ones:

  • OWASP Top 10: The regularly updated list of the ten most critical security risks for web applications, from broken access control through injection to failures in logging and monitoring. It is intended as an awareness document, but in practice it is often treated as a minimum benchmark.
  • OWASP API Security Top 10: The counterpart for programming interfaces, with its own risk classes such as broken object authorization. Relevant because APIs now make up a large part of application traffic.
  • ASVS (Application Security Verification Standard): A detailed catalog of requirements against which applications can be checked at several levels. Where the Top 10 raise awareness, the ASVS delivers the checklist for development and audit.
  • Tools and guides: From the freely available vulnerability scanner through cheat sheets for developers to the SAMM maturity model for entire organizations.

How it works

The content is created openly and data-driven. For the Top 10, the community evaluates vulnerability data from a large number of real applications and supplements it with industry surveys. Every project is maintained publicly, changes are traceable, and anyone can contribute. It is precisely this openness that has made the materials the shared vocabulary of the industry: when an audit report speaks of an injection vulnerability, everyone involved knows which risk class is meant.

Why it matters

  • Common language: development teams, auditors, procurement, and management talk about the same risk classes instead of vague security promises.
  • Practical entry point: the Top 10 make an unmanageable field tangible and help steer budgets toward the most common classes of errors.
  • Verifiable benchmark: with the ASVS, application security can be expressed in concrete, testable requirements, from login to error handling.
  • Contract and compliance anchor: many tenders, frameworks, and audit catalogs refer to OWASP material; those who know it understand the requirements faster.
  • Free and neutral: the content is open to every company, regardless of size and products in use.

Typical use cases

  • Development: a team aligns its code reviews and test cases with the Top 10 and the cheat sheets and checks releases against an ASVS level.
  • Procurement: a tender requires software suppliers to make statements on coverage of the OWASP Top 10 and on the handling of dependencies.
  • Testing: pentests and audits structure their results along the OWASP risk classes so that findings are comparable and can be prioritized.
  • Protective operations: a web application firewall is operated with rule sets oriented to the OWASP risk classes, for example against injection or cross-site scripting.

OWASP Top 10 and CVE: the difference

Both terms often come up in the same sentence, but they mean different things. The OWASP Top 10 describe risk CLASSES: recurring types of errors such as broken access control or insecure configuration. A CVE, by contrast, refers to a CONCRETE, cataloged vulnerability in a particular product, including a version specification. Put simply: the Top 10 tell you which types of errors you should avoid in your own software; CVEs tell you which known gaps you have to patch in purchased software. A complete security program needs both, plus containment in case something gets through anyway.

How KAEMI helps

OWASP is not a foreign word from tenders for us: KAEMI Managing Director Sven Launspach is himself an OWASP member and brings the work of the community directly into our practice. For the protection of web applications and APIs, KAEMI relies on Application Security as a managed service: web application firewall, DDoS protection, and bot and API management, operated with rule sets oriented to the OWASP risk classes. In addition, Zero Trust microsegmentation limits the damage if an application vulnerability is nevertheless exploited: the compromised service stays contained instead of becoming a springboard into the rest of the network.

Frequently asked questions about OWASP

What does OWASP mean?

OWASP stands for Open Worldwide Application Security Project. The non-profit organization has been developing freely available, vendor-neutral standards, guides, and tools for application security since 2001. It is carried by a worldwide community; best known is the risk list OWASP Top 10.

What are the OWASP Top 10?

The OWASP Top 10 are the regularly updated list of the ten most critical security risks for web applications, including broken access controls, injection, and insecure configuration. They are based on evaluated vulnerability data from real applications and serve as an awareness and prioritization aid.

Are the OWASP Top 10 a certificate or standard?

No. The Top 10 are an awareness document without formal certification. Anyone who needs verifiable requirements turns to the OWASP ASVS, which translates application security into testable criteria and levels. Many tenders nevertheless refer to the Top 10 as a minimum benchmark.

How does a WAF help against OWASP risks?

A web application firewall filters attack patterns such as injection or cross-site scripting out of the data traffic before they reach the application. It does not replace secure development, but measurably lowers the risk and also protects applications that cannot be patched at short notice.

Is it enough to cover the OWASP Top 10?

The Top 10 are a good start, but not a complete program. That also includes vulnerability management for purchased software, secure configuration, monitoring, and containment in the network, for example via microsegmentation, so that a single application error does not become a company-wide incident.

More terms

PCI DSS

PCI DSS is the credit card industry's security standard for all companies that store, process, or transmit cardholder data. This article explains the core requirements, shows how network segmentation considerably reduces the audit scope, and distinguishes the standard from the GDPR.

Read term →

OT Security

OT security protects control and production systems in which availability takes priority, life cycles span decades, and patching is often barely possible. This article explains the differences from IT security, the Purdue model, and why segmentation is the central protective measure for production networks.

Read term →

Peering and Interconnection

Peering refers to the direct exchange of data traffic between two networks without a detour via transit providers. This article explains the difference between public peering at internet exchanges and private interconnects and shows why direct paths lower latency and costs and increase control over the data path.

Read term →

Want to put this into practice in your own network? Talk to KAEMI, aligned to your requirements and with operations from a single source.