OWASP Top 10
summary
OWASP Top 10 2017 explains how the list is built from a real data call (over 114,000 applications, 43 dataset submissions with 20+ usable), closed 125 issues in four months, and validated with Bugcrowd. New items like DSerialization and XXE make the cut alone; credential stuffing and automation rise with NIST 800-63 guidance (recommend longer passwords and mandatory MFA). Practical tooling and process wins include using dependency-check, publishing source data on GitHub, linking to CWE/ASVS/proactive controls, and calling out the median breach dwell time of 192 days.
AI-written summary · about
chapters (25)
- 0:00Introduction and overview
- 1:50Rocky road to the 2017 list
- 5:27Building the new leadership
- 6:49Project summit outcomes
- 8:21Data analysis and methodology
- 10:27Bug crowd data contribution
- 12:01Top 10 list ranking factors
- 13:35Impact of specific breaches
- 15:01Awareness vs standards
- 17:12Open development process
- 18:40Community translation efforts
- 20:09Finalizing the release
- 22:32What is new in the list
- 25:39SQL injection demo
- 26:49Anti-automation and credentials
- 28:51Sensitive data exposure
- 30:33XXE injection demonstration
- 31:43Broken access control
- 33:44Security misconfiguration
- 34:43Cross-site scripting
- 35:36Insecure deserialization
- 37:49Vulnerable components
- 40:14Logging and monitoring
- 41:56Future outlook and conclusion
- 44:11Q&A and final thoughts
related talks
50mThe How and Why of the OWASP Top Ten 2021
30mTop 10 Introduction
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
26mFlagship Projects: Top 10 "The making of the OWASP Top 10 and beyond"
51mHarmonizing the OWASP API and Application Top 10 Lists
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
58m: The OWASP Top Ten Proactive Controls 2018
31mOWASP API Security Project