diff --git a/.build/build-owasp.xml b/.build/build-owasp.xml
new file mode 100644
index 0000000000..e3f4c42498
--- /dev/null
+++ b/.build/build-owasp.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<project basedir="." name="apache-cassandra-owasp-tasks">
+    <property name="dependency-check.home" value="${build.dir}/dependency-check-ant"/>
+    <property name="dependency-check.version" value="6.3.1"/>
+
+    <condition property="is.dependency.check.jar">
+        <available file="${dependency-check.home}/dependency-check-ant/dependency-check-ant.jar" type="file" />
+    </condition>
+
+    <target name="dependency-check-download"
+            depends="build"
+            description="Fetch OWASP Dependency checker"
+            unless="is.dependency.check.jar">
+
+        <echo>Downloading OWASP Dependency checks ...</echo>
+
+        <mkdir dir="${dependency-check.home}"/>
+
+        <get src="https://github.com/jeremylong/DependencyCheck/releases/download/v${dependency-check.version}/dependency-check-ant-${dependency-check.version}-release.zip"
+             dest="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" usetimestamp="true" />
+
+        <unzip src="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" dest="${dependency-check.home}"/>
+    </target>
+
+    <target name="dependency-check" description="Dependency-Check Analysis" depends="dependency-check-download,resolver-dist-lib">
+
+        <path id="dependency-check.path">
+            <fileset dir="${dependency-check.home}/dependency-check-ant/lib">
+                <include name="*.jar"/>
+            </fileset>
+        </path>
+
+        <taskdef resource="dependency-check-taskdefs.properties">
+            <classpath refid="dependency-check.path" />
+        </taskdef>
+
+        <!--
+            default value for cveValidForHours is 4 after which sync is done again
+
+            skipping using two specific caches at the end is solving (1)
+
+            failBuildOnCVSS is by default 11 so build would never fail,
+            the table categorising vulnerabilities is here (2), so by setting
+            "failBuildOnCVSS" to 1, we will fail the build on any CVE found
+            if it is not suppressed already dependency-check-suppressions.xml
+
+            If a vendor provides no details about a vulnerability,
+            NVD will score that vulnerability as 10.0 (the highest rating translating to critical).
+
+            (1) https://github.com/jeremylong/DependencyCheck/issues/2166
+            (2) https://nvd.nist.gov/vuln-metrics/cvss
+        -->
+        <dependency-check projectname="Apache Cassandra"
+                          reportoutputdirectory="${basedir}/build"
+                          reportformat="HTML"
+                          prettyPrint="true"
+                          cveValidForHours="1"
+                          centralAnalyzerUseCache="false"
+                          nodeAuditAnalyzerUseCache="false"
+                          failBuildOnCVSS="1"
+                          assemblyAnalyzerEnabled="false"
+                          dataDirectory="${dependency-check.home}/data"
+                          suppressionFile="${basedir}/.build/dependency-check-suppressions.xml">
+            <fileset dir="lib">
+                <include name="**/*.jar"/>
+            </fileset>
+        </dependency-check>
+    </target>
+</project>
diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
new file mode 100644
index 0000000000..10709d79f6
--- /dev/null
+++ b/.build/dependency-check-suppressions.xml
@@ -0,0 +1,47 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!--
+  copy suppressions / false positives here if there are any, how to do it is explained in
+  https://jeremylong.github.io/DependencyCheck/general/suppression.html
+-->
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <!-- not applicable since 4.0 -->
+        <packageUrl regex="true">^pkg:maven/com\.datastax\.cassandra/cassandra\-driver\-core@.*$</packageUrl>
+        <cve>CVE-2018-8016</cve>
+        <cve>CVE-2020-13946</cve>
+        <cve>CVE-2020-17516</cve>
+    </suppress>
+    <suppress>
+        <!-- dependency checker identified this as a completely different package (wire) -->
+        <packageUrl regex="true">^pkg:maven/net\.openhft/chronicle\-wire@.*$</packageUrl>
+        <cpe>cpe:/a:wire:wire</cpe>
+    </suppress>
+    <suppress>
+        <!-- not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -->
+        <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
+        <cve>CVE-2020-8908</cve>
+    </suppress>
+    <!-- netty's http stuff is not applicable here -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty\-all@.*$</packageUrl>
+        <cve>CVE-2021-21290</cve>
+        <cve>CVE-2021-21295</cve>
+        <cve>CVE-2021-21409</cve>
+    </suppress>
+</suppressions>
diff --git a/build.xml b/build.xml
index dc3f547c56..ca404a433f 100644
--- a/build.xml
+++ b/build.xml
@@ -2178,4 +2178,5 @@
 
   <import file="${basedir}/.build/build-resolver.xml"/>
   <import file="${basedir}/.build/build-rat.xml"/>
+  <import file="${basedir}/.build/build-owasp.xml"/>
 </project>