Skip to content
Software development
ASD ISMISM-1850

ASD ISM 1850 Mitigate OWASP Top 10 in web applications

What it says

The OWASP Top 10 are mitigated in the development of web applications.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Developers need to address the OWASP Top 10 security risks in web applications to enhance security.

When you're building a website or an online service, you need to pay attention to the top security risks that can cause trouble, like data breaches or hacking attempts. If these risks aren't addressed properly, your site could be vulnerable to attacks that compromise your users' information, damage your reputation, and cost you a lot of money.

Why it matters

Failing to mitigate OWASP Top 10 risks (e.g., injection, XSS, access control flaws) can cause web app compromise, data leakage and service disruption.

How to implement

  1. Developers should familiarise themselves with the OWASP Top 10 security risks.

    Start by reading the OWASP Top 10 list to understand the most common threats, such as injection attacks or data exposure, and know what each risk means for your application.

  2. The IT team should regularly test the web application for these risks.

    Use tools or hire experts to scan the website and simulate attacks to see if the website can resist these common threats. This will help you find and fix vulnerabilities.

  3. Managers should ensure developers receive security training.

    Organise workshops or online courses that explain the OWASP Top 10 and how developers can build security into their coding practices.

  4. Project managers should incorporate security checks into the development timeline.

    Add steps in the project plan where developers must review code for security risks and get sign-off before moving to the next phase of development.

  5. The security team should monitor and update the web application continuously.

    Keep track of updates from the OWASP community and ensure the website is updated to handle new threats as they arise.

Keep it running

Bake OWASP Top 10 mitigations into SDLC: secure coding standards, threat modelling, SAST/DAST, dependency scans, and regular remediation of findings and retesting.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The OWASP Top 10 awareness training records: Request documentation showing developers attended training sessions.

    Look at

    Details like the date, content covered, and attendees' signatures.

    Good evidence

    Includes recent training dates, comprehensive content, and full attendance.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see recent security assessments of the web application.

    Look at

    The dates of the scans, what was tested, and any vulnerabilities found.

    Good evidence

    Shows regular, complete scans with identified issues addressed timely.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Security sign-off documents in project plans: Request documents detailing security reviews in development phases.

    Look at

    Checklists or sign-offs were completed at each stage.

    Good evidence

    Will show sign-offs with dates from relevant team members indicating security checks were completed.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Records of recent security patches and updates applied.

    Look at

    The update descriptions and check if they align with known OWASP risks.

    Good evidence

    Includes recent updates that correspond with identified risks.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Incident response reports: Request records of any past security incidents and how they were managed.

    Look at

    Documented steps taken to resolve the issue and prevent reoccurrence.

    Good evidence

    Will show clear steps, responsible persons, and follow-up actions.

Mappings

Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.

ISO 27001

ISO/IEC 27001: 5 mappings

  • A.8.25Secure development lifecyclePartially meets
  • A.8.26Defining security requirements for applicationsPartially meets
  • A.8.27Secure system architecture and engineering principlesPartially meets
  • A.8.28Secure coding practices in software developmentPartially meets
  • A.8.29Security testing in development and acceptanceDepends on

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.