The How and Why of the OWASP Top Ten 2021
summary
Explains how the OWASP Top Ten 2021 is built: empirical analysis of over half a million applications from 13 contributors, heavy CWE mapping (≈400 unique CWEs, 241 with CVE links), and a scoring formula that combines incidence rate not frequency, testing coverage, CVSS sub‑scores for exploit/impact, and a high‑water‑mark aggregation. Shows tooling and data sources such as dependency-check and NVD, why categories changed (e.g., crypto failures, software/data integrity) and what remains hard to test.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 2:15Icons
- 3:34Process
- 4:43Core Principles
- 11:00Venn Diagram
- 13:30Software Assurance Maturity Model SAM
- 15:13Thank you
- 16:25Incidence vs Frequency
- 21:02CWE Analysis
- 24:12Community Survey
- 32:27Dynamic Analysis
- 36:04Impact
- 37:48Exploit and Impact
- 40:08CVS Scoring
- 41:33CVS Impact Scoring
- 41:57Exploit Scoring
- 42:21CWEs
- 42:46Data
- 43:59Formula
- 45:24Whats Next
related talks
26mFlagship Projects: Top 10 "The making of the OWASP Top 10 and beyond"
47mOWASP Top 10
30mTop 10 Introduction
29mFlagship Projects: Top 10 "Intro of Top 10"
49mThe 2013 OWASP Top 10
31mOWASP API Security Project
32mUsing the OWASP Top 10 As The Foundation for Security and Privacy Programs Across Your Organization
43mFrom OWASP top 10 to Secure Applications