What’s new in the OWASP Top 10 for 2023?

Security is top of mind in a lot of businesses. The threat landscape is so dangerous that everyone is looking for some way to lower their risk profile. That's one of the reasons why the OWASP Top 10 list is greeted with such enthusiasm — it lays out the most significant threats based on an assessment across many enterprises.

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software through community-led open-source software projects. It periodically releases the OWASP Top 10 list, which outlines the 10 most critical security concerns for web application security.

So what’s new on the OWASP Top 10 list for 2023? Well, the last update was in 2021, and it’s typically updated every three to four years. So the next update isn’t expected around 2025.

However, the 2021 list had significant changes. Instead of focusing squarely on vulnerability classification, the newest version introduces broader categories with more attention given to the degree of exploitability and the overall impact of a potential threat.

Infosec Skills author John Wagnon spoke about the list on a recent Cyber Work Podcast.

"The top 10 list covers the biggest risks in the world of web applications today," said Wagnon. "When you look at the newest list, it's a bit broader, and they've really gone after the root cause rather than the symptom."

OWASP Top 10 changes

A new item on the list is cryptographic failures. It encompasses items that were part of the previous top 10 list, such as sensitive data exposure. Why? The reason that sensitive data is being exposed everywhere is usually because of underlying cryptography problems.

In the top position on the list is broken access control. Wagnon explained that the modern network deals with applications that are available to people working from home, operating in a coffee shop, doing tasks mid-flight or traveling to different customer sites, often internationally. That brings about countless access control challenges. Hence, broken access control has moved to the top of the chart.

"Number one is the most critical as the items of the OWASP list are in a criticality ranked order," said Wagnon. "However, it is important to understand that what comes up as the top 10 is based on input from companies around the world and may not necessarily be your organization's top 10."

Cryptographic failure is number two on the OWASP list, but it may be number one in a specific organization. Thus, the OWASP Top 10 list should be viewed as an awareness document that gives organizations an idea of the state of application security today.

Legacy applications

Several items from the list have been there for a great many years. After all, there are a great many applications out there that have been around for decades. Among web applications, for example, some were developed around the year 2000 that are still in use. They were created well before the advent of the cloud, virtualization, multi-core processors, containers and other modern innovations.