OWASP - User contributions [en]

Category:OWASP Security Spending Benchmarks

2010-02-07T19:17:20Z

Bgelbord:

[[:Category:OWASP Project]] 

== NEXT REPORT CURRENTLY COLLECTING RESPONSES - AIMING FOR Q2 DELIVERY ==

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation and Founder, [http://www.securityscoreboard.com/ Security Scoreboard]). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Aspect_logo_resized.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Rapid7.png]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2010-02-07T19:16:39Z

Bgelbord:

[[:Category:OWASP Project]] 

== NEXT REPORT CURRENTLY COLLECTING RESPONSES - AIMING FOR Q2 DELIVERY ==

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation and Founder, [http://securityscoreboard.com/ Security Scoreboard]). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Aspect_logo_resized.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Rapid7.png]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Podcast News

2010-01-22T01:20:27Z

Bgelbord: /* OWASP Podcast Roundtable */

'''[[Podcast_News|OWASP Podcast News]]'''

OWASP NEWS October 2009 

== OWASP Podcast Roundtable ==

'''Next Recording : January 22, 2010'''

==== [Full-disclosure] Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack ====

http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0346.html

''Discussion'': holey OS code, Batman! how do you even start to get a handle on this bugger? this isn't web app specific, but it squarely hits secure coding between the eyes. how does a bug like this survive for 17 years?

==== Top Ten Web Hacking Techniques of 2009 (Official) ====

http://jeremiahgrossman.blogspot.com/2010/01/top-ten-web-hacking-techniques-of-2009.html

''Discussion'': do you agree? anything jump out? any good back-stories?

==== Google, China, "Aurora", and Advanced Persistent Threat ====

(''this makes me want to start chanting "lions and tigers and bears - OH MY!"'')

Google: A new approach to China http://googleblog.blogspot.com/2010/01/new-approach-to-china.html

Operation “Aurora” Hit Google, Others http://siblog.mcafee.com/cto/operation-%E2%80%9Caurora%E2%80%9D-hit-google-others/

Hack of Google, Adobe Conducted Through Zero-Day IE Flaw http://www.wired.com/threatlevel/2010/01/hack-of-adob/

Microsoft Security Advisory (979352) Vulnerability in Internet Explorer Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/979352.mspx

Google v China http://taosecurity.blogspot.com/2010/01/google-v-china.html

Web-based systems vs. Advanced Persistent Threat http://jeremiahgrossman.blogspot.com/2010/01/web-based-systems-vs-advanced.html

''Discussion'': is this important news? how does this affect the development community, particularly by extension? has anything really changed?

''Discussion'': A new IE 0-day brings mega-tech-corps to their knees. France and Germany respond by recommending against the use of IE altogether. Is this news? with so many IE6 apps still in use today, does it even matter?

''Discussion'': this is also the source of a couple potential buzzword winners for 2010... "Operation Aurora" and "advanced persistent threat"...

==== Microsoft Advances Search Privacy with Bing ====

http://microsoftontheissues.com/cs/blogs/mscorp/archive/2010/01/18/microsoft-advances-search-privacy-with-bing.aspx

''Discussion'': is this really that big a deal? do they really need the IP address at all? is this doing enough, or does it fall far short?

==== Microsoft Seeks New Legal Framework For Cloud ====

http://www.informationweek.com/news/government/policy/showArticle.jhtml?articleID=222301657&cid=IWK_Government-Twitter

''Discussion'': what sort of legislation/regulation do we need? what would be useful? we all know, I think, that's it going to happen one way or another. the question is what is and isn't useful.

==== Imperva Report on Password Practices ====

http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf

''Discussion'': is this surprising? Is enforced password complexity the answer? Is this the users' problem and should we care?

Category:OWASP Security Spending Benchmarks

2009-12-02T22:42:43Z

Bgelbord:

[[:Category:OWASP Project]] 

== NEXT REPORT TO BE PUBLISHED IN Q4 ==

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Aspect_logo_resized.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Rapid7.png]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-11-02T19:15:57Z

Bgelbord: added Aspect logo

[[:Category:OWASP Project]] 

== NEXT REPORT TO BE PUBLISHED IN Q4 ==

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Aspect_logo_resized.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

File:Aspect logo resized.jpg

2009-11-02T19:13:58Z

Bgelbord:

Podcast News

2009-09-17T19:08:51Z

Bgelbord:

Podcast News

2009-09-17T19:08:14Z

Bgelbord:

Podcast News

2009-07-23T19:25:04Z

Bgelbord: added June articles

Category:OWASP Security Spending Benchmarks

2009-07-21T21:30:00Z

Bgelbord:

[[:Category:OWASP Project]] 

== NEXT REPORT TO BE PUBLISHED IN Q4 ==

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-06-30T04:44:31Z

Bgelbord:

[[:Category:OWASP Project]] 

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/f/f0/OWASP_SSB_Q2_Project_Report.pdf PDF Download]]

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

File:OWASP SSB Q2 Project Report.pdf

2009-06-30T04:40:11Z

Bgelbord: This is the Q2 report of the OWASP Security Spending Benchmarks Project with a focus on cloud computing.

This is the Q2 report of the OWASP Security Spending Benchmarks Project with a focus on cloud computing.

Category:OWASP Security Spending Benchmarks

2009-06-30T04:38:01Z

Bgelbord: Added Q2 report

[[:Category:OWASP Project]] 

== Q2 Report Published - Focus on Cloud Computing ==

The Q2 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

There are a number of key findings in the Q2 09 study:

* Software-as-a-Service is in much greater use than Infrastructure-as-a-Service or Platform-as-a-Service. Over half of respondents make moderate or significant use of SaaS. Less than a quarter of all respondents make any use of either IaaS or PaaS.

* Security spending does not change significantly as a result of cloud computing. Respondents did not report significant spending changes in the areas of network security, third party security reviews, security personnel, or identity management.

* Organizations are not doing their homework when it comes to cloud security. When engaging a cloud partner, only half of organizations inquire about common security-related issues, and only a third require documentation of security measures in place.

* The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.

* Compliance and standards requirements related to cloud computing are not well understood. Respondents report having the greatest understanding of PCI requirements relating to cloud computing and the least understanding of HIPAA cloud requirements.

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Project is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 30th: Final report published 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Podcast News

2009-06-11T22:08:09Z

Bgelbord: removal of duplicates

'''[[Podcast_News|OWASP Podcast News]]'''

OWASP NEWS April 2009 

==OWASP General News==
 
Global Committees progress
https://www.owasp.org/index.php/Global_Committee_Pages
 
What should the next OWASP Top 10 contain? http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
 
Upcoming Conferences
http://www.owasp.org/index.php/Category:OWASP_AppSec_Conference
 
Season of Code 2009
http://www.owasp.org/index.php/OWASP_Season_of_Code_2009
 
Board Mins.
http://www.owasp.org/index.php/OWASP_Board_Meetings

==OWASP AppSec News==
;5/1 Mythbusting – Secure Code is Less Expensive to Develop http://jeremiahgrossman.blogspot.com/2009/05/mythbusting-secure-code-is-less.html
;5/1 Getting started with the PHPIS Intrusion Detection System http://www.h-online.com/security/Getting-started-with-the-PHPIDS-intrusion-detection-system--/features/113163
;5/4 http://feedproxy.google.com/~r/mcgovern/~3/k9BoNtavPxQ/conference-is-about-community.html
;5/5 http://nickcoblentz.blogspot.com/2009/05/light-weight-code-review-as-you-program.html

;5/4 Using Denial of Service for Hacking http://ha.ckers.org/blog/20090504/using-denial-of-service-for-hacking/
;5/4 OWASP ISWG: Struts 2/WebWork Gap Analysis http://nickcoblentz.blogspot.com/2009/05/owasp-iswg-struts-2webwork-gap-analysis.html http://nickcoblentz.blogspot.com/2009/05/struts-2-security-addons-code.html
;5/4 Best Practice: Consider External Data Feeds Untrusted http://www.veracode.com/blog/2009/05/best-practice-consider-external-data-feeds-untrusted/
;5/4 Protection against Forceful Browsing http://coding-insecurity.blogspot.com/2009/05/protection-against-forceful-browsing.html
;5/5 Moth - A new release from the w3af project http://www.mail-archive.com/w3af-develop@lists.sourceforge.net/msg00369.html http://security-sh3ll.blogspot.com/2009/05/moth.html
;5/5 Botnets took control of 12 million new IPs this year http://www.wired.com/threatlevel/2009/05/botnets-took-control-of-12-million-new-ips-this-year/
;5/6 Enter Formjacking http://i8jesus.com/?p=48
;5/8 8 Reasons Why Website Vulnerabilities Are Not Fixed http://jeremiahgrossman.blogspot.com/2009/05/8-reasons-why-website-vulnerabilities.html
;5/8 SQL Injection Lessons from X-Force Emergency Response Service Investigations http://blogs.iss.net/archive/sql-injection-ers.html
;5/12 Delay of FTC Red Flag Rule http://www.bankinfosecurity.com/articles.php?art_id=1457
;5/13 Botnet is Captured and Studied http://gadgetwise.blogs.nytimes.com/2009/05/13/botnet-is-captured-and-studied-and-the-findings-arent-good/
;5/13 Effective Account Lockout http://coding-insecurity.blogspot.com/2009/05/effective-account-lockout.html
;5/13 Sincerest Form of Flattery http://securitylabs.websense.com/content/Blogs/3397.aspx

;5/15 Does Tokenization Solve Anything? http://www.secureconsulting.net/2009/05/does_tokenization_solve_anythi.html
;5/16 Daily Dave and crew talk browser-based client side crypto http://seclists.org/dailydave/2009/q2/0093.html
;5/19 It’s No Secret. Measuring the Security and Reliability of Authentication via ‘Secret’ Questions http://newschoolsecurity.com/2009/05/179/
;5/19 Some Thoughts on the OWASP Top Ten http://blog.ncircle.com/blogs/vert/archives/2009/05/some_thoughts_on_the_owasp_top.html
;5/19 Making Secure Code Easier http://blogs.msdn.com/sdl/archive/2009/05/19/making-secure-code-easier.aspx
;5/19 Java deserialization issues http://blog.cr0.org/2009/05/write-once-own-everyone.html
;5/20 Parameter Pollution http://www.h-online.com/security/New-type-of-attack-on-web-applications-Parameter-Pollution--/news/113333/from/rss
;5/28 Don Ankney LayerOne XSS Presentation http://hackerco.de/2009/05/layerone-presentation-video.html
;5/28 Logging in the Age of Web Services http://1raindrop.typepad.com/1_raindrop/2009/05/logging-in-the-age-of-web-services.html

Category:OWASP Security Spending Benchmarks

2009-06-10T20:17:56Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 25th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg | 200px]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-06-10T20:10:32Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 25th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:CSI.jpg]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

File:CSI.jpg

2009-06-10T20:08:58Z

Bgelbord: CSI logo

CSI logo

Podcast News

2009-06-07T00:04:02Z

Bgelbord: added some more news stories

Category:OWASP Security Spending Benchmarks

2009-06-04T15:14:13Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-June 10th (EXTENDED): Collect survey responses through partner network. 
4. June 10th-June 20th: Analyze results and produce draft report. 
5. June 20th - June 25th: Get partner feedback on draft and make edits. 
6. June 25th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-05-28T19:22:12Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 29th (EXTENDED): Collect survey responses through partner network. 
4. June 1st-June 10th: Analyze results and produce draft report. 
5. June 10th - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:The-open-group.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

File:The-open-group.gif

2009-05-28T19:20:53Z

Bgelbord:

Category:OWASP Security Spending Benchmarks

2009-05-28T18:21:51Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The Q1 2009 report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the Q1 09 study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 29th (EXTENDED): Collect survey responses through partner network. 
4. June 1st-June 10th: Analyze results and produce draft report. 
5. June 10th - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(DONE) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-05-26T17:58:28Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 29th (EXTENDED): Collect survey responses through partner network. 
4. June 1st-June 10th: Analyze results and produce draft report. 
5. June 10th - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-04-08T14:49:38Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''boaz.gelbord AT owasp.org''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-04-02T17:05:02Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

Information Security Magazine [http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1352162,00.html Web browsers remain vulnerable to user mistakes]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-30T15:42:31Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

CIO India [http://www.cio.in/news/viewArticle/ARTICLEID=5931602 Web Apps Security Spending Rising]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-27T19:47:26Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

Search Security [http://searchsecurity.techtarget.com/video/0,297151,sid14_gci1352074,00.html Video Interview with Boaz Gelbord]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-27T15:43:15Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

CIO Espana [http://www.idg.es/cio/Mas-de-un-25_por_ciento-de-las-empresas-elevara-su-gasto-en-seguridad-de-aplicaciones-Web/doc78597-seguridad.htm Más de un 25% de las empresas elevará su gasto en seguridad de aplicaciones Web]

Information Week [http://www.informationweek.com/blog/main/archives/2009/03/firms_taking_we.html Firms Taking Web App Security (More) Seriously]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T21:16:54Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

CIO.com [http://www.cio.com/article/486881/Survey_Gauges_Web_Application_Security_Spending Survey Gauges Web Application Security Spending]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T19:09:08Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

Search Security [http://securitywireweekly.blogs.techtarget.com/2009/03/25/owasp-security-benchmark-study-mobile-threats-real/ Podcast]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T18:32:38Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

The Industry Standard [http://www.thestandard.com/news/2009/03/26/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T17:37:28Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

Network World [http://www.networkworld.com/news/2009/032609-survey-gauges-web-application-security.html Survey Gauges Web Application Security Spending]

The IT Chronicle [http://www.theitchronicle.com/content/survey-gauges-web-application-security-spending Survey Gauges Web Application Security Spending]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T17:34:35Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

Info World [http://www.infoworld.com/article/09/03/26/Survey_gauges_Web_application_security_spending_1.html Survey Gauges Web Application Security Spending]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T15:05:58Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

SC Magazine: [http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ OWASP Security Spending Benchmarks Report Published]

Dark Reading: [http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Web Application Security Spending Relatively Unscathed by Poor Economy]

Search Security: [http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html More companies seek third-party code review, survey finds]

Search Security (Germany): [http://www.searchsecurity.de/themenbereiche/applikationssicherheit/sichere-software-entwicklung/articles/177103 Drittanbieter-Code-Review und geschulte Programmierer bevorzugt]

PC World: [http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html Survey Guages Web Application Security Spending]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-26T14:17:45Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage of OWASP SSB Project ==

[http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ SC Magazine] "OWASP Security Spending Benchmarks Report Published"

[http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Dark Reading] "Web Application Security Spending Relatively Unscathed by Poor Economy"

[http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html Search Security] "More companies seek third-party code review, survey finds"

[http://www.pcworld.com/businesscenter/article/162012/survey_gauges_web_application_security_spending.html PC World] "Survey Guages Web Application Security Spending"

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-24T19:02:22Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage ==

[http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ SC Magazine]

[http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Dark Reading]

[http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1351731,00.html Search Security]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-22T19:26:46Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network. 
2. April 15-30: Formulate survey questions based on identified thematic priorities 
3. May 1st-May 15th: Collect survey responses through partner network. 
4. May 15th-May 31st: Analyze results and produce draft report. 
5. June 1st - June 15th: Get partner feedback on draft and make edits. 
6. June 15th: Publish final report 

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage ==

[http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ SC Magazine]

[http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Dark Reading]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-22T19:25:39Z

Bgelbord:

[[:Category:OWASP Project]] 

== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==

Planned Q2 Timeline:

1. April 1-15: Discuss thematic priorities with partners. Expand partner network.
2. April 15-30: Formulate survey questions based on identified thematic priorities
3. May 1st-May 15th: Collect survey responses through partner network.
4. May 15th-May 31st: Analyze results and produce draft report.
5. June 1st - June 15th: Get partner feedback on draft and make edits.
6. June 15th: Publish final report

Q1 Timeline:

1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== News Coverage ==

[http://www.scmagazineus.com/OWASP-Security-Spending-Benchmarks-Report-published/article/129116/ SC Magazine]

[http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=215901240 Dark Reading]

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-19T14:33:44Z

Bgelbord:

Category:OWASP Security Spending Benchmarks

2009-03-19T03:28:16Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''
== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-19T03:26:21Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''
== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Survey Questions ==

The full list of survey questions for the March 2009 report can be found at:

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

We utilize the SurveyMonkey system to host surveys conducted for the OWASP SSB Project. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We control survey access via username/password, as well as through a trusted network of contacts. All information collected is made available through Survey Monkey.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results.(CURRENT) 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-19T03:23:46Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''
== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Survey Questions ==

The full list of survey questions can be found at:

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

We are utilizing the SurveyMonkey system to host the survey. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-19T03:22:30Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''
== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available. It can be found at the following link:

[[http://www.owasp.org/images/b/b2/OWASP_SSB_Project_Report_March_2009.pdf PDF Download]].

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or you would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Survey Questions ==

The full list of survey questions can be found at:

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

We are utilizing the SurveyMonkey system to host the survey. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

File:OWASP SSB Project Report March 2009.pdf

2009-03-19T03:18:09Z

Bgelbord:

Category:OWASP Security Spending Benchmarks

2009-03-19T03:09:41Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''
== Security Spending Benchmarks Project Report March 2009 ==

The first report of the OWASP Security Spending Benchmarks Report is now available.

There are a number of key findings in the study:

* Organizations that have suffered a public data breach spend more on security in the development process than those that have not.

* Web application security spending is expected to either stay flat or increase in nearly two thirds of companies.

* Half of respondents consider security experience important when hiring developers, and a majority provide their developers with security training. 38% have a third party firm conduct a security review of outsourced code.

* At least 61% of respondents perform an independent third party security review before deploying a Web application while 17% do not (the remainder do not know or do so when requested by customers).

* Just under half of the surveyed organizations have Web application firewalls deployed for at least some of their Web applications.

== Raw Data ==

Transparency is a key principle of the OWASP SSB Project. For this reason all raw survey results are made available to the community. We welcome additional commentary and interpretations on the survey data. The raw survey data can be found [https://www.surveymonkey.com/sr_detail.aspx?sm=6RXm2J2aqar1MT7JlandR0MYzVFmx25FwQ9trvJH1JG4GcuRCMp3TAkaCJyNCQYrtI1Ny025AnORe0Y3lU%2bj7w%3d%3d here].

== Inquiries ==

Please contact the project leader Boaz Gelbord (bgelbord at wgen dot net) if you have questions about the project or are would like to inquire about contributing to the project.

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Survey Questions ==

The full list of survey questions can be found at:

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

We are utilizing the SurveyMonkey system to host the survey. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-13T21:05:55Z

Bgelbord:

[[:Category:OWASP Project]] 

'''UPDATE: SURVEY RESULTS WILL BE PUBLISHED ON THURSDAY MARCH 19TH!'''

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

The survey was formulated with the help of our project partners to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

== Survey Questions ==

The full list of survey questions can be found at:

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

We are utilizing the SurveyMonkey system to host the survey. We do not collect any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-12T16:13:09Z

Bgelbord:

[[:Category:OWASP Project]] 

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

Prior to releasing the survey we are asking colleagues to help us formulate the most appropriate questions. Your feedback is much appreciated. We want to use the survey answers to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

How do the above answers correlate with:

<ul>
<li>Company size</li>
<li>Industry vertical</li>
<li>Sensitivity of the underlying data</li>
<li>Existence of executive level security oversight</li>
<li>Role of security in the company’s software development cycle</li>
</ul>

== Survey Questions ==

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

For data collection our current plan is to utilize the SurveyMonkey system for hosting of the survey. We will not be collecting any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we plan to take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 19th (was March 15th) - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 19th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-03-09T16:04:30Z

Bgelbord:

[[:Category:OWASP Project]] 

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

Prior to releasing the survey we are asking colleagues to help us formulate the most appropriate questions. Your feedback is much appreciated. We want to use the survey answers to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

How do the above answers correlate with:

<ul>
<li>Company size</li>
<li>Industry vertical</li>
<li>Sensitivity of the underlying data</li>
<li>Existence of executive level security oversight</li>
<li>Role of security in the company’s software development cycle</li>
</ul>

== Survey Questions ==

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

For data collection our current plan is to utilize the SurveyMonkey system for hosting of the survey. We will not be collecting any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we plan to take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. January 12th - Open up survey to respondents (DONE) 
3. February 6 (extended from Jan 26) - Close survey (DONE) 
4. February 6th - Survey Analysis Begins (DONE) 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report (DONE) 
6. February 20th- Decision point whether to include late submissions (DONE) 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. (DONE) 
8. March 15th - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 15th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-02-09T15:52:02Z

Bgelbord:

[[:Category:OWASP Project]] 

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

Prior to releasing the survey we are asking colleagues to help us formulate the most appropriate questions. Your feedback is much appreciated. We want to use the survey answers to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

How do the above answers correlate with:

<ul>
<li>Company size</li>
<li>Industry vertical</li>
<li>Sensitivity of the underlying data</li>
<li>Existence of executive level security oversight</li>
<li>Role of security in the company’s software development cycle</li>
</ul>

== Survey Questions ==

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

For data collection our current plan is to utilize the SurveyMonkey system for hosting of the survey. We will not be collecting any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we plan to take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. Open up survey to respondents (Jan 12, 2009) 
3. Close survey (Feb 6, 2009 - extended from Jan 26, 2009) 
4. February 6th - Survey Analysis Begins 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report. 
6. February 20th- Decision point whether to include late submissions 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. 
8. March 15th - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 15th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]

Category:OWASP Security Spending Benchmarks

2009-02-07T00:04:23Z

Bgelbord:

[[:Category:OWASP Project]] 

== About the Security Spending Benchmarks Project ==

The Security Spending Benchmarks Project seeks to produce guidance and an industry accepted benchmark for justifying overall Web application security spending. We want to quantify how many dollars and human resources should be allocated towards the software development life-cycle, security training, security software/tools, independent third-party reviews, Web application firewalls, etc. This project is motivated by the fact that:

<ul>
<li>There are few, if any, industry standard benchmarks for executive management to consider when deciding what is a reasonable amount of resources to spend on Web application security in or out of the software development processes.</li>
<li>Spending on security helps mitigate risks whose potential costs are often difficult to quantify, thereby making justifying and obtaining security budgets difficult.</li>
<li>Many business initiatives require organizations to take “reasonable measures” and “adhere to best practices” for developing, delivering, and/or hosting secure Web application, but there is no industry consensus or data repositories on how this translates into monetary terms.</li>
<li>Smaller organizations outside of highly regulated industries purchase and deploy Web applications with no realistic ability to evaluate their security program.</li>
<li>Producing a less secure Web application may be less expensive than producing a more secure version of the same software. Organization that have invested development resources into software security may not be able to charge a premium for this investment because there is no reference point for the investment.</li>
</ul>

Prior to releasing the survey we are asking colleagues to help us formulate the most appropriate questions. Your feedback is much appreciated. We want to use the survey answers to address the following questions and many others:

<ul>

<li>What percentage of a Web application development groups headcount is dedicated towards security?</li>
<li>How much budget is allocated towards Web application security as a percentage of software development and overall operational IT security costs?</li>
<li>Where do Web application security budget come from?</li>
<li>How much budget is allocated towards security education?</li>
</ul>

How do the above answers correlate with:

<ul>
<li>Company size</li>
<li>Industry vertical</li>
<li>Sensitivity of the underlying data</li>
<li>Existence of executive level security oversight</li>
<li>Role of security in the company’s software development cycle</li>
</ul>

== Survey Questions ==

[[https://www.owasp.org/images/7/79/Owasp_ssb_draft7.pdf PDF Download]]

== Data Collection & Distribution ==

For data collection our current plan is to utilize the SurveyMonkey system for hosting of the survey. We will not be collecting any publicly identifiable information including names, addresses, employer, email addresses, etc. from the respondents. While we expect a limited number of respondents trying to intentionally skew the results, we plan to take precautions to limit the potential while not creating unnecessary overhead. We are controlling survey access via username/password, as well as through a trusted network of contacts. All information collected will be made available in report (PDF, HTML) as well as raw (CSV, XML, etc.) form.

== Project Status ==
1. Completing the project description text and finalizing the proposed survey questions. (DONE) 
2. Open up survey to respondents (Jan 12, 2009) 
3. Close survey (Feb 6, 2009 - extended from Jan 26, 2009) 
4. February 6th - Survey Analysis Begins 
5. February 6th-20th - Boaz Gelbord and Jeremiah Grossman to edit draft report. 
6. February 20th- Decision point whether to include late submissions 
7. February 20th - Circulate draft report to partners with raw data, request to keep data confidential prior to publication. 
8. March 10th - Publish report after integrating partner feedback. Generate community interest and discussion around results. 
9. After March 10th - Coordinate formal acceptance of deliverable by OWASP and plan further steps for the project. 

== Project Leadership ==
The Security Spending Benchmarks Project Leader is [http://www.boazgelbord.com/ Boaz Gelbord] (Executive Director of Information Security, Wireless Generation). Boaz can be contacted reached directly at '''bgelbord AT wgen.net''' with any questions or feedback. Jeremiah Grossman (Founder & CTO, WhiteHat Security) is also closely assisting in the effort.

== Project Contributors ==

[[Image:AppSecLogo.jpg]] 

[[Image:Cenzic.jpg]] 

[[Image:Cigital_logo.gif]] 

[[Image:Denim_logo.gif]] 

[[Image:echelonone.jpg]] 

[[Image:eema.jpg]] 

[[Image:Fortify_logo.png]] 

[[Image:GDS_LOGO_SMALL.jpg]] 

[[Image:Ifis_logo.jpg]] 

[[Image:MetroSITEGroup.jpg]] 

[[Image:NCircle-logo.gif]] 

[[Image:Imperva_Logo.gif]] 

[[Image:Sectheory-logo-2.jpg]] 

[[Image:Logo_securosis.png]] 

[[Image:Tssci.png]] 

[[Image:TTT_logo_2008.png]] 

[[Image:Whitehat_security_logo.gif]]