Skip to content
BoKSA

Web Security Fundamentals

Web Security Fundamentals

Use this page to revise the core vocabulary of web application security — the terms and concepts a security knowledge test typically checks before you go anywhere near writing secure code yourself.

The OWASP Top 10

The OWASP Top 10 is a regularly updated list of the most critical web application security risks. You should be able to name several of them and give a concrete example of each, for instance:

  • Injection — untrusted input is executed as part of a command or query (e.g. SQL injection).
  • Broken authentication — flaws in login, session handling, or credential storage let an attacker impersonate a user.
  • Broken access control — a user can perform actions or reach data they shouldn't be allowed to (e.g. changing an ID in a URL to view someone else's data).

Threat modeling

Threat modeling is a structured way to reason about what could go wrong before it does, built from four basic questions: what are we building (assets), what could go wrong (threats), where are the weaknesses (vulnerabilities), and what do we do about it (mitigations). STRIDE is a simple, memorable checklist for the threat step: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Applying STRIDE to something concrete — a login flow, a CRUD API — is more useful than trying to threat-model an entire system at once.

Regulation, at a high level

The EU Cyber Resilience Act (CRA) places obligations on producers of software with digital elements to build in security and manage vulnerabilities responsibly. You don't need the legal detail, but you should be able to connect the dots: secure coding, monitoring, and timely patching are concrete ways a development team contributes to that obligation.

Starting Points

Key Points

  • You can list several OWASP Top 10 risks and give a concrete example of each in a web context.
  • You can explain the four basic elements of threat modeling: assets, threats, vulnerabilities, mitigations.
  • You can explain what STRIDE stands for and apply it to a simple scenario, such as a login flow.
  • You can explain, at a high level, how secure coding, monitoring, and patching relate to obligations under regulation such as the Cyber Resilience Act.