What is the OWASP Top 10? Name the categories and a prevention for each

OWASP (Open Worldwide Application Security Project) is a non-profit community that publishes free application-security resources. The OWASP Top 10 is an awareness document listing the most critical categories of web application security risk. It is built from vulnerability data contributed by many organisations, plus a community survey, and is revised every few years. The 2025 edition followed the 2021 one. Check owasp.org for the current list.

OWASP Top 10: 2025 (concept, and a key prevention)

1. A01 Broken Access Control: users act outside their permissions. → Deny by default; enforce authorisation on the server for every request and object (is this record theirs?); test it.
2. A02 Security Misconfiguration: default accounts, verbose errors, unnecessary features, missing security headers. → Hardened, repeatable configuration; disable what you do not use; automated configuration checks.
3. A03 Software Supply Chain Failures: vulnerable, outdated or compromised dependencies, build tools and pipelines. → Keep an inventory (an SBOM), patch promptly, pin and verify packages, secure the CI/CD pipeline.
4. A04 Cryptographic Failures: sensitive data unprotected or weakly protected. → TLS everywhere, strong standard algorithms, proper key management, slow salted hashes for passwords.
5. A05 Injection (SQL, OS command and others; since the 2021 edition, cross-site scripting is grouped here too): untrusted data interpreted as code or commands. → Parameterised queries, context-aware output encoding, safe APIs, allow-list validation.
6. A06 Insecure Design: missing security controls at the design level. → Threat modelling, secure design patterns, abuse-case thinking.
7. A07 Authentication Failures: weak login, credential stuffing, poor session handling. → MFA, rate limiting, breached-password checks, secure session management.
8. A08 Software or Data Integrity Failures: trusting updates, plugins or serialised data without verifying them. → Signatures and integrity checks; avoid unsafe deserialisation of untrusted data.
9. A09 Security Logging and Alerting Failures: attacks go unnoticed. → Log security-relevant events, protect the logs, alert on suspicious patterns, have an incident-response plan.
10. A10 Mishandling of Exceptional Conditions (new in 2025): errors and edge cases handled in ways that fail open, leak information or leave inconsistent state. → Fail safely (deny on error), handle errors centrally, never show stack traces to users.

How to use it

• It is an awareness baseline and training checklist, not a complete standard.
• For requirements and testing, use the OWASP ASVS (Application Security Verification Standard), the OWASP Cheat Sheet Series and the Web Security Testing Guide.
• Build the controls into the development process: secure defaults in frameworks, code review, SAST/DAST and dependency scanning in CI, and regular authorised testing.

In an interview, naming the categories matters less than explaining one or two in depth, such as access control or injection, with concrete prevention.