Certificate Topics — Learning the OWASP Top 10 (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Law Enforcement track Certificate behind this topic: "Learning the OWASP Top 10" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 29, 2025) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911. It is community-designed training, not agency policy, and school completion is a school achievement only — not a law-enforcement rank, title, or credential.

Before you start

• This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• This is a defender's orientation, not a hacking course: you will learn what each of the ten risks is, how it shows up in real breaches, and the defensive principle behind the fix — enough to recognise risk, ask vendors hard questions, and protect the services your community uses.
• Minister Destiny Marie Morgan earned the certificate behind this topic while studying how applications fail. This unit teaches OWASP's own public list, in this school's own words — nothing here teaches anyone to break into a system.

The lesson

Part 1. What OWASP Is, and What the Top 10 Is For

OWASP — the Open Worldwide Application Security Project — is a nonprofit community that publishes free, open guidance on application security. Its best-known publication, the OWASP Top 10, is an awareness document: the ten broad categories of web application risk OWASP judges most critical, derived from contributed data and expert survey. The current established edition is the 2021 list, used throughout this unit. It is a starting point for defenders, developers, managers, and buyers — a shared vocabulary, not a complete catalogue of everything that can go wrong.

Hold its purpose firmly, because Part 6 returns to it: the Top 10 tells you what to look for and talk about. OWASP's companion materials — its Cheat Sheet Series and its Application Security Verification Standard — go deeper on how to build and check defences. In this unit each category follows the same pattern: plain-language meaning, how it appears in the real world, and the defensive principle. Learn the pattern and you can reason about applications you have never seen.

Part 2. The First Three — Access Control, Cryptography, Injection

A01 Broken Access Control sits at number one because it is everywhere: the application checks who you are but not what you are allowed to do, so an ordinary user views or changes another person's records by guessing an address or a record number. The defensive principle is deny by default and check permission on the server for every request — never trust that hiding a button is protection. In breach after breach, this is how private records — including records held by agencies and their vendors — quietly became public.

A02 Cryptographic Failures covers data protected weakly or not at all: passwords stored recoverably, sensitive data sent or kept without proper encryption, outdated methods kept from habit. The principle: protect data in transit and at rest with current, standard cryptography, and collect less sensitive data in the first place. A03 Injection is the classic: untrusted input is treated as a command — to a database, an operating system, or a browser — because the application failed to separate data from instructions. The principle is to use safe, parameterised interfaces and validate input, so what a user types can never become what the system obeys.

Part 3. Design and Configuration — The Middle of the List

A04 Insecure Design is the 2021 list's important argument: some failures are not coding mistakes but missing design decisions — no limit on how many times a sensitive action can be attempted, no thought about how a feature could be abused. You cannot patch a design that never considered the threat; the principle is to design with abuse cases in mind from the first sketch, using threat modelling proportionate to the stakes.

A05 Security Misconfiguration is the unglamorous giant: default passwords unchanged, unnecessary features left on, error messages that lecture attackers, cloud storage left open to the internet. It appears constantly in breach reporting precisely because it needs no brilliance to exploit — only a scanner. The principle is a repeatable, hardened configuration, reviewed on a cycle, with defaults treated as incidents waiting. A06 Vulnerable and Outdated Components completes the middle: modern applications are mostly assembled from libraries and frameworks, and running a component with a known, publicised flaw is an engraved invitation. The principle: keep an inventory of components, watch their security notices, and patch on a schedule — the application-world twin of the asset inventory from programme building.

Part 4. Identity, Integrity, Watching, and the Server Tricked

A07 Identification and Authentication Failures covers how applications decide who you are: weak password rules, logins that allow unlimited guessing, sessions that never expire or are easy to steal. The defensive principles are multi-factor authentication, sane limits on attempts, and proper session handling — the same habits awareness programmes teach users, enforced here by the system itself.

A08 Software and Data Integrity Failures is about trusting things you should verify: updates accepted without checking their signature, data from untrusted sources treated as safe. The principle is verification — signed updates, integrity checks, a pipeline that proves software is what it claims to be. A09 Security Logging and Monitoring Failures is the quiet one: attacks that succeed because nobody was watching — insufficient logs, alerts nobody reads, breaches discovered months later by outsiders. The principle: log what matters, alert on it, and make sure a human's job includes the watching. A10 Server-Side Request Forgery (SSRF) closes the list: an attacker tricks the server itself into making requests — to internal addresses the attacker cannot reach directly. The principle: the server must validate and restrict what it will fetch, because its position inside the network makes its requests privileged.

Part 5. How These Flaws Appear in Real Breaches

Read breach reporting with the Top 10 in hand and a pattern emerges: the categories combine. A misconfigured service (A05) exposes an application still running an outdated component (A06); broken access control (A01) lets the intruder browse records at leisure; absent logging (A09) means the browsing runs for months before an outsider notices. The famous headline is the entry point; the damage is usually done by the boring categories afterwards. That is why defenders study the list as a system, not as trivia.

For law-enforcement readers, one more pattern matters: public-facing portals — records requests, evidence-adjacent systems, vendor-hosted forms — are applications too, often built or run by third parties. The Top 10 is your inspection language for them. You do not need to test a vendor's system yourself; you need to know which questions have real answers and which answers are mist. Part 6 gives you those questions.

Part 6. What to Ask a Vendor or Developer — and the Limits of the List

Ask, and write down the answers: How do you enforce access control on the server side, for every request? How is sensitive data encrypted in transit and at rest, and how are passwords stored? How do you prevent injection — do you use parameterised queries throughout? What is your patch rhythm for components, and how do you tell us when one is critically flawed? Is multi-factor authentication available — and enforced for administrators? What do you log, who watches it, and how quickly would you tell us about an incident? How are your updates signed and verified?

Finally, know the list's limits, as OWASP itself states them: the Top 10 is a minimum awareness floor, not a guarantee and not a compliance stamp. An application can pass a Top-10 review and still fail in ways the list does not cover. Use it as the start of the conversation — with developers, vendors, and your own risk register — never as the end of one.

Words to know — Learning the OWASP Top 10

• OWASP — The Open Worldwide Application Security Project, a nonprofit community publishing free application-security guidance.
• Broken Access Control — A01:2021 — users can act beyond their permissions because the application fails to check what they are allowed to do.
• Cryptographic Failures — A02:2021 — sensitive data exposed through weak, outdated, or missing encryption and related protections.
• Injection — A03:2021 — untrusted input is executed as a command because data and instructions were not separated.
• Insecure Design — A04:2021 — risk built in at the design stage, where abuse cases and controls were never considered.
• Security Misconfiguration — A05:2021 — unsafe defaults, unnecessary features, or careless settings left in place.
• Vulnerable and Outdated Components — A06:2021 — libraries, frameworks, or platforms with known flaws kept in service unpatched.
• SSRF (Server-Side Request Forgery) — A10:2021 — an attacker tricks the server into making requests to places the attacker cannot reach directly.
• Threat modelling — Thinking through, at design time, how a system could be abused and what controls that requires.
• Defence in depth — Layering several independent protections so one failure does not expose everything.

Myths vs facts — Learning the OWASP Top 10

• Myth: The Top 10 is a hacking syllabus. Fact: It is a defender's awareness list — what the risks are and the principles behind fixing them. OWASP publishes it so applications get built and bought more safely.
• Myth: If an application passes a Top-10 check, it is secure. Fact: The Top 10 is a floor, not a guarantee. Applications can fail in ways the list does not cover.
• Myth: Injection is an old problem that modern tools solved. Fact: Injection remains A03 because the underlying mistake — mixing data with commands — is still made constantly.
• Myth: Access control is handled because the button is hidden. Fact: Hiding an interface element is not a check. Permissions must be verified on the server for every request.
• Myth: Logging is paperwork that can wait. Fact: A09 exists because unwatched systems turn small intrusions into long, damaging ones. Watching is a defence.

Think it through — Learning the OWASP Top 10

Your agency is adopting a vendor-hosted public portal where residents submit sensitive documents. The vendor's pitch says 'bank-grade security' and shows a compliance logo, but its answers are vague. You are on the review group, and your tools are the Top 10 and good questions.

Walk it through:

1. Start with A01 and A07: ask how access control is enforced on the server for every request, whether staff and resident accounts are fully separated, and whether multi-factor authentication is enforced for administrators.
2. Press on A02: how are submitted documents encrypted in transit and at rest, and how long are they retained before deletion?
3. Cover the quiet categories: A06 (what is the patch rhythm for components, and how are customers notified of a critical flaw?), A09 (what is logged, who watches it, and how fast will the agency be told about an incident?), and A08 (are updates signed and verified?).
4. Apply Part 4's lesson: assume categories combine. Ask what happens when one layer fails — the answer reveals whether defence in depth exists or only a pitch does.
5. Record every answer in the risk register with the vendor's name beside its commitments. Vague answers are themselves a finding, priced into the decision.

Try this — Learning the OWASP Top 10

• ☐ Write the ten 2021 categories from memory, each with its defensive principle in a few words
• ☐ Take one application you use and ask: how would I know if its access control failed?
• ☐ Draft the seven vendor questions from Part 6 into a checklist your organisation could reuse
• ☐ Find one news breach report and identify which Top 10 categories combined in it
• ☐ Check one system you control for A05 basics: default passwords changed, unneeded features off

Resources to keep — Learning the OWASP Top 10

• OWASP Top 10:2021 (owasp.org) — The official list — each category with descriptions, examples, and prevention guidance, free.
• OWASP Cheat Sheet Series (cheatsheetseries.owasp.org) — Practical, free defensive guidance for builders, organised by topic.
• OWASP Application Security Verification Standard (ASVS) (owasp.org) — The deeper, free standard for verifying application security controls when a review needs to go beyond awareness.
• CISA — Secure by Design (cisa.gov) — Free federal guidance pressing vendors to build security in — a strong companion to your vendor questions.

What you earned / what's next — Learning the OWASP Top 10

✅ Learning the OWASP Top 10 complete (quiz score 80% or higher): You can recognise the ten web application risks, explain the defence behind each, and question a vendor in language that gets real answers.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Learning the OWASP Top 10

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You now speak the shared language of application security — not to break systems, but to protect the people whose records live inside them. That is a defender's knowledge, and it travels everywhere you do. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• OWASP Top 10:2021 — OWASP Foundation (owasp.org) — the ten categories, their order, descriptions, and prevention guidance used throughout.
• OWASP Cheat Sheet Series — OWASP Foundation (cheatsheetseries.owasp.org) — defensive principles behind the fixes.
• CISA Secure by Design — Cybersecurity and Infrastructure Security Agency (cisa.gov) — vendor accountability framing used in Part 6.

Course Record — Learning the OWASP Top 10

• Learning outcomes: On completing this unit, the student can:
• Name the ten OWASP Top 10:2021 categories in plain language
• Explain the defensive principle behind each category's fix
• Describe how categories combine in real breaches to extend damage
• Distinguish a defender's orientation from a hacking course, and state the list's limits
• Ask a vendor or developer specific, answerable questions drawn from the categories
• Apply the list to a public-facing portal or service your community depends on
• Study time: Approximately 1 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).