For me the problem that this article describes, people using the OWASP Top 10 as a checklist, isn't that checklists are innately a bad idea, but that the OWASP

For me the problem that this article describes, people using the OWASP Top 10 as a checklist, isn't that checklists are innately a bad idea, but that the OWASP Top 10 isn't meant to be a checklist. The Top 10 is a document designed to raise awareness of various web application security issues. Unfortunately it's a victim of its own success. People saw a defined list and jumped to the incorrect conclusion that this was a definitive list of the things you should look at to have a "secure" web application. Unfortunately it's now become embedded in various places such that any attempt to change it causes lots of problems as people who are using it in ways it wasn't intended to be used get annoyed that if changed, it will no longer work for them. On the more general point of checklists and security, I actually like them as a means of providing a common baseline of security in various arenas. The important part is realising that a checklist is generally a starting point and not the "be all and end all" of any effort.