rebuild

Career/Security/OWASP Top 10.md

@@ -0,0 +1,18 @@
+This stands for Open Web Application Security Project. 
+
+It is a non profit foundation which publishes the OWASP top 10, which is a standard document that identifies the most critical security risks to web applications.
+
+Current edition: **OWASP Top 10:2025**
+
+The 2025 list ranks risks as follows:
+
+- **A01:2025 Broken Access Control**: Remains the #1 risk, covering unauthorized access and privilege escalation; includes [[Server-Side Request Forgery (SSRF)]]. 
+- **A02:2025 Security Misconfiguration**: Moved up to #2, highlighting insecure defaults, exposed services, and inconsistent controls. 
+- **A03:2025 Software Supply Chain Failures**: A new, expanded category (from "Vulnerable and Outdated Components") covering dependencies, CI/CD systems, and distribution infrastructure. 
+- **A04:2025 Cryptographic Failures**: Covers insecure encryption, weak key management, and data exposure. 
+- **A05:2025 Injection**: Includes SQL, OS, and template injection flaws. 
+- **A06:2025 Insecure Design**: Focuses on architectural weaknesses and lack of threat modeling. 
+- **A07:2025 Authentication Failures**: Covers weak login flows, session handling, and password policies. 
+- **A08:2025 Software or Data Integrity Failures**: Addresses tampering with code, data, or CI/CD pipelines. 
+- **A09:2025 Security Logging & Alerting Failures**: Highlights gaps in monitoring that allow attacks to go undetected. 
+- **A10:2025 Mishandling of Exceptional Conditions**: A new category focusing on unsafe error handling and system resilience during failures.