OWASP Top 10 overview in Cybersecurity - Mini Project: Build & Apply

OWASP Top 10 Overview

📖 Scenario: You are part of a small company's IT team. Your manager asked you to prepare a simple summary of the OWASP Top 10 security risks to share with your coworkers. This will help everyone understand the most common web application security problems.

🎯 Goal: Create a clear list of the OWASP Top 10 security risks with a brief description for each. This list will be used as a quick reference guide for your team.

📋 What You'll Learn

Create a dictionary called owasp_top_10 with the exact 10 OWASP risk names as keys and their short descriptions as values.

Create a variable called risk_threshold and set it to the number 5 to represent the top half of the list.

Use a for loop with variables risk and description to iterate over owasp_top_10.items() and create a new dictionary called top_risks containing only the first 5 risks.

Add a final key-value pair to owasp_top_10 with the key 'Summary' and a short sentence summarizing the importance of these risks.

💡 Why This Matters

🌍 Real World

Understanding the OWASP Top 10 helps developers and IT teams protect web applications from common security threats.

💼 Career

Knowledge of OWASP Top 10 is essential for roles in cybersecurity, software development, and IT security auditing.

1

Create the OWASP Top 10 dictionary

Create a dictionary called owasp_top_10 with these exact entries: 'Injection' with description 'Flaws allowing untrusted data to be executed as code.', 'Broken Authentication' with 'Failures in authentication mechanisms.', 'Sensitive Data Exposure' with 'Inadequate protection of sensitive information.', 'XML External Entities (XXE)' with 'Vulnerabilities in XML processors.', 'Broken Access Control' with 'Restrictions on authenticated users are not properly enforced.', 'Security Misconfiguration' with 'Improper configuration of security settings.', 'Cross-Site Scripting (XSS)' with 'Injection of malicious scripts into web pages.', 'Insecure Deserialization' with 'Deserialization flaws leading to remote code execution.', 'Using Components with Known Vulnerabilities' with 'Use of vulnerable software components.', and 'Insufficient Logging & Monitoring' with 'Lack of proper logging and monitoring.'.

Cybersecurity

# Create the owasp_top_10 dictionary with the exact 10 risks and descriptions
# Your code here

Hint

Use curly braces {} to create the dictionary. Each key is a string with the risk name, and each value is a string with the description.

2

Set the risk threshold

Create a variable called risk_threshold and set it to the number 5 to represent the top half of the OWASP Top 10 list.

Cybersecurity

owasp_top_10 = {
    'Injection': 'Flaws allowing untrusted data to be executed as code.',
    'Broken Authentication': 'Failures in authentication mechanisms.',
    'Sensitive Data Exposure': 'Inadequate protection of sensitive information.',
    'XML External Entities (XXE)': 'Vulnerabilities in XML processors.',
    'Broken Access Control': 'Restrictions on authenticated users are not properly enforced.',
    'Security Misconfiguration': 'Improper configuration of security settings.',
    'Cross-Site Scripting (XSS)': 'Injection of malicious scripts into web pages.',
    'Insecure Deserialization': 'Deserialization flaws leading to remote code execution.',
    'Using Components with Known Vulnerabilities': 'Use of vulnerable software components.',
    'Insufficient Logging & Monitoring': 'Lack of proper logging and monitoring.'
}
# Create risk_threshold variable and set it to 5
# Your code here

Hint

Just create a variable named risk_threshold and assign it the number 5.

3

Select the top risks using a loop

Use a for loop with variables risk and description to iterate over owasp_top_10.items(). Create a new empty dictionary called top_risks before the loop. Inside the loop, add each risk and description to top_risks until you have added risk_threshold number of risks. Use a counter variable called count initialized to 0 to track how many risks have been added.

Cybersecurity

owasp_top_10 = {
    'Injection': 'Flaws allowing untrusted data to be executed as code.',
    'Broken Authentication': 'Failures in authentication mechanisms.',
    'Sensitive Data Exposure': 'Inadequate protection of sensitive information.',
    'XML External Entities (XXE)': 'Vulnerabilities in XML processors.',
    'Broken Access Control': 'Restrictions on authenticated users are not properly enforced.',
    'Security Misconfiguration': 'Improper configuration of security settings.',
    'Cross-Site Scripting (XSS)': 'Injection of malicious scripts into web pages.',
    'Insecure Deserialization': 'Deserialization flaws leading to remote code execution.',
    'Using Components with Known Vulnerabilities': 'Use of vulnerable software components.',
    'Insufficient Logging & Monitoring': 'Lack of proper logging and monitoring.'
}
risk_threshold = 5

# Your code here

Hint

Start with an empty dictionary top_risks = {} and a counter count = 0. Use a for loop over owasp_top_10.items(). Inside the loop, check if count is less than risk_threshold. If yes, add the risk to top_risks and increase count by 1. Stop the loop when count reaches risk_threshold.

4

Add a summary to the OWASP dictionary

Add a new key-value pair to the owasp_top_10 dictionary with the key 'Summary' and the value 'These top 10 risks highlight the most critical security issues in web applications.'.

Cybersecurity

owasp_top_10['Summary'] = 'These top 10 risks highlight the most critical security issues in web applications.'
# Your code here

Hint

Use the syntax owasp_top_10['Summary'] = 'Your summary text' to add the new entry.

Practice

1. What is the main purpose of the OWASP Top 10 list?

easy

A. To highlight the most common web security risks

B. To provide a list of programming languages

C. To rank the fastest web browsers

D. To list popular web development frameworks

Solution

1. Step 1: Understand the OWASP Top 10 focus

   The OWASP Top 10 is a list created to identify the most frequent and critical security risks in web applications.

2. Step 2: Compare options with OWASP purpose

   Only To highlight the most common web security risks correctly states that it highlights common web security risks, while others are unrelated.

3. Final Answer:

   To highlight the most common web security risks -> Option A

4. Quick Check:

   OWASP Top 10 = Common web security risks [OK]

Hint: OWASP Top 10 = top web security risks [OK]

Common Mistakes:

• Confusing OWASP with programming tools
• Thinking it ranks browsers or frameworks
• Assuming it lists coding languages

2. Which of the following is a correct example of an OWASP Top 10 risk category?

easy

A. User Interface Design

B. Cloud Storage Optimization

C. Data Backup Scheduling

D. Cross-Site Scripting (XSS)

Solution

1. Step 1: Identify OWASP risk categories

   OWASP Top 10 includes risks like Cross-Site Scripting (XSS), Injection flaws, and Broken Authentication.

2. Step 2: Match options to known OWASP risks

   Only Cross-Site Scripting (XSS) matches a known OWASP risk category; others relate to unrelated IT topics.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option D

4. Quick Check:

   XSS is an OWASP risk category [OK]

Hint: Look for known security risk names like XSS [OK]

Common Mistakes:

• Choosing unrelated IT terms
• Confusing design or backup topics with security risks
• Not recognizing common OWASP terms

3. Consider this simplified list of OWASP Top 10 risks: Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities (XXE). Which risk is NOT included in this list?

medium

A. Broken Authentication

B. Injection

C. Cross-Site Scripting (XSS)

D. Sensitive Data Exposure

Solution

1. Step 1: Review the given list of risks

   The list includes Injection, Broken Authentication, Sensitive Data Exposure, and XXE.

2. Step 2: Identify which option is missing

   Cross-Site Scripting (XSS) is a common OWASP risk but is not in the provided list.

3. Final Answer:

   Cross-Site Scripting (XSS) -> Option C

4. Quick Check:

   XSS missing from list = Cross-Site Scripting (XSS) [OK]

Hint: Check which known risk is absent from the list [OK]

Common Mistakes:

• Assuming all common risks are listed
• Confusing similar risk names
• Overlooking the missing item

4. A developer wrote this statement: "SQL Injection is not part of the OWASP Top 10." What is wrong with this statement?

medium

A. SQL Injection is a type of UI design issue

B. SQL Injection is a core OWASP Top 10 risk

C. SQL Injection only affects mobile apps

D. SQL Injection is unrelated to security

Solution

1. Step 1: Understand SQL Injection's role in OWASP

   SQL Injection is a classic example of Injection flaws, which is a top OWASP risk.

2. Step 2: Evaluate the incorrect statement

   The statement denies SQL Injection's inclusion, which is false because it is a core risk.

3. Final Answer:

   SQL Injection is a core OWASP Top 10 risk -> Option B

4. Quick Check:

   SQL Injection = OWASP risk [OK]

Hint: Injection risks always include SQL Injection [OK]

Common Mistakes:

• Thinking SQL Injection is unrelated to security
• Confusing it with UI or mobile issues
• Ignoring OWASP's Injection category

5. A company wants to reduce risks from Broken Authentication and Sensitive Data Exposure. Which two actions best address these OWASP Top 10 risks?

hard

A. Implement strong password policies and encrypt sensitive data

B. Use flashy UI designs and increase server speed

C. Disable all user logins and remove data backups

D. Ignore authentication and focus on marketing

Solution

1. Step 1: Understand the risks

   Broken Authentication means weak login controls; Sensitive Data Exposure means data is not protected well.

2. Step 2: Match actions to risks

   Strong password policies improve authentication security; encrypting data protects sensitive information.

3. Final Answer:

   Implement strong password policies and encrypt sensitive data -> Option A

4. Quick Check:

   Strong passwords + encryption = reduce these risks [OK]

Hint: Match risk with security controls like passwords and encryption [OK]

Common Mistakes:

• Choosing unrelated actions like UI design
• Thinking disabling logins is practical
• Ignoring encryption for data protection