Ravi Sir's Cyber Security Cards › Comparison Cards
STRIDE vs OWASP Top 10
Comparison card: STRIDE vs OWASP Top 10. Easy English, with a real example. Scan the QR for the full lesson.
Read card text
What this card says
What each one is
STRIDE: a checklist of six threat types used to model a design before you build.
OWASP Top 10: a list of the most common web bugs seen in real apps.
How they differ
STRIDE is used early, on the design, to ask how could this be attacked.
The Top 10 is used on built apps, to check for known bug types.
Example
STRIDE on a login page finds Spoofing (weak login) and Denial of service (login flood).
OWASP checks the finished app for Injection, Broken Access Control and so on.
Use when
Use STRIDE at design time to miss no threat type.
Use the OWASP Top 10 while coding and testing. They work together.
Learn more in the lesson: 29.9 Threat Modelling (STRIDE)