Foreword

Foreword

Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure. As our software becomes increasingly complex, and connected, the difficulty of achieving application security increases exponentially. The rapid pace of modern software development processes makes the most common risks essential to discover and resolve quickly and accurately. We can no longer afford to tolerate relatively simple security problems like those presented in this OWASP Top 10.
A great deal of feedback was received during the creation of the OWASP Top 10 - 2017, more than for any other equivalent OWASP effort. This shows how much passion the community has for the OWASP Top 10, and thus how critical it is for OWASP to get the Top 10 right for the majority of use cases.
Although the original goal of the OWASP Top 10 project was simply to raise awareness amongst developers and managers, it has become the de facto application security standard.
In this release, issues and recommendations are written concisely and in a testable way to assist with the adoption of the OWASP Top 10 in application security programs. We encourage large and high performing organizations to use the OWASP Application Security Verification Standard (ASVS) if a true standard is required, but for most, the OWASP Top 10 is a great start on the application security journey.
We have written up a range of suggested next steps for different users of the OWASP Top 10, including What’s Next for Developers, What’s Next for Security Testers, What’s Next for Organizations, which is suitable for CIOs and CISOs, and What’s Next for Application Managers, which is suitable for application managers or anyone responsible for the lifecycle of the application.
In the long term, we encourage all software development teams and organizations to create an application security program that is compatible with your culture and technology. These programs come in all shapes and sizes. Leverage your organization’s existing strengths to measure and improve your application security program using the Software Assurance Maturity Model.
We hope that the OWASP Top 10 is useful to your application security efforts. Please don’t hesitate to contact OWASP with your questions, comments, and ideas at our GitHub project repository:
* https://github.com/OWASP/Top10/issues
You can find the OWASP Top 10 project and translations here:
* https://owasp.org/www-project-top-ten

Lastly, we wish to thank the founding leadership of the OWASP Top 10 project, Dave Wichers and Jeff Williams, for all their efforts, and believing in us to get this finished with the community’s help. Thank you!

* Andrew van der Stock
* Brian Glas
* Neil Smithline
* Torsten Gigler

Project Sponsorship

Thanks to Autodesk for sponsoring the OWASP Top 10 - 2017.
Organizations and individuals that have provided vulnerability prevalence data or other assistance are listed on the Acknowledgements page.