OWASP – Open Worldwide Application Security Project

OWASP – the Open Worldwide Application Security Project is a nonprofit foundation and open community dedicated to making software security visible, so that individuals and organizations can make informed decisions about risk. Founded in 2001, it was originally named the Open Web Application Security Project; in 2023 the foundation adopted its current name to reflect a remit that had grown beyond web applications to software security at large. It is vendor-neutral, volunteer-driven, and publishes all of its material free and open-source.

OWASP is best known for community-built projects that have become reference points for practitioners.

  • Top 10. A periodically refreshed list of the most critical risks to web applications, drawn from incident and vulnerability data. The Top 10 is less a complete threat model than a consciousness-raising device, surfacing the categories that account for most real-world breaches. Cross-site scripting (XSS), SQL injection, and broken access control are perennial entries, and server-side request forgery (SSRF) joined the list in the 2021 edition.
  • Cheat Sheet Series. Concise, code-level defensive guidance for specific concerns such as input validation, authentication, and serialization, written for working developers rather than security specialists.
  • Application Security Verification Standard (ASVS). A tiered checklist of verifiable security requirements, used to scope security testing and audits.
  • Software Assurance Maturity Model (SAMM). A maturity framework for measuring and improving an organization’s secure-software practices, complementary to secure by design thinking.
  • Testing Guide and tooling. The OWASP Testing Guide catalogs manual and automated test techniques, while projects such as the Zed Attack Proxy (ZAP) and Dependency-Track support penetration testing and software composition analysis against data from vulnerability databases.

The foundation also supports local chapters and the AppSec conference series, and acts as an umbrella for hundreds of member projects. Its influence is partly normative: the Top 10 and ASVS are routinely cited in compliance regimes, procurement requirements, and security training, which gives OWASP’s volunteer output a reach that few standards bodies match.

See also

References