Web applications are crucial to business operations today, but they also present a large surface area for cyber threats. A significant number of these threats can be understood and mitigated through a working knowledge of the 'owasp top ten web application security risks'. This guide will walk you through core concepts, practical steps for defense, and the broader implications of each risk.

1. Introduction

Open Web Application Security Project (OWASP) is a non-profit foundation dedicated to improving the security of software. They standardize the knowledge base of the internet industry's main security concerns through the OWASP Top 10, making it an essential resource for any developer or software engineer.

2. OWASP Top Ten Web Application Security Risks

2.1. Injection

Injection flaws tend to occur when untrusted data is sent as part of a command or query. Attackers can use this to trick an interpreter into executing unintended instructions, which can lead to data loss or corruption.

Preventing injection involves keeping data separate from commands and queries. Developers can use safe APIs, limit privileges on database accounts, and use OWASP's Escapist project for HTML context output encoding.

2.2. Broken Authentication

Session management and authentication are difficult to implement correctly, leading too often to compromises of keys, passwords, or session tokens. Developers should incorporate multi-factor authentication, ensure session timeouts are in place, and use a server-side, secure, built-in session manager.

2.3. Sensitive Data Exposure

This vulnerability can lead to credit card crime, identity theft, or other fraud if not adequately addressed. Defense requires encryption of all sensitive data at rest and in transit, and not storing sensitive data unnecessarily.

2.4. XML External Entities (XXE)

XXE attacks can lead to the disclosure of internal files, denial of service, or remote code execution. Mitigation includes disabling entity parsing and not using XML where possible. Further security can be added through isolation of uploaded file handling.

2.5. Broken Access Control

When not properly enforced, access controls can lead to unauthorized users performing critical functions. Developers need to deny all access by default and ensure broken access control flaws are mitigated before detection.

2.6. Security Misconfigurations

This typically occurs when security settings are defined, implemented, and maintained as defaults. Regular, proactive security reviews can reduce this risk, as can using automated tools to verify security settings.

2.7. Cross-Site Scripting (XSS)

XSS flaws originate when an application includes untrusted data in a new webpage without valid, escape contextual output. XSS allows attackers to execute scripts that can hijack user sessions or deface websites. Mitigation includes separating untrusted data from active browser content.

2.8. Insecure Deserialization

Insecure deserialization can lead to remote code execution, making these flaws harder to exploit but also severely impactful. Developers should not deserialize hostile objects and should implement integrity checks.

2.9. Using Components with Known Vulnerabilities

This issue arises when a vulnerable component is exploited in a data loss or server takeover. Defense involves continual tracking and fixing of components in applications.

2.10. Insufficient Logging & Monitoring

Inadequate logging and monitoring lead to a longer Incident response time. Developers should ensure all login, access control failures, and server-side input validation failures are logged with enough user context to identify suspicious activities.

3. Conclusion

In conclusion, the 'owasp top ten web application security risks' provide a benchmark for organisations and developers to ensure secure coding practices. By better understanding and mitigating these risks, companies can safeguard their assets, maintain customer trust, and ensure disruption-free business operations. This guide is just the start; it's crucial to remember that web application security is an ongoing, ever-evolving responsibility.