Cybersecurity · Intermediate level

Intermediate level · Module 3: Web and Application Security Awareness · Lesson 1 of 3

The OWASP Top 10

Learn the most common categories of web application security risk.

In this lesson you will

  • Explain the purpose of the OWASP Top 10
  • Describe several common risk categories

Key concepts

OWASPbroken access controlinjectioncryptographic failures

The lesson

The OWASP Top 10 is a widely used awareness document listing the most critical web application security risk categories.

Broken access control lets users see or change data they should not — for example, changing a number in a web address to view another person's record. Injection happens when untrusted input is treated as a command, such as in SQL queries.

Cryptographic failures expose sensitive data through missing or weak encryption. Developers prevent these with access checks on every request, parameterised queries and strong encryption.

Step by step

  1. Read the Top 10 category summaries.
  2. Match five scenarios to categories.
  3. Write the defence for each.
  4. Discuss which matter most for a small NGO site.

Practice activity

Map the scenarios to OWASP categories and defences.

Expected result: Correct mappings with defences explained in plain language.

Check your understanding

  1. What is broken access control?

    Show answer

    Users can access or change data beyond their permissions.

  2. How do developers prevent SQL injection?

    Show answer

    With parameterised queries.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.