Skip to content
Software development
ASD ISMISM-1851

ASD ISM 1851 Secure development using OWASP API security top 10

What it says

The OWASP API Security Top 10 are mitigated in the development of web APIs.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Web API developers must address the top 10 security risks identified by OWASP to ensure safety.

When developing web applications, it's crucial to focus on the top security risks identified by the OWASP (Open Web Application Security Project) for APIs. If not addressed, these risks can make your application vulnerable to attacks, which might lead to data theft or disruption of services, potentially damaging your reputation and trust with customers.

Why it matters

Without addressing the OWASP API Security Top 10, web APIs may allow unauthorised access, data exposure, and business disruption, harming trust and finances.

How to implement

  1. Developers should familiarise themselves with the OWASP API Security Top 10 list of risks.

    This can be done by reading the latest OWASP guidelines and discussing them in team meetings to understand how these risks apply to the current API projects.

  2. IT teams should conduct regular code reviews focused on security.

    This means checking the code against OWASP's top 10 API security risks, making use of automated tools where possible, and documenting findings and resolutions.

  3. Project managers should ensure training sessions for developers about secure coding practices.

    Arrange for workshops or online courses where security experts explain how to mitigate each of the top 10 API risks in practical terms.

  4. System owners should regularly test their APIs for vulnerabilities.

    Engage external security experts to perform penetration testing, which simulates attacks on your system to identify any weaknesses that might exist.

  5. Developers should implement security checks during the build process.

    This involves integrating tools that automatically scan for vulnerabilities whenever the code changes, and setting up alerts for any issues found, so they can be quickly addressed.

Keep it running

Map API threats to the OWASP API Security Top 10; test authn/authz, validate inputs, and harden endpoints to prevent common API exploits.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The security training records of the development team.

    Look at

    The dates and the scope of the training sessions attended, particularly those related to OWASP API Security.

    Good evidence

    Outcome is recent, regular training sessions covering all top 10 risks.

  2. Check 2 of 4What an auditor asks for

    Look at

    A focus on OWASP's top 10 API risks, including identified issues and steps taken to address them.

    Good evidence

    Shows thorough reviews with clear, actionable outcomes.

  3. Check 3 of 4What an auditor asks for

    Good evidence

    Result is regular testing with detailed reports of any findings and evidence of rectifications.

  4. Check 4 of 4What an auditor asks for

    Ask for

    Records of the automated security checks integrated into the development process.

    Look at

    How often checks run and the types of vulnerabilities targeted. A successful audit will reveal frequent scans and quick, documented responses to any issues.

    Good evidence

    Includes a comprehensive, clear policy with practical mitigation strategies for each risk.

Mappings

Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.8.25Secure development lifecyclePartially meets
  • A.8.26Defining security requirements for applicationsPartially meets
  • A.8.28Secure coding practices in software developmentPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.