Practicing and exploring
Test your knowledge and understanding by answering some questions, getting some hands-on practice, and exploring the topics covered in this chapter with deeper research.
Exercise 12.1 – Online-only material
The OWASP Top 10 is primarily an awareness document. If you want to use the OWASP Top 10 as a coding or testing standard, you must accept that it is just a starting point.
One of the difficulties of using the OWASP Top 10 as a standard is that its goal is to document ranked security risks, not to identify security issues that are easily testable. You cannot comprehensively detect, test, or protect against the full OWASP Top 10 due to the nature of several of the risks. For example, A04:2021 – Insecure Design is impossible to test automatically with a tool.
OWASP encourages anyone wanting to adopt an application security standard to use the OWASP Application Security Verification Standard (ASVS), as it’s designed to be...