Review: Akamai's White Paper on the OWASP Top 10 (2021)

I recently went through Akamai's white paper on the OWASP Top 10 Software Security Vulnerabilities. While the paper highlights Akamai's services, I want to share a simplified breakdown of the vulnerabilities themselves.

Here is what every developer should know:

1. Broken Access Control

The "who can do what" rules are bypassed.

The Risk: Users accessing data they should not (e.g., changing a URL ID to see someone else's profile).

The Fix: Deny by default. Use server-side checks for every single request.

2. Cryptographic Failures

Moving away from the term "Sensitive Data Exposure" to focus on the root: failing to protect data in transit or at rest.

The Risk: Using HTTP instead of HTTPS, or weak hashing (like MD5) for passwords.

The Fix: Use TLS 1.3, salt/hash passwords with Argon2 or bcrypt, and never commit keys to GitHub.

3. Injection

A classic. Untrusted data is "injected" into a command or query.

The Risk: SQLi, NoSQL injection, or command injection where user input deletes a database.

The Fix: Use parameterized queries (Prepared Statements) and validate/sanitize all input.

4. Insecure Design

A new category in 2021. It is not a coding error; it is a failure in the architecture.

The Risk: A logic flaw, like a password reset flow that uses easily guessable security questions.

The Fix: Use threat modeling before writing the first line of code.

5. Security Misconfiguration

When systems are not hardened.

The Risk: Leaving default "admin/admin" credentials, or detailed error messages (stack traces) exposed to users.

The Fix: Disable unused features and automate your configuration audits.

6. Vulnerable and Outdated Components

Using "Lego blocks" (libraries) that have known holes.

The Risk: An old version of Log4j or an npm package with a CVE.

The Fix: Use tools like npm audit or Snyk to track and update dependencies.

7. Identification and Authentication Failures

Issues with confirming the user's identity.

The Risk: Permitting weak passwords or allowing credential stuffing (brute force) attacks.

The Fix: Implement Multi-Factor Authentication (MFA) and session timeouts.

8. Software and Data Integrity Failures

Relying on software/data without verifying its source.

The Risk: A malicious update in your CI/CD pipeline or an untrusted library.

The Fix: Use digital signatures and verify checksums for all downloads.

9. Security Logging and Monitoring Failures

The "Silent Killer." If you do not log it, it did not happen.

The Risk: A breach occurs, but there is no audit trail to find out how or when.

The Fix: Ensure all login and high-value transactions are logged (but redact sensitive info).

10. Server-Side Request Forgery (SSRF)

The server is tricked into making a request to an internal resource.

The Risk: An attacker uses your server to "reach inside" your network to steal cloud metadata or internal files.

The Fix: Use allow-lists for destination domains and block local/metadata IP ranges.

Source & Credits