OWASP Top 10 for SACCOs: A Practical Compliance Checklist

What it is: Access control enforces policies preventing users from acting outside their intended permissions. When these controls fail — or are absent — users can access other members' accounts, view sensitive administrative data, or perform actions reserved for staff. This moved from position five in 2017 to the single most common vulnerability in 2021, appearing in 94% of tested applications.

SACCO impact: A member with a standard login could manipulate URL parameters to access another member's loan application, account balance, or personal identification records. An employee with read-only access could escalate privileges to initiate transfers. Horizontal privilege escalation (accessing another user's same-level resources) and vertical privilege escalation (gaining higher-level permissions than assigned) are both in scope here.

Technical example: An application retrieves account information via GET /accounts?id=10452. If the server does not verify that the authenticated session belongs to member 10452, any authenticated member can increment the ID parameter and access every other member's record sequentially.

• Implement role-based access control (RBAC) — every user role explicitly mapped to permitted resources and actions
• Enforce object-level authorisation on every API endpoint — validate that the authenticated user owns the requested resource
• Deny access by default — all access must be explicitly granted, not inherited
• Log all access control failures with sufficient context (user ID, timestamp, resource requested)
• Implement rate limiting on APIs to limit the impact of automated access control probing
• Conduct quarterly access reviews — remove unnecessary permissions, especially for departed staff
• Disable directory listing on all web servers
• Implement universal multi-factor authentication (MFA) — required across all systems, not just remote access

What it is: Cryptography is the science of encoding information so that only authorised parties can read it. Cryptographic failures occur when data is transmitted or stored without adequate encryption, when deprecated (outdated, no longer considered safe) algorithms are used, or when encryption is implemented incorrectly — producing a false sense of security.

SACCO impact: Member national ID numbers, account balances, loan repayment histories, and any payment card data could be exposed in transit (as they move across the internet) or at rest (while stored in your database). Under the Kenya Data Protection Act 2019, exposure of unencrypted personal data constitutes a reportable breach. Under PCI DSS, exposure of cardholder data carries automatic fines and potential loss of card-processing privileges.

• Enforce TLS 1.2 minimum across all web traffic — TLS 1.3 is preferred; disable TLS 1.0 and 1.1 immediately
• Encrypt all sensitive member data at rest using AES-256 or equivalent NIST-approved algorithm
• Implement proper certificate lifecycle management — automate renewal to prevent lapses
• Never store sensitive authentication data post-authorisation (CVV codes, full magnetic stripe data)
• Hash all passwords using bcrypt, scrypt, or Argon2 — never MD5 or SHA-1, which are computationally broken
• Enable Perfect Forward Secrecy (PFS) in TLS configurations to protect past sessions if keys are later compromised
• Use cryptographically secure random number generators — never use Math.random() or equivalent for security-sensitive operations
• Review and update cryptographic standards annually against current NIST guidance

What it is: Injection attacks occur when untrusted data — input entered by a user into a form, a URL, or an API call — is processed as executable code or as a database command. SQL injection is the most common variant: an attacker enters malicious SQL syntax (database language commands) into a login or search field, causing the database to execute unintended instructions.

SACCO impact: A successful SQL injection attack against a SACCO's member portal could extract the entire member database — including PINs, account numbers, loan histories, and personal identification data — in minutes. It could allow an attacker to modify account balances, delete transaction records, or gain administrative control of the underlying server. In 2021, a SQL injection attack against LinkedIn exposed personal records of over 700 million users; the attack vector is identical in SACCO systems that lack input validation.

• Use parameterised queries (prepared statements) for every database operation — never concatenate user input directly into SQL strings
• Implement server-side input validation using allowlists — define what valid input looks like, reject everything else
• Deploy a Web Application Firewall (WAF) as an additional detection and filtering layer
• Apply least-privilege database accounts — application database users should never have DROP, CREATE, or administrative permissions
• Conduct quarterly SQL injection testing against all input fields — automated and manual
• Use Object-Relational Mapping (ORM) frameworks correctly — misconfigured ORMs can still be vulnerable
• Escape all special characters in user inputs before any processing

What it is: Unlike other OWASP categories that address implementation flaws, insecure design targets fundamental architectural weaknesses — security gaps baked into an application's logic before a single line of code is written. This category entered the OWASP Top 10 in 2021, reflecting the security industry's recognition that patching implementation bugs is insufficient when the underlying design is flawed.

SACCO impact: Business logic vulnerabilities (flaws in how the application handles business rules) are among the most dangerous and difficult to detect. A SACCO might design a loan disbursement system without considering whether a member could submit two concurrent applications and receive double funding before either is processed. Or a withdrawal limit enforced only on the front-end (what the user sees) could be bypassed by an attacker calling the back-end API directly.

• Conduct formal threat modelling (systematically identifying how a system could be attacked) for every new feature before development begins
• Enforce all business logic validation on the server side — never rely solely on client-side controls
• Test for race conditions (where two operations run simultaneously and produce unintended outcomes) in all financial transaction flows
• Define security requirements as part of user stories and acceptance criteria in your development process
• Conduct design reviews with a security specialist before committing to architecture
• Implement circuit breakers and rate limiting to design for failure gracefully
• Document security assumptions and trust boundaries explicitly in system documentation

What it is: Security misconfiguration is the most pervasive vulnerability category in practice — nearly 90% of tested applications exhibit some form of it. It occurs when systems are deployed without proper hardening (removing unnecessary features and securing defaults), when default credentials are never changed, or when verbose error messages expose internal system architecture to potential attackers.

SACCO impact: A server deployed with default credentials — a username of "admin" and password of "admin" — is trivially compromised. Unnecessary services left running on servers expand the attack surface without providing any operational benefit. Detailed error messages showing database table names or file paths serve as reconnaissance intelligence for attackers.

• Change all default credentials immediately upon system installation — this is non-negotiable
• Remove or disable all unnecessary features, services, ports, and accounts
• Implement automated configuration scanning to detect drift from hardened baselines
• Display only generic error messages to end users — log full technical details server-side only
• Implement HTTP security headers: Content-Security-Policy, X-Frame-Options, Strict-Transport-Security
• Segment network architecture — production, staging, and development environments must be isolated
• Maintain a patching cadence — critical patches applied within 72 hours, high within two weeks

What it is: Modern web applications are rarely built from scratch — they are assembled from dozens or hundreds of third-party libraries, frameworks, plugins, and dependencies. When any of these components contain known vulnerabilities and are not updated, the entire application inherits that risk. Attackers maintain real-time databases of known vulnerable versions and actively scan for them.

SACCO impact: A SACCO's member portal built on an outdated WordPress version, an unpatched PHP framework, or an obsolete JavaScript library may be trivially exploitable through publicly documented attack techniques requiring no special skill — only knowledge of the version number. The Log4Shell vulnerability (CVE-2021-44228), for instance, affected millions of Java applications overnight because organisations did not know what versions they were running.

• Maintain a complete software inventory — a Software Bill of Materials (SBOM) listing every component and its version
• Subscribe to security advisories for all components in use (CVE feeds, vendor newsletters)
• Use automated Software Composition Analysis (SCA) tools to continuously monitor for newly disclosed vulnerabilities
• Remove all unused dependencies, libraries, and frameworks — unused components still carry risk
• Only obtain components from official, verified sources — verify checksums and digital signatures
• Establish a patch management policy with clear SLA timelines by severity level
• Track end-of-life announcements for all components and plan upgrades before support expires

What it is: Authentication is the process of verifying that a user is who they claim to be. When authentication mechanisms are weak — short passwords, lack of multi-factor authentication, predictable session tokens, or missing account lockout — attackers can compromise identities through brute force (trying millions of password combinations), credential stuffing (using stolen username/password pairs from other breaches), or session hijacking (stealing a logged-in user's session cookie).

SACCO impact: A compromised SACCO staff account is a direct path to member data, loan processing systems, and financial records. A compromised member account enables fraudulent loan applications, unauthorised transfers, and manipulation of personal information. With over 2 billion stolen credential pairs in circulation from previous breaches globally, password-only authentication is no longer defensible for financial institutions.

• Implement MFA for all user accounts — FIDO2/WebAuthn (phishing-resistant hardware keys or device biometrics) is the current gold standard
• Enforce a minimum 12-character password policy with complexity requirements
• Implement progressive account lockout after repeated failed login attempts
• Use cryptographically random session IDs — never expose session identifiers in URLs
• Enforce session timeout of 15–30 minutes for inactive sessions
• Invalidate all sessions on logout, password change, and privilege change
• Implement risk-based authentication — require step-up verification for high-value transactions
• Monitor for impossible travel (logins from geographically impossible locations within short timeframes) and other anomalous patterns
• Prevent credential stuffing through rate limiting, CAPTCHA, and IP reputation checks

What it is: This category addresses the failure to protect code pipelines and data flows from integrity violations. It encompasses insecure software update mechanisms, CI/CD pipeline vulnerabilities (the automated systems that build and deploy software), and insecure deserialization (when applications process data objects from untrusted sources without validation). The SolarWinds supply chain attack — in which malicious code was embedded into a trusted software update affecting 18,000 organisations — exemplifies the catastrophic potential of integrity failures at scale.

SACCO impact: A compromised update to your member portal software could introduce malware that exfiltrates data silently. Insecure deserialization in a loan processing API could allow remote code execution — giving an attacker complete control of the server.

• Verify digital signatures on all software updates before installation
• Use only trusted, official package repositories and verify component integrity via checksums
• Implement file integrity monitoring (FIM) on all production systems
• Separate build and deployment pipelines with explicit human approval gates for production deployments
• Never deserialise untrusted data — validate and sanitise all input objects
• Implement Subresource Integrity (SRI) checks for all externally hosted JavaScript and CSS resources
• Conduct formal vendor security assessments before integrating any third-party component

What it is: Without comprehensive logging and active monitoring, breaches go undetected. The average time to discover a breach in the financial sector is 200 days — more than six months during which attackers have unrestricted access to systems, member data, and financial records. Security logging and monitoring failures were elevated in the 2021 OWASP list precisely because organisations consistently underinvest in detection capability relative to prevention.

SACCO impact: Without logs, you cannot reconstruct what happened during a breach, cannot demonstrate to SASRA or ODPC that you detected and responded appropriately, cannot satisfy insurance claims, and cannot provide evidence for law enforcement. Under the Kenya Data Protection Act 2019, organisations must be able to demonstrate proactive detection of breaches and report them to the ODPC within 72 hours of discovery.

• Log all authentication events — successes and failures — with user ID, timestamp, source IP, and outcome
• Log all access to sensitive member data and all administrative function calls
• Implement a centralised SIEM (Security Information and Event Management) platform to aggregate and correlate logs
• Set up real-time alerts for high-severity events: multiple failed logins, privilege escalation, bulk data access
• Store logs in write-once, tamper-evident storage — logs that can be deleted by attackers are useless
• Retain logs for a minimum of seven years for financial institutions — verify your specific regulatory retention obligations
• Test logging and alerting systems quarterly — confirm that alerts actually fire when expected
• Develop and rehearse incident response playbooks (step-by-step response procedures) for the most likely attack scenarios

What it is: Server-Side Request Forgery occurs when an attacker can cause the server to make HTTP requests to an unintended location. Because the request originates from the server itself — which is inside the network perimeter (the boundary between your internal systems and the internet) — it can bypass firewall rules and access internal systems that are not publicly reachable. SSRF was introduced to the OWASP Top 10 in 2021 driven largely by cloud adoption, where metadata endpoints (internal URLs exposing cloud infrastructure credentials) are a high-value SSRF target.

SACCO impact: An SSRF vulnerability in a feature that fetches external content — such as a profile image importer or a document validator — could be weaponised to probe internal banking systems, access cloud provider metadata containing authentication tokens, or map internal network topology as a precursor to a larger attack.

• Validate and sanitise all user-supplied URLs — implement strict allowlists of permitted domains and protocols
• Block all non-HTTP/HTTPS URL schemas (file://, gopher://, ftp://, dict://)
• Implement network-level egress filtering — servers should not be able to reach arbitrary internal resources
• Segment internal networks — ensure that internet-facing applications cannot communicate directly with core banking or member database servers
• Disable HTTP redirects entirely, or validate all redirect targets against the allowlist
• Monitor for unusual outbound connection patterns from application servers