OWASP Top 10

The OWASP Top 10 is a short list of the ten most common ways a website or a web application gets broken into. A group of security volunteers called OWASP writes it and updates it every few years. Nobody sells it, so anyone can sit down and read the whole thing in an afternoon.

The list is useful because the same mistakes keep happening. One is a staff account that opens every customer record instead of only its own, and another is a login page that lets a thief try a thousand passwords in a minute. Worse still is a search box that hands whatever you type straight to the database, so a visitor types a command and reads the whole table. Then come the plain ones, like a password kept as readable text, or an upload form that takes a program dressed up as a photo. Last is borrowed code nobody has updated in three years, with a hole anyone can look up online.

Notice what those have in common, because not one of them is clever. They are ordinary errors made by tired people near a deadline, and it is machines that find them. Scanners sweep millions of addresses a day looking for exactly these faults, which is the honest part most sales pages leave out. Most break-ins are not aimed at you at all, because your site was simply on a list. When Linkysoft is handed a system somebody else built, the first pass through this list almost always finds something.

So here is the best question to ask a software supplier before you sign. Show me how you test against the OWASP Top 10, and show me the report from the last time you ran it. A supplier who works this way answers in a minute and sends you a file, while one who never has will talk about firewalls, encryption and how careful the team is. That vague answer is the warning, so ask in the first meeting rather than after the build, because changing a design later costs several times more than getting it right once.

Linkysoft runs that check before a web application goes live, and again after every large change, because a new feature can quietly reopen an old hole. If your system is already running and nobody has ever tested it, then a short security review is the cheaper place to begin. Three days of proper testing usually tells an owner more than a year of worrying.