OWASP Top 10 overview in Cybersecurity - Time & Space Complexity

Time Complexity: OWASP Top 10 overview

O(n * m)

Understanding Time Complexity

When studying the OWASP Top 10, it's important to understand how the effort to detect or fix vulnerabilities grows as the size of a web application increases.

We want to know how the time needed to analyze security risks changes when the application gets bigger or more complex.

Scenario Under Consideration

Analyze the time complexity of scanning a web application for the OWASP Top 10 vulnerabilities.

// Pseudocode for scanning vulnerabilities
for each page in web_application:
  for each input_field in page:
    test for injection vulnerabilities
  for each link in page:
    test for broken access control
  check for security misconfigurations
  check for sensitive data exposure

This code scans each page and its inputs to find common security issues listed in the OWASP Top 10.

Identify Repeating Operations

Look at what repeats as the application grows.

• Primary operation: Looping through each page and then each input field and link on that page.
• How many times: Once for every page, and inside that, once for every input field and link.

How Execution Grows With Input

As the number of pages increases, the scanning time grows because each page and its elements need checking.

Input Size (n pages)	Approx. Operations
10	Checks on 10 pages and their inputs/links
100	Checks on 100 pages and their inputs/links
1000	Checks on 1000 pages and their inputs/links

Pattern observation: The time grows roughly in direct proportion to the number of pages and their elements.

Final Time Complexity

Time Complexity: O(n * m)

This means the scanning time grows linearly with the number of pages and their inputs/links in the application.

Common Mistake

[X] Wrong: "Scanning a few pages means scanning the whole app quickly regardless of size."

[OK] Correct: Each page and its inputs must be checked, so more pages mean more work and longer scanning time.

Interview Connect

Understanding how scanning time grows helps you explain security testing challenges clearly and shows you grasp practical impacts of application size on security work.

Self-Check

"What if the application had nested components with inputs inside inputs? How would that affect the scanning time complexity?"