owasp-security skill

Comprehensive OWASP Security Skills

A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies.

Quick Navigation

1. OWASP Top 10 (2021)
2. OWASP ASVS 5.0
3. OWASP MASVS v2.1.0
4. OWASP API Security Top 10
5. OWASP Kubernetes Top 10
6. OWASP Agentic Applications 2026

Section 1: OWASP Top 10 (2021)

The OWASP Top 10 represents the most critical security risks in web applications.

A01: Broken Access Control

Detection: URLs with direct ID references (/user/1234/orders); client-side only enforcement; missing authorization checks. Mitigation: Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. Example:

// INSECURE: No authorization check
app.get('/users/:id/orders', (req, res) => {
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
// SECURE: Authorization check
app.get('/users/:id/orders', (req, res) => {
  if (req.user.id !== parseInt(req.params.id)) return res.status(403).json({error: 'Forbidden'});
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});

Checklist: ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields

A02: Cryptographic Failures

Detection: Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code. Mitigation: Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs. Example:

# INSECURE: API key in code
api_key = "sk-abc123xyz789"

# SECURE: From environment
import os
api_key = os.getenv("API_KEY")
if not api_key: raise ValueError("API_KEY not set")

Checklist: ☐ HTTPS enforced ☐ AES-256 encryption at rest ☐ No secrets in code ☐ Sensitive data masked in logs

A03: Injection (SQL, Command, NoSQL)

Detection: String concatenation in queries; exec, query, run with user input; no prepared statements. Mitigation: Use parameterized queries; whitelist input; avoid string concatenation; use safe APIs (subprocess.run with list args). Example:

# INSECURE: String concatenation
os.system("tar -czf " + filename + " /var/data")

# SECURE: List-based API
import subprocess
subprocess.run(["tar", "-czf", filename, "/var/data"], check=True)

Checklist: ☐ Parameterized queries only ☐ No string concat ☐ Whitelist input ☐ Safe subprocess calls

A04: Insecure Design

Detection: No threat modeling; missing security controls by design; no authentication/authorization from the start. Mitigation: Implement threat modeling early; design security in from the beginning; use established security libraries/patterns. Checklist: ☐ Threat modeling completed ☐ Security controls in design ☐ Auth/authz from start ☐ Security review in SDLC

A05: Security Misconfiguration

Detection: Debug mode enabled; default credentials; verbose error messages; missing security headers; exposed APIs. Mitigation: Disable debug mode; change defaults; hide version info; implement security headers (HSTS, CSP, X-Frame-Options). Example:

# INSECURE: Debug enabled in production
app.debug = True

# SECURE: Debug disabled
app.debug = False
app.config['HSTS_MAX_AGE'] = 31536000

Checklist: ☐ Debug disabled ☐ Defaults changed ☐ Security headers set ☐ No version disclosure

A06: Vulnerable & Outdated Components

Detection: Old versions in package.json/requirements.txt; unpatched frameworks; deprecated libraries. Mitigation: Regularly audit dependencies with npm audit, pip safety, Snyk; remove unused packages; keep frameworks patched. Checklist: ☐ Dependency audits regular ☐ No outdated versions ☐ Unused deps removed ☐ CI/CD security scanning

A07: Authentication Failures

Detection: Weak passwords; no MFA; predictable session IDs; weak password reset tokens; no rate limiting on login. Mitigation: Hash passwords (bcrypt/Argon2); implement MFA; generate cryptographically secure session IDs; rate-limit failed attempts. Checklist: ☐ Strong password hashing ☐ MFA available ☐ Secure session IDs ☐ Rate limiting on login

A08: Software/Data Integrity Failures

Detection: Unsigned updates; unverified dependencies; unsafe deserialization (pickle, Java ObjectInputStream). Mitigation: Sign and verify all updates; use JSON instead of native serialization; whitelist allowed classes; verify checksums. Checklist: ☐ Updates signed/verified ☐ JSON used for serialization ☐ No unsafe deserialization ☐ Checksums verified

A09: Logging & Monitoring Failures

Detection: No security event logging; logs contain secrets; no centralized logging; no alerts for anomalies. Mitigation: Log authentication events, access denials, config changes; centralize logs; implement alerts for suspicious patterns. Checklist: ☐ Security events logged ☐ No secrets in logs ☐ Logs centralized ☐ Alerts for anomalies

A10: Server-Side Request Forgery (SSRF)

Detection: App fetches URLs from user input; no URI validation; internal IP ranges accessible. Mitigation: Validate/sanitize URLs; whitelist domains; block internal IP ranges (10.0.0.0/8, 127.0.0.1); use allowlists. Checklist: ☐ URLs validated ☐ Domains whitelisted ☐ Internal IPs blocked ☐ Protocols restricted

Section 2: OWASP ASVS 5.0 (Application Security Verification Standard)

ASVS defines security requirements across three verification levels (L1: Basic, L2: Standard, L3: Advanced).

Authentication Requirements

Access Control Requirements

Cryptography Requirements

Input Validation & Encoding

Session Management

Section 3: OWASP MASVS v2.1.0 (Mobile Security)

Mobile applications require specialized security attention due to unique threat models: device-specific vulnerabilities, platform differences (iOS vs Android), and user data sensitivity.

What it is: MASVS defines 8 control groups with L1/L2/L3 verification levels for mobile app security.

When to use: Any iOS or Android app security review, secure storage implementation, biometric authentication, network communication hardening.

Core Control Groups

STORAGE — Protecting Sensitive Data at Rest

L1 Requirements:

• Sensitive credentials never stored in plaintext
• Exclude sensitive data from backups
• Use platform credential storage APIs

iOS Implementation (Secure):

import Security

func storePassword(account: String, password: String) {
    let passwordData = password.data(using: .utf8)!
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: account,
        kSecValueData as String: passwordData,
        kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
    ]
    SecItemAdd(query as CFDictionary, nil)
}

Android Implementation (Secure):

import androidx.security.crypto.EncryptedSharedPreferences
import androidx.security.crypto.MasterKeys

val masterKey = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
val encryptedSharedPreferences = EncryptedSharedPreferences.create(
    "secret_shared_prefs",
    masterKey,
    context,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
encryptedSharedPreferences.edit().putString("api_key", "secret").apply()

CRYPTO — Cryptographic Standards

L1 Requirements: No hardcoded keys, AES-256 for encryption, SHA-256 for hashing L2 Requirements: Secure key storage, proper key derivation (PBKDF2), authenticated encryption (GCM mode) L3 Requirements: HSM integration, key rotation, cryptographic agility

AUTH — Authentication & Biometric Security

Secure Biometric Implementation (iOS):

import LocalAuthentication

func authenticateWithBiometric() {
    let context = LAContext()
    let reason = "Authenticate to access sensitive data"
    
    context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, 
                          localizedReason: reason) { success, error in
        if success {
            // Re-authenticate for critical operations
            KeychainManager.retrieveToken()
        }
    }
}

NETWORK — TLS & Certificate Pinning

L1 Requirements: TLS 1.2+ for all communications L2 Requirements: Certificate pinning implementation L3 Requirements: Mutual TLS (mTLS) support