OWASP Top 10

The OWASP Top 10 describes broad categories of web application security risk rather than ten individual attacks or a complete testing standard. Its categories and rankings change between editions, so requirements and assessment results should identify the edition being used. Examples of the risks it addresses include broken access control, injection, security misconfiguration, and weaknesses in authentication or software integrity. Use it to organize threat modeling, security reviews, and remediation priorities, not as proof that an application is secure.

In cloud environments, responsibility is distributed across application code, managed services, identity policies, network boundaries, and deployment pipelines. A managed database does not prevent SQL injection when an application constructs queries by concatenating untrusted input. Parameterized queries address that vulnerability directly, while a web application firewall can provide an additional filtering layer. Similarly, an authenticated API that accepts an account identifier must verify that the caller may access that account; an edge firewall generally cannot determine business-level ownership.

At the network edge, a web application firewall inspects supported HTTP request components and applies rules for suspicious payloads, known attack patterns, and request rates. On AWS, AWS WAF can protect supported resources such as Amazon CloudFront distributions and Application Load Balancers. Managed rule groups can reduce exposure to common exploit attempts, but their coverage is not a one-to-one implementation of every OWASP category. Inspection limits, encoded payloads, excluded fields, and application-specific behavior can leave gaps.

For example, an online store might place CloudFront and AWS WAF in front of its application, enable relevant managed rules, and use rate-based rules to limit repeated abusive requests. Before enforcing newly introduced rules, engineers can evaluate them in Count mode, inspect logs, and test legitimate traffic. False positives should lead to narrowly scoped exceptions rather than disabling an entire protection layer. Restrict origin access as well: use origin access control for an S3 origin and suitable access restrictions for other origin types so attackers cannot simply bypass the protected entry point.

Response headers complement request filtering. A CloudFront response headers policy can deliver Strict-Transport-Security, Content-Security-Policy, and anti-framing controls to browsers. These headers support transport and browser-side defenses, but they do not repair insecure authorization or unsafe query construction. A content security policy must match the application's actual resource requirements; a permissive policy provides little protection, while an overly restrictive policy can break legitimate functionality.

Cross-origin resource sharing is another frequently misunderstood control. Amazon S3 CORS configuration tells browsers which cross-origin interactions are permitted; it does not grant S3 permissions or stop nonbrowser clients from sending requests. Configure allowed origins, methods, and headers narrowly, retain appropriate bucket and identity policies, and ensure CDN caching does not serve an inappropriate CORS response across origins. Likewise, AWS IoT Core policies should restrict device actions and topic resources, but MQTT authorization is not something an HTTP-focused web application firewall replaces.

DDoS protection and application vulnerability protection also solve different problems. AWS Shield Advanced provides enhanced DDoS protection and response capabilities for supported resources; its application-layer protections work with AWS WAF where supported. It does not fix injection, insecure design, or broken access control. Effective coverage combines edge controls with secure coding, least privilege, dependency maintenance, outbound request restrictions, logging, and security testing. For exam scenarios, identify the underlying failure first, then select the control that addresses it rather than assuming one edge service covers the entire Top 10.