OWASP HOME

# ===== The big artefacts =====
# OWASP Top 10              the most-known list (2021 version, due to refresh)
# OWASP ASVS                Application Security Verification Standard (levels 1/2/3)
# OWASP Cheat Sheet Series  pragmatic per-topic guidance
# OWASP ZAP                 free DAST scanner
# OWASP Dependency-Check    SCA for known CVEs in deps
# OWASP SAMM                Software Assurance Maturity Model

# ===== Top 10 (2021), at a glance =====
# A01 Broken access control
# A02 Cryptographic failures
# A03 Injection (including XSS)
# A04 Insecure design
# A05 Security misconfiguration
# A06 Vulnerable / outdated components
# A07 ID + authentication failures
# A08 Software + data integrity failures
# A09 Security logging + monitoring failures
# A10 SSRF

# Each item maps to controls you can apply in code + infrastructure.

# ===== Defensive baseline (pick one per category) =====
# Access control: deny by default; central authorisation layer; tests
# Crypto:         AEAD primitives, KMS-wrapped keys, no DIY
# Injection:      parameterise queries, escape templates, sanitise allowlists
# Design:         threat model per feature; abuse cases in stories
# Misconfig:      IaC + CIS benchmarks + drift detection
# Components:     SCA in CI (npm audit, Snyk, Dependabot, OSV)
# Authn:          modern auth (OIDC), MFA, rate limit, lockouts, recovery flow
# Integrity:      signed artifacts, supply chain checks (SLSA / sigstore)
# Logging:        structured logs + 90d retention + alerts on shape changes
# SSRF:           outbound allowlists; metadata service blocked; URL validation

# ===== Practical first steps =====
# 1. Pick OWASP ASVS Level 1 as the floor for any app
# 2. Add ZAP baseline scan to weekly CI on staging
# 3. Add dependency scanning to PR checks (Snyk / npm audit / OSV)
# 4. Tabletop the Top 10 each quarter; map controls to your code

# ===== When OWASP wins =====
# - Any team that needs a starting point for AppSec
# - Compliance frameworks (PCI, ISO 27001) reference it
# - Free, vendor-neutral, regularly updated

# ===== Patterns to internalise =====
# - Use the cheat sheets as canonical references in code review
# - Treat the Top 10 as a CHECKLIST, not a list of bug fixes
# - Pair every offensive finding with a detection rule + hardening control
# - Authorise testing in writing before any keystrokes

# ===== Pitfalls =====
# - Trophy hunting the Top 10 without ASVS to depth
# - ZAP scans on prod (use staging that mirrors prod)
# - Ignoring component vulns until quarterly review
# - 'We did the Top 10' as if it is a finish line

// OWASP Top 10 (2021): the ten categories of the most critical web risks.
// A01 → A10. Updated periodically by the Open Worldwide Application Security Project.