Issue Details
Insecure Deserialization
Aliases: None
Explanation
In OWASP 2017, A8 Insecure Deserialization combines related risk themes across Software and Data Integrity Failures, Insecure Design. Integrity failures allow tampering of software, updates, or data when trust and verification are weak. Insecure design reflects missing security controls in architecture and workflows before implementation. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
Remedy
For OWASP 2017 A8 Insecure Deserialization, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Sign software artifacts, verify update integrity, lock dependency versions, and protect CI/CD and deployment pipelines. Perform threat modeling early, add abuse-case testing, and build security controls into architecture decisions. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
| Year | Rank | Category |
|---|---|---|
| 2017 | #8 | A8 - Insecure Deserialization |
| 2021 | #8 | A08 - Software and Data Integrity Failures |
| 2025 | #8 | A08 - Software or Data Integrity Failures |