How Beagle View of OWASP Top-10 Can Restrict the Optimal Web-App Security: The Security Ladder for Optimal Posture - Ashish Kumawat; Kiran Gunturu; Aditya Sharad Bhosale (International Journal of Information Security Engineering, 2025)
Is OWASP Top-10 good enough to ensure that your web application is secure enough? When it comes to application security, many of us in the information security community, are generally overwhelmed with the OWASP Top-10. Even when we deliberate with developers, OWASP Top-10 is on top of our agenda, and surprisingly the only agenda in many discussions. The approach adopted for this paper is two-pronged: Secondary data – Open source, literature review; Primary data – Proof of concept for those vulnerabilities which are not covered by OWASP Top-10. As part of our study, we have demonstrated how OWASP Top-10 can cover a variety of vulnerabilities while there can be vulnerabilities which remain uncovered in OWASP Top-10. Our findings suggest that remaining focused just on one framework may not be an optimal strategy. To overcome this bias, we have suggested a security ladder methodology which can suit a variety of organizations and can cater to an optimal web app security posture.
Keywords: Cybersecurity; OWASP Top-10; security ladder; threat modeling; web-application security