Privacy settings
We use cookies and similar technologies that are necessary to run the website. Additional cookies are only used with your consent. You can consent to our use of cookies by clicking on Agree. For more information on which data is collected and how it is shared with our partners please read our privacy and cookie policy: Cookie policy, Privacy policy
We use cookies to access, analyse and store information such as the characteristics of your device as well as certain personal data (IP addresses, navigation usage, geolocation data or unique identifiers). The processing of your data serves various purposes: Analytics cookies allow us to analyse our performance to offer you a better online experience and evaluate the efficiency of our campaigns. Personalisation cookies give you access to a customised experience of our website with usage-based offers and support. Finally, Advertising cookies are placed by third-party companies processing your data to create audiences lists to deliver targeted ads on social media and the internet. You may freely give, refuse or withdraw your consent at any time using the link provided at the bottom of each page.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
OWASP, API Security, Vulnerabilities

A08:2021 OWASP – Software and Data Integrity Failures

Humans in today’s digital world are surrounded by software and applications. For almost all of your day-to-day personal and professional work, we have an application or software to assist us. However, they are not as useful as they seem. 

If not guarded by enough API security measures, the application/software we use acts as a means for a hacker to reach you. That explains why a cyber-attack is taking place every 39 seconds. 

OWASP Top 10, a well-recognized entity educating people about the problem-causing threat, recently updated the list. A08:2021, the latest vulnerability in OWASP’s most-recent list, is something any software user should be familiar with. Let’s learn more about it.

A08:2021 OWASP – Software and Data Integrity Failures

Vulnerability Description

A08:2021 is the new entrant and talks about the seen/unseen dangers that modern-era software/applications bring with them.

Often called as Software and Data Integrity Failures OWASP, it talks about the assumptions linked with critical CI/CD pipeline, data handling, and software update integrity failure. In layman's language, when one uses software/application/critical data without adhering to best verification or authentication practices, multiple threats approaches and A08:2021 covers all of them.

Not going through with the authentication process creates an opportunity for hackers/threat actors to gain authorized access to restricted applications/software. Once that happens, they are allowed to cause endless havoc such as malicious code injection, data theft, and controlling the application/software operation.

Examples of Attacks

Some common examples of A08:2021 are:

  • When end-user updates happen devoid of signing

Many applications/software come with auto-update features and don’t comply with the user-verification process using the digital signing mechanism. Such unsigned update incidences provide an opportunity for threat actors to corrupt the targeted system/software. This could be a serious issue and has no direct fix. The only remedy is to fix the issue in the future version only. 

  • The incidence of insecure deserialization

Incidence deserialization occurs when a React application uses Spring Boot microservices and programmers struggle hard to make sure the code used remains unalterable. To make this happen, programmers generally perform user state serialization. If that’s not done correctly, an attacker can easily figure out the “r00” Java object signature. Using the Java Serial Killer tool, the threat actor can perform remote code execution. 

Examples of Attacks
Examples of Attacks
  1. A hacker identifies the agency's insecure CI/CD pipeline and installs malicious code that gets into production.
  2. Customers unknowingly download malicious code from the agency's replacement servers.
  3. The malicious replacement connects to the customer's environment and the hacker uses it to gain access to the customer's network.

Prevention Methods

Even though this vulnerability is capable of causing damage beyond one’s imagination, measures like continual monitoring, use of efficacious tools/technology, and adoption of best authentication/verification practices can bring great relief.

Here are some of the best and viable preventive methods for A08:2021:

  1. Authentication 

To make sure the software or critical data delivered is coming from a trusted resource, use digital signatures.

  1. User-level Restrictions

It’s important that dependencies as well as libraries used by software/applications are using verified repositories and have restricted access. Users of high-risk profiles are suggested to use a well-inspected repository hosted internally.

  1. Testing

Codes used for software/application generation must go through extensive testing during the development phase and whenever configuration changes are made. It improved the code security and reduced risk of the A08:2021 appearing in OWASP Top 10 2022.

  1. Use of software chain security Aids

Utilizing tools like OWASP CycloneDX or OWASP Dependency-Check helps security professionals to find out whether or not the application/software components feature any sort of vulnerabilities.

  1. Follow Pipeline Deployment Standard

The CI/CD pipeline used for software/application development should feature appropriate segregation, access control, and configuration. This helps in code flow integrity during the entire development and execution phase.

  1. Encrypt and Validate All Data

It's very crucial to make sure that any unencrypted or unverified data is not shared with any unauthorized resource. All data, before sharing, must go through an extensive integrity check or be backed by a digital signature. This practice helps one to spot any tampering or replay related incidents related to your data/serial processes.

How Wallarm can help with Software and Data Integrity Failures?

Wallarm is an online platform offering 100% efficacious end-to-end API security solutions that work on all the leading APIs such as REST, gRPC, graphQL, and so on. It offers a multi-facet preventive solution to improve cybersecurity and reduce the Software and Data Integrity Failures impact.

It comprises a feature-rich Cloud WAF, a highly functional API Security and Threat Prevention platform, and a technologically-sound API and OWASP vulnerability attack simulation tool.

With Cloud WAF, one can keep serverless workloads and API secure in simple steps. It lets you enjoy the best CDN benefits, gives near-zero false positives and helps you meet PCI DSS compliances. Attacks like account takeover, API abuse, and misconfiguration, can be stopped early with Wallarm Cloud WAF.

The end-to-end API Security and Threat Prevention platform of Wallarm offers everything needed to ensure through-and-through cyber-safeguarding. You can detect issues in their beginning stage, respond to them with a protective strategy, and test the efficacy of applied security measures. The platform features great API integration abilities and can test any kind of API in any sort of ecosystem.

GoTestWAF will help you test the security level of your APIs and spot any hidden loopholes. The tool will help you test the APIs in a near-reality ecosystem using the high-end simulation. One can generate need-based corrupted codes and insert them into API and systems to find out how strong is the security of both. The tool supports assorted API protocols and is a must-have for enhanced API safety seekers. 


What is OWASP, and how does it relate to software and data integrity failures?
What are some common software and data integrity failures?
How can I prevent software and data integrity failures?
How can I learn more about software and data integrity failures?
What is an example of a software and data integrity failure that caused a major data breach?


Subscribe for the latest news

April 26, 2024
Learning Objectives
Subscribe for
the latest news
Related Topics