thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Insecure Design

OWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.

Definition

Introduced in 2021, Insecure Design covers issues like missing rate limits on business flows, trusting client-side state and weak credential recovery designs. Perfect implementation cannot fix an insecure design. Mitigations are threat modeling, secure design patterns, reference architectures and abuse-case testing.

Example

A ticketing site has no limit on how many seats one user can hold, so bots reserve every seat.

Exam tip

Answer is threat modeling and secure design patterns, not better coding.

Related terms