OWASP Explained: The Top 10 and ZAP for Security+ and PenTest+

OWASP — the Open Worldwide Application Security Project, formerly Open Web Application Security Project — is a non-profit foundation producing free, vendor-neutral resources for application security. Its output is referenced across the industry and across CompTIA's objectives.

OWASP is not a standard you comply with. It is a body of freely available guidance, and the Top 10 is an awareness document, not a checklist.

That distinction matters and exams occasionally probe it. An organization cannot be "OWASP compliant". It can build against OWASP guidance, test against the ASVS, and use the Top 10 to prioritize training.

The OWASP Top 10

The flagship document, updated roughly every three to four years, listing the most critical web application security risks. The 2021 edition is the one most widely referenced in current exam material:

  1. Broken Access Control — the top risk. Users acting outside their permissions: viewing another account's records, escalating privileges, bypassing authorization checks.
  2. Cryptographic Failures — previously "Sensitive Data Exposure". Weak algorithms, missing encryption, hard-coded or poorly managed keys.
  3. Injection — SQL, command, LDAP and similar. Cross-site scripting was folded into this category in 2021.
  4. Insecure Design — new in 2021. Flaws in the architecture itself, which no amount of careful implementation fixes. Threat modelling is the countermeasure.
  5. Security Misconfiguration — default credentials, unnecessary features enabled, verbose error messages, missing hardening. XML external entities (XXE) folded in here.
  6. Vulnerable and Outdated Components — the Log4Shell category. Using libraries with known vulnerabilities.
  7. Identification and Authentication Failures — weak passwords, broken session management, credential stuffing exposure.
  8. Software and Data Integrity Failures — insecure deserialization, unverified updates, compromised CI/CD pipelines. The SolarWinds category.
  9. Security Logging and Monitoring Failures — not detecting the breach, which is why dwell times run into weeks.
  10. Server-Side Request Forgery (SSRF) — added by community survey. The application is tricked into making requests to internal resources on the attacker's behalf.

Two shifts worth noting because they reveal how thinking changed: Broken Access Control moved to number one, and Insecure Design was added as a category, acknowledging that some problems cannot be coded around because the design was wrong.

The Other OWASP Projects

The Top 10 gets the attention, but several other projects appear in exam material.

  • OWASP ZAP (Zed Attack Proxy) — a free web application scanner and intercepting proxy. The open-source counterpart to Burp Suite, and a named tool on PenTest+.
  • ASVS — Application Security Verification Standard. A detailed, tiered set of requirements you actually can test against, which is what people often mean when they wrongly say "OWASP compliant".
  • OWASP Top 10 for LLM Applications — increasingly relevant, covering prompt injection, insecure output handling, training data poisoning and excessive agency. Directly relevant to SecAI+.
  • API Security Top 10 — a separate list, because APIs fail differently from web pages.
  • Mobile Top 10, Cheat Sheet Series, SAMM (a software assurance maturity model), and Dependency-Check for scanning components.

Where It Fits in a Secure SDLC

OWASP guidance maps onto the development lifecycle: threat modelling and the Insecure Design category at design time; the Cheat Sheets and secure coding guidance during development; ZAP and the ASVS during testing; and the Top 10 as the basis for developer security training.

The related bodies exams group with it: CWE (Common Weakness Enumeration, a catalogue of weakness types), CVE (specific vulnerability instances), NIST (SP 800 series guidance), CIS (benchmarks and controls), and SANS (training and the CWE Top 25). Knowing which organization produces which artifact is a fair exam question.

Security+ (SY0-701) Exam Tips

  • Know what OWASP is — a non-profit producing free application security resources — and that the Top 10 is its best-known output.
  • Recognize the Top 10 categories by description. A scenario describing a user accessing another user's records is Broken Access Control; one describing an unpatched library is Vulnerable and Outdated Components.
  • Broken Access Control is number one in the current list.
  • It is awareness guidance, not a compliance standard.
  • Know the neighbours: CWE, CVE, NIST, CIS, SANS, and which produces what.
  • Secure coding practices — input validation, parameterized queries, output encoding, least privilege — are the countermeasures the list points toward.

PenTest+, CySA+ and SecAI+ Angles

PenTest+ (PT0-003) uses the Top 10 as a web application testing methodology and names ZAP among the standard tools. Expect to map a finding to its Top 10 category in a report.

CySA+ (CS0-004) uses it for vulnerability prioritization and for framing findings when communicating with development teams.

SecAI+ (CY0-001) draws on the OWASP Top 10 for LLM Applications, which is currently the most widely cited framework for AI application risk — prompt injection in particular.

Key Takeaways

  • OWASP is a non-profit producing free application security guidance, not a certification or compliance regime.
  • The Top 10 is an awareness document ranking the most critical web application risks.
  • Broken Access Control is currently number one, and Insecure Design was added as a category in 2021.
  • ZAP is the free scanner and intercepting proxy; ASVS is the testable standard.
  • There are separate Top 10 lists for APIs, mobile, and LLM applications.
  • Know it apart from CWE, CVE, NIST, CIS and SANS.

Related reading: Web application firewalls · Fuzzing · STRIDE threat modeling

Comments

Post a Comment