Access control (also called authorization) is the mechanism that decides, for every attempted operation, whether the authenticated subject is permitted to perform that operation on that specific resource. It is the enforcement of your application's policy about who may do what, to which data, under which conditions.

Use Cryptography to Protect Data is the proactive control that says: wherever sensitive data lives or travels, apply correct, current, well-implemented cryptography so that even if an attacker reaches the bytes, they cannot read, forge, or tamper with them. It is the defensive discipline whose absence OWASP catalogues as A02:2021 – Cryptographic Failures.

C3 - Validate all Input & Handle Exceptions is a proactive control from the OWASP Top 10 Proactive Controls (2024). It is not a description of a vulnerability; it is a defensive discipline you build into every application to mitigate whole classes of attacks-injection, cross-site scripting, XML external entities, path traversal, and unsafe deserialization-and to make sure the failures that do occur fail safely.

Address Security from the Start is the proactive control that says security is a design property, not a feature you attach at the end. Instead of building a system and then testing for bugs, you build security into every phase of the software development lifecycle-requirements, architecture, design, implementation, testing, deployment, and operation-so the safe way to build something is also the default way.

Secure By Default Configurations is the proactive control of shipping and running systems that are safe out of the box. A default deployment-one where nobody has yet applied any special hardening-should already be in a secure state.

Keep Your Components Secure is the proactive control of managing the security of every first- and third-party component your software depends on, across its entire lifecycle-from the moment you choose it, through every release you ship, to the day you retire it. A modern application is mostly code you did not write: frameworks, libraries, runtimes, base images, and the long tail of transitive dependencies those pull in.

Secure Digital Identities is the proactive control that says: implement identity, authentication, and session management deliberately and correctly, and match the strength of those mechanisms to the risk of the thing they protect. It is the defensive discipline whose absence OWASP catalogues as A07:2021 – Identification and Authentication Failures.

Leverage Browser Security Features is the proactive control of using the security mechanisms that modern browsers already provide as a deliberate layer of defense. Every current browser ships with an enforcement engine for response headers, cookie attributes, and HTML/HTTP directives that constrain what a page is allowed to do-which scripts may run, which origins it may talk to, whether it may be framed, and how it may be transported.

Security Logging and Monitoring is the proactive control of recording security-relevant events, watching those records in near-real time, and wiring them into detection and response. It is the discipline that lets an organisation know when something is going wrong-and prove afterwards what happened.

Stop Server-Side Request Forgery (SSRF) is the proactive control of making sure that when your server fetches a URL, it can only ever reach destinations you intended-never an internal service, a cloud metadata endpoint, or a local file. SSRF happens when an attacker supplies or influences a URL that the application then requests on its behalf, turning your trusted server into a proxy that speaks from inside your network.