The OWASP Top Ten Proactive Controls describes the most important controls and control categories that every architect and developer should absolutely, 100% include in every project. Gain insights into best practices for utilizing generative AI coding tools securely in our upcoming live hacking session. Databases are often key components for building rich web applications as the need for state and persistency arises. Make sure you track the use of open source libraries and maintain an inventory of versions, their licenses and vulnerabilities such as OWASP’s top 10 vulnerabilities using tools like OWASP’s Dependency Check or Snyk.

Recently, I was thinking back at a great opening session of DevSecCon community we had last year, featuring no other than Jim Manico.

OWASP top 10 Proactive Controls 2020

These techniques should be applied proactively at the early stages of software development to ensure maximum effectiveness. However, development managers, product owners, Q/A professionals, program managers, and anyone involved in building software can also benefit from this document. As application developers, we are used to logging data that helps us debug and trace issues concerning wrong business flows or exceptions thrown.

Another example is the question of who is authorized to hit APIs that your web application provides. It lists security requirements such as authentication protocols, session management, and cryptographic security standards. Most importantly, the ASVS provides a phased approach to gradually implement security requirements as you are making your first steps. The checklists that follow are general lists that are categorised to follow the controls listed in the
OWASP Top 10 Proactive Controls project. These checklists provide suggestions that certainly should be tailored to
an individual project’s requirements and environment; they are not meant to be followed in their entirety. Probably the best advice on checklists is given by the Application Security Verification Standard (ASVS).

2. Web application checklist

The OWASP Top Ten Proactive Controls 2018 is a list of security techniques that should be considered for every software development project. This document is written for developers to assist those new to secure development. One of the main goals of this document is to provide concrete practical guidance that helps developers build secure software.

A prominent OWASP project named Application Security Verification Standard—often referred to as OWASP ASVS for short—provides over two-hundred different requirements for building secure web application software. It’s highly likely that access control requirements take shape throughout many layers of your application. For example, when pulling data from the database in a multi-tenant SaaS application, where you need to ensure that data isn’t accidentally exposed for different users.

Link to the OWASP Top 10 Project

Security-focused logging is another type of data logs that we should strive to maintain in order to create an audit trail that later helps track down security breaches and other security issues. It is owasp controls impractical to track and tag whether a string in a database was tainted or not. Instead, you build proper controls in the presentation layer, such as the browser, to escape any data provided to it.

This document is intended to provide initial awareness around building secure software. This document will also provide a good foundation of topics to help drive introductory software security developer training. These controls should be used consistently and thoroughly throughout all applications. However, this document should be seen as a starting point rather than a comprehensive set of techniques and practices. In order to achieve secure software, developers must be supported and helped by the organization they author code for.