<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
		<id>https://wiki.owasp.org/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Dinis.cruz</id>
		<title>OWASP - User contributions [en]</title>
		<link rel="self" type="application/atom+xml" href="https://wiki.owasp.org/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Dinis.cruz"/>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php/Special:Contributions/Dinis.cruz"/>
		<updated>2026-04-05T22:51:28Z</updated>
		<subtitle>User contributions</subtitle>
		<generator>MediaWiki 1.27.2</generator>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_-_Cyber_Security_in_the_Boardroom&amp;diff=229855</id>
		<title>OWASP - Cyber Security in the Boardroom</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_-_Cyber_Security_in_the_Boardroom&amp;diff=229855"/>
				<updated>2017-05-21T12:00:51Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:OWASP_Project_Header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==Owasp Cyber Security at the Board Level Project==&lt;br /&gt;
&lt;br /&gt;
Owasp Cyber Security at the Board Level Project is...&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
Write a short introduction&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
&lt;br /&gt;
Write a description that is just a few paragraphs long&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP XXX is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is XXX? ==&lt;br /&gt;
&lt;br /&gt;
OWASP XXX  provides:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
Link to presentation&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
Project leader's name&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
* [[OWASP_CISO_Survey]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
&lt;br /&gt;
* Link to page/download&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* [20 Nov 2013] News 2&lt;br /&gt;
* [30 Sep 2013] News 1&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
This project can be purchased as a print on demand book from Lulu.com&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=Builders]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=Defenders]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] &lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_DOC.jpg|link=]]   &lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
XXX is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of XXX, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of XXX is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/Owasp_Cyber_Security_at_the_Board_Level_Project_About_Page}} &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Projects/Owasp_Cyber_Security_at_the_Board_Level_Project_About_Page&amp;diff=229854</id>
		<title>Projects/Owasp Cyber Security at the Board Level Project About Page</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Projects/Owasp_Cyber_Security_at_the_Board_Level_Project_About_Page&amp;diff=229854"/>
				<updated>2017-05-21T12:00:35Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;{{Template:Project About | project_name =Cyber Security at the Board Level Project  | project_description = ..... .... .... | project_license =... | leader_name1 = Sherif Mans...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Template:Project About&lt;br /&gt;
| project_name =Cyber Security at the Board Level Project &lt;br /&gt;
| project_description = .....&lt;br /&gt;
....&lt;br /&gt;
....&lt;br /&gt;
| project_license =...&lt;br /&gt;
| leader_name1 = Sherif Mansour&lt;br /&gt;
| leader_email1 = sherif.mansour@owasp.org&lt;br /&gt;
| leader_username1 = &lt;br /&gt;
| mailing_list_name = &lt;br /&gt;
}}&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_-_Cyber_Security_in_the_Boardroom&amp;diff=229853</id>
		<title>OWASP - Cyber Security in the Boardroom</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_-_Cyber_Security_in_the_Boardroom&amp;diff=229853"/>
				<updated>2017-05-21T12:00:17Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;=Main=  &amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;link=&amp;lt;/div&amp;gt;  {| style=&amp;quot;padding: 0;margin:0;margin-top:10px;t...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:OWASP_Project_Header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==Owasp Cyber Security at the Board Level Project==&lt;br /&gt;
&lt;br /&gt;
Owasp Cyber Security at the Board Level Project is...&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
Write a short introduction&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
&lt;br /&gt;
Write a description that is just a few paragraphs long&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP XXX is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is XXX? ==&lt;br /&gt;
&lt;br /&gt;
OWASP XXX  provides:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
Link to presentation&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
Project leader's name&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
* [[OWASP_CISO_Survey]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
&lt;br /&gt;
* Link to page/download&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* [20 Nov 2013] News 2&lt;br /&gt;
* [30 Sep 2013] News 1&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
This project can be purchased as a print on demand book from Lulu.com&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=Builders]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=Defenders]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] &lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_DOC.jpg|link=]]   &lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
XXX is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of XXX, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of XXX is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP_Example_Project_About_Page}} &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226783</id>
		<title>Owasp-Summit-2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226783"/>
				<updated>2017-02-25T17:56:59Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Please see the site http://owaspsummit.org for all details = */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Please see the site [http://owaspsummit.org http://owaspsummit.org] for all details =&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
(Owasp Summit 2017, England, 12-16 June 2017)&lt;br /&gt;
&lt;br /&gt;
Main site at http://owaspsummit.org&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226782</id>
		<title>Owasp-Summit-2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226782"/>
				<updated>2017-02-25T17:56:45Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Please see the site [http://owaspsummit.org http://owaspsummit.org] for all details ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
(Owasp Summit 2017, England, 12-16 June 2017)&lt;br /&gt;
&lt;br /&gt;
Main site at http://owaspsummit.org&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226761</id>
		<title>Owasp-Summit-2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=226761"/>
				<updated>2017-02-24T19:53:30Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Owasp Summit 2017, England, 12-16 June 2017 */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Owasp Summit 2017, England, 12-16 June 2017=&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Please see the site [http://owaspsummit.org http://owaspsummit.org] for all details ==&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=224190</id>
		<title>Owasp-Summit-2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-Summit-2017&amp;diff=224190"/>
				<updated>2016-12-16T09:39:52Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Owasp Summit 2017, England, 12-16 June 2017=&lt;br /&gt;
&lt;br /&gt;
OWASP is organizing a Summit focused on the collaboration between  DevOps and Application Security. &lt;br /&gt;
&lt;br /&gt;
This is not a conference with uni-directional presentations, this is a working summit with working sessions on areas like: &lt;br /&gt;
* Secure Coding, &lt;br /&gt;
* Security Testing/TDD&lt;br /&gt;
* DevOps,&lt;br /&gt;
* Threat Modeling&lt;br /&gt;
* Mobile Security &lt;br /&gt;
* IoT&lt;br /&gt;
* Risk &amp;amp; Governance&lt;br /&gt;
* Privacy &amp;amp; CTO/CISO requirements&lt;br /&gt;
*  Secure Design&lt;br /&gt;
* Bug-bounties&lt;br /&gt;
* Browser Security&lt;br /&gt;
* AI for Attack &amp;amp; Defence&lt;br /&gt;
* DDoS&lt;br /&gt;
* Cyber Warfare&lt;br /&gt;
* AppSec Standards; &lt;br /&gt;
... and of course, working sessions on popular OWASP projects (lead by its leaders) such as: &lt;br /&gt;
* Zap, &lt;br /&gt;
* Top 10&lt;br /&gt;
* Dependency Checker&lt;br /&gt;
* OwaspSAMM&lt;br /&gt;
* OWASP Guides (Testing, ASVS, Core Review)&lt;br /&gt;
* AppSensor and dozens more.&lt;br /&gt;
&lt;br /&gt;
Using the same model as the past two OWASP Summits in Portugal (in [https://www.owasp.org/index.php/OWASP_EU_Summit_2008 in 20018] and [https://www.owasp.org/index.php/Summit_2011 in 2011]), this 5 day event will be a 16h day high energy experience, where the attendees are expected to work and collaborate really hard. Every working session will be thoroughly prepared and focused on actionable outcomes.&lt;br /&gt;
&lt;br /&gt;
If you care about Application Security and want to collaborate with the key players in this industry, this is the event to be.&lt;br /&gt;
&lt;br /&gt;
The Summit will occur in England, 12-16 June 2017, with an entry ticket of TBD (covering hotel + accommodation + event fee). OWASP is funding a large number of its leaders and other deserving individuals to attend, so if you feel you can't afford this fee, or your company is not in a position to sponsor you, please contact the event organisers.&lt;br /&gt;
&lt;br /&gt;
If you want to be involved, contact seba@owasp.org or dinis.cruz@owasp.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== related sites ==&lt;br /&gt;
&lt;br /&gt;
* GitHub: https://github.com/OWASP/owasp-summit-2017&lt;br /&gt;
* Slack: https://owasp.slack.com/archives/owasp-summit&lt;br /&gt;
* Tasks and questions: https://github.com/OWASP/owasp-summit-2017/issues&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Summit_2017&amp;diff=224189</id>
		<title>Summit 2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Summit_2017&amp;diff=224189"/>
				<updated>2016-12-16T09:39:30Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Redirected page to Owasp-Summit-2017&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#Redirect:[[Owasp-Summit-2017]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Summit_2017&amp;diff=223888</id>
		<title>Summit 2017</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Summit_2017&amp;diff=223888"/>
				<updated>2016-12-03T08:14:44Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Redirected page to Owasp-DevSecCon-Summit&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#Redirect:[[Owasp-DevSecCon-Summit]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Summit_2008&amp;diff=223887</id>
		<title>Summit 2008</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Summit_2008&amp;diff=223887"/>
				<updated>2016-12-03T08:12:26Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Redirected page to OWASP EU Summit 2008&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#Redirect[[OWASP_EU_Summit_2008]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Summit_2008&amp;diff=223886</id>
		<title>Summit 2008</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Summit_2008&amp;diff=223886"/>
				<updated>2016-12-03T08:11:44Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;Redirect:OWASP_EU_Summit_2008&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Redirect:OWASP_EU_Summit_2008]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-DevSecCon-Summit&amp;diff=222858</id>
		<title>Owasp-DevSecCon-Summit</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-DevSecCon-Summit&amp;diff=222858"/>
				<updated>2016-10-29T15:59:01Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Owasp-DevSecCon Summit, England, April 2017=&lt;br /&gt;
&lt;br /&gt;
OWASP is joining forces with DevSecCon to create a Summit focused on the collaboration between &lt;br /&gt;
Developers and Application Security. &lt;br /&gt;
&lt;br /&gt;
This is not a conference with uni-directional presentations, this is a working summit with working sessions on areas like: &lt;br /&gt;
* Secure Coding, &lt;br /&gt;
* Security Testing/TDD&lt;br /&gt;
* DevOps,&lt;br /&gt;
* Threat Modeling&lt;br /&gt;
* Mobile Security &lt;br /&gt;
* IoT&lt;br /&gt;
* Risk &amp;amp; Governance&lt;br /&gt;
* Privacy &amp;amp; CTO/CISO requirements&lt;br /&gt;
*  Secure Design&lt;br /&gt;
* Bug-bounties&lt;br /&gt;
* Browser Security&lt;br /&gt;
* AI for Attack &amp;amp; Defence&lt;br /&gt;
* DDoS&lt;br /&gt;
* Cyber Warfare&lt;br /&gt;
* AppSec Standards; &lt;br /&gt;
... and of course, working sessions on popular OWASP projects (lead by its leaders) such as: &lt;br /&gt;
* Zap, &lt;br /&gt;
* Top 10&lt;br /&gt;
* Dependency Checker&lt;br /&gt;
* OwaspSAMM&lt;br /&gt;
* OWASP Guides (Testing, ASVS, Core Review)&lt;br /&gt;
* AppSensor and dozens more.&lt;br /&gt;
&lt;br /&gt;
Using the same model as the past two OWASP Summits in Portugal, this 5 day event will be a 16h day high energy experience, where the attendees are expected to work and collaborate really hard. Every working session will be thoroughly prepared and focused on actionable outcomes.&lt;br /&gt;
&lt;br /&gt;
If you care about Application Security and want to collaborate with the key players in this industry, this is the event to be.&lt;br /&gt;
&lt;br /&gt;
The Summit will occur in England, April 2017, with an entry ticket of $2000 (covering travel + hotel + accommodation + event fee). OWASP is funding a large number of its leaders and other deserving individuals to attend, so if you feel you can't afford this fee, or your company is not in a position to sponsor you, please contact the event organisers.&lt;br /&gt;
&lt;br /&gt;
If you want to be involved, contact seba@owasp.org or dinis.cruz@owasp.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== related sites ==&lt;br /&gt;
&lt;br /&gt;
* GitHub: https://github.com/OWASP/owasp-devseccon-summit&lt;br /&gt;
* Slack: https://owasp.slack.com/archives/owasp-dsc-summit&lt;br /&gt;
* Tasks and questions: https://github.com/OWASP/owasp-devseccon-summit/issues&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Owasp-DevSecCon-Summit&amp;diff=222664</id>
		<title>Owasp-DevSecCon-Summit</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Owasp-DevSecCon-Summit&amp;diff=222664"/>
				<updated>2016-10-24T19:59:07Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Owasp-DevSecCon Summit, England, April 2017=&lt;br /&gt;
&lt;br /&gt;
OWASP is joining forces with DevSecCon to create a Summit focused on the collaboration between &lt;br /&gt;
Developers and Application Security. &lt;br /&gt;
&lt;br /&gt;
This is not a conference with uni-directional presentations, this is a working summit with working sessions on areas like: &lt;br /&gt;
* Secure Coding, &lt;br /&gt;
* Security Testing/TDD&lt;br /&gt;
* DevOps,&lt;br /&gt;
* Threat Modeling&lt;br /&gt;
* Mobile Security &lt;br /&gt;
* IoT&lt;br /&gt;
* Risk &amp;amp; Governance&lt;br /&gt;
* Privacy &amp;amp; CTO/CISO requirements&lt;br /&gt;
*  Secure Design&lt;br /&gt;
* Bug-bounties&lt;br /&gt;
* Browser Security&lt;br /&gt;
* AI for Attack &amp;amp; Defence&lt;br /&gt;
* DDoS&lt;br /&gt;
* Cyber Warfare&lt;br /&gt;
* AppSec Standards; &lt;br /&gt;
... and of course, working sessions on popular OWASP projects (lead by its leaders) such as: &lt;br /&gt;
* Zap, &lt;br /&gt;
* Top 10&lt;br /&gt;
* Dependency Checker&lt;br /&gt;
* OwaspSAMM&lt;br /&gt;
* OWASP Guides (Testing, ASVS, Core Review)&lt;br /&gt;
* AppSensor and dozens more.&lt;br /&gt;
&lt;br /&gt;
Using the same model as the past two OWASP Summits in Portugal, this 5 day event will be a 16h day high energy experience, where the attendees are expected to work and collaborate really hard. Every working session will be thoroughly prepared and focused on actionable outcomes.&lt;br /&gt;
&lt;br /&gt;
If you care about Application Security and want to collaborate with the key players in this industry, this is the event to be.&lt;br /&gt;
&lt;br /&gt;
The Summit will occur in England, April 2017, with an entry ticket of $2000 (covering travel + hotel + accommodation + event fee). OWASP is funding a large number of its leaders and other deserving individuals to attend, so if you feel you can't afford this fee, or your company is not in a position to sponsor you, please contact the event organisers.&lt;br /&gt;
&lt;br /&gt;
If you want to be involved, contact seba@owasp.org or dinis.cruz@owasp.org&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222574</id>
		<title>Security Champions</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222574"/>
				<updated>2016-10-20T21:46:32Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Security Champions are a key element of an AppSec team, since they create an cross-functional team focused on Application Security&lt;br /&gt;
&lt;br /&gt;
'''What is an Security Champion?'''&lt;br /&gt;
&lt;br /&gt;
*  Security Champions are active members of a team that may help to make decisions about when to engage the Security Team&lt;br /&gt;
*  Act as the &amp;quot;voice&amp;quot; of security for the given product or team&lt;br /&gt;
*  Assist in the triage of security bugs for their team or area&lt;br /&gt;
&lt;br /&gt;
'''What do they do?'''&lt;br /&gt;
&lt;br /&gt;
*  Actively participate in the AppSec JIRA and WIKI&lt;br /&gt;
*  Collaborate with other security champions&lt;br /&gt;
**  Review impact of 'breaking changes' made in other projects&lt;br /&gt;
*  Attend weekly meetings&lt;br /&gt;
*  Are the single point of contact for their assigned team&lt;br /&gt;
*  Ensure that security is not a blocker on active development or reviews&lt;br /&gt;
*  Assist in making security decisions for their team&lt;br /&gt;
**  Low-Moderate security impact&lt;br /&gt;
***  Empowered to make decisions&lt;br /&gt;
***  Document decisions made in bugs or wiki&lt;br /&gt;
**  High-Critical security impact&lt;br /&gt;
**  Work with AppSec team on mitigations strategies&lt;br /&gt;
*  Help with QA and Testing&lt;br /&gt;
**  Write Tests (from Unit Tests to Integration tests)&lt;br /&gt;
**  Help with development of CI (Continuous Integration) environments&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222572</id>
		<title>Security Champions</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222572"/>
				<updated>2016-10-20T21:43:28Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Dinis.cruz moved page OWASP Security Champions Project to Security Champions: Better to start with a page (before making it a project)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:OWASP_Project_Header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Instructions are in RED text and should be removed from your document by deleting the text with the span tags. This document is intended to serve as an example of what is required of an OWASP project wiki page. The text in red serves as instructions, while the text in black serves as an example. Text in black is expected to be replaced entirely with information specific to your OWASP project.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==The OWASP Security Principles==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you need to add your more robust project description. A project description should outline the purpose of the project, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, and project leaders should ensure that the description is meaningful.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Inevitably applications are designed with security principles architects knew about, security folks included. However, as this project demonstrates there are far more than just a 'few' principles, most of which never make it into the design.&lt;br /&gt;
&lt;br /&gt;
For example, security design happens with perhaps a handful of principles:&lt;br /&gt;
&lt;br /&gt;
* Least Privilege&lt;br /&gt;
* Perimeter Security&lt;br /&gt;
* Defence in Depth&lt;br /&gt;
&lt;br /&gt;
However, we regularly see designs without '''separation of privilege'''!&lt;br /&gt;
&lt;br /&gt;
Think about that, most web applications today have all their eggs in a single basket. The business logic, the identities, passwords, products, policy enforcement, security rules are all found in the same application database that makes up the typical website! It is little wonder then, that attacks on the database have been so completely devastating, since there is no separation of privilege!&lt;br /&gt;
&lt;br /&gt;
The aim of this project, is to identify and describe a minimum functional set of principles that must be present in a secure design.&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This section must include a shorter description of what the project is, why the project was started, and what security issue is being helped by the project deliverable. This description will be used to promote the project so make sure the description represents your project in the best way possible. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Although this is a sample template, the project is real! [http://owasp.github.io/Security-Principles Please contribute to this project.]&lt;br /&gt;
'''&lt;br /&gt;
&lt;br /&gt;
Over the course of my career, I have come across and collected a number of security ''aphorisms.'' These aphorisms constitute the fundamental principles of information security.&lt;br /&gt;
&lt;br /&gt;
None of the ideas or truths are mine, and unfortunately, I did not collect the citations. Initially, I would like to identify the correct citations for each aphorism.&lt;br /&gt;
&lt;br /&gt;
Additionally, many are re-statements of the same idea; thus, the 'collection of ideas' defines a fundamental principle. As such, I would also like to reverse engineer the principles from the aphorisms where appropriate, as well.&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project must be licensed under a community friendly or open source license.  For more information on OWASP recommended licenses, please see [https://www.owasp.org/index.php/OWASP_Licenses OWASP Licenses]. While OWASP does not promote any particular license over another, the vast majority of projects have chosen a Creative Commons license variant for documentation projects, or a GNU General Public License variant for tools and code projects.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''The OWASP Security Principles are free to use. In fact it is encouraged!!!&lt;br /&gt;
'' Additionally, I also encourage you to contribute back to the project. I have no monopoly on this knowledge; however, we all have pieces of this knowledge from our experience. Let's begin by putting our individual pieces together to make something great. Great things happen when people work together.&lt;br /&gt;
&lt;br /&gt;
The OWASP Security Principles are licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is OWASP Security Principles Project? ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Here you should add a short description of what your project actually does. What is the primary goal of your project, and why is it important?&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The end goal is to identify, cite, and document the fundamental principles of information security. Once this is well organised, I think it would be great to publish this through the [http://scriptogr.am/dennis-groves/post/owasp-press OWASP Press]. Of course, it will always remain freely available, and any money collected will go directly into the project to absorb costs with any remaining funds going to the OWASP Foundation.&lt;br /&gt;
&lt;br /&gt;
This document should serve as a guide to technical architects and designers outlining the fundamental principles of security.&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to slide presentations related to your project. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
AppSec USA 2013 [https://github.com/OWASP/Security-Principles/tree/master/Presentations/AppSec%20NYC%202013]&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project leader is the individual who decides to lead the project throughout its lifecycle. The project leader is responsible for communicating the project’s progress to the OWASP Foundation, and he/she is ultimately responsible for the project’s deliverables. The project leader must provide OWASP with his/her real name and contact e-mail address for his/her project application to be accepted, as OWASP prides itself on the openness of its products, operations, and members.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to other OWASP Projects that are similar to yours. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [[OWASP_CISO_Survey]]&lt;br /&gt;
&lt;br /&gt;
== Openhub ==&lt;br /&gt;
&lt;br /&gt;
* [https://www.openhub.net/orgs/OWASP OWASP Project Openhub]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to your repository.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The home of the OWASP Security Principles is on [https://github.com/OWASP/Security-Principles GitHub.] You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.&lt;br /&gt;
&lt;br /&gt;
However, if you like you may also download the master repository from the following links:&lt;br /&gt;
* [https://github.com/OWASP/Security-Principles/zipball/master .zip file.]&lt;br /&gt;
* [https://github.com/OWASP/Security-Principles/tarball/master .tgz file.]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to press your project has been a part of. Appropriate press includes: Project Leader interviews, articles written about your project, and videos about your project. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [20 Nov 2013] News 2&lt;br /&gt;
* [30 Sep 2013] News 1&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you place links to where your project product can be downloaded or purchased, in the case of a book. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This project can be purchased as a print on demand book from Lulu.com&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Here is where you can let the community know what project stage your project is currently in, whether the project is a builder, breaker, or defender project, and what type of project you are running. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] &lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_DOC.jpg|link=]]   &lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Many projects have &amp;quot;Frequently Asked Questions&amp;quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==How can I participate in your project?==&lt;br /&gt;
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. &lt;br /&gt;
&lt;br /&gt;
==If I am not a programmer can I participate in your project?==&lt;br /&gt;
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. &lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
&lt;br /&gt;
==Contributors==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	The success of OWASP is due to a community of enthusiasts and contributors that work to make our projects great. This is also true for the success of your project. &lt;br /&gt;
Be sure to give credit where credit is due, no matter how small! This should be a brief list of the most amazing people involved in your project. &lt;br /&gt;
Be sure to provide a link to a complete list of all the amazing people in your project's community as well.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project  [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. &lt;br /&gt;
&lt;br /&gt;
The first contributors to the project were:&lt;br /&gt;
&lt;br /&gt;
* [https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves]&lt;br /&gt;
* [https://github.com/sublimino Andrew Martin]&lt;br /&gt;
* [https://github.com/Lambdanaut Josh Thomas]&lt;br /&gt;
* '''YOUR NAME BELONGS HERE'''&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.&lt;br /&gt;
&amp;lt;/span&amp;gt; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
As of October 2013, the priorities are:&lt;br /&gt;
* Finish the referencing for each principle.&lt;br /&gt;
* Update the Project Template.&lt;br /&gt;
* Use the OWASP Press to develop a book.&lt;br /&gt;
* Finish and publish the book on Lulu.&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of the OWASP Security Principles Project is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* Helping find references to some of the principles.&lt;br /&gt;
* Project administration support. &lt;br /&gt;
* Wiki editing support.&lt;br /&gt;
* Writing support for the book. &lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &amp;quot;OWASP_Example_Project&amp;quot;. When in doubt, ask the OWASP Projects Manager. &lt;br /&gt;
Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{{:Projects/OWASP_Example_Project_About_Page}} &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_Security_Champions_Project&amp;diff=222573</id>
		<title>OWASP Security Champions Project</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_Security_Champions_Project&amp;diff=222573"/>
				<updated>2016-10-20T21:43:28Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Dinis.cruz moved page OWASP Security Champions Project to Security Champions: Better to start with a page (before making it a project)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#REDIRECT [[Security Champions]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Secure_SDLC_Cheat_Sheet&amp;diff=222219</id>
		<title>Secure SDLC Cheat Sheet</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Secure_SDLC_Cheat_Sheet&amp;diff=222219"/>
				<updated>2016-10-08T16:35:23Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: added link to project&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= DRAFT CHEAT SHEET - WORK IN PROGRESS =&lt;br /&gt;
&lt;br /&gt;
= Background =&lt;br /&gt;
&lt;br /&gt;
This cheat sheet provides a quick reference on the most important initiatives to build security into multiple parts of software development processes. This cheat sheet is based on the OWASP Software Assurance Maturity Model ([[OWASP_SAMM_Project|SAMM]]) which can be integrated into any existing SDLC. &lt;br /&gt;
&lt;br /&gt;
SAMM is based around a set of 12 security practices, which are grouped into 4 business functions. Every security practice contains a set of activities, structured into 3 maturity levels. The activities on a lower maturity level are typically easier to execute and require less formalization than the ones on a higher maturity level. &lt;br /&gt;
&lt;br /&gt;
The structure and setup of the '''SAMM maturity model''' are made to support:&lt;br /&gt;
# The '''assessment''' of the current software assurance posture &lt;br /&gt;
# The definition of the '''strategy''' (i.e. the target) that the organization should take &lt;br /&gt;
# The formulation of an implementation '''roadmap''' of how to get there and &lt;br /&gt;
# Prescriptive advice on how to '''implement''' particular activities.&lt;br /&gt;
&lt;br /&gt;
In that sense, the value of SAMM lies in providing a means to know where your organization is on its journey towards software assurance, and to understand what is recommended to move to a next level of maturity. Note that SAMM does not insist that all organizations achieve maturity level 3 in every category. Indeed, you determine the target maturity level for each Security Practice that is the best fit for your organization and its needs. SAMM provides a number of templates for typical organizations to this end, but you can adapt these as you see fit.&lt;br /&gt;
&lt;br /&gt;
= How to Apply =&lt;br /&gt;
&lt;br /&gt;
A typical approach of using SAMM in an organization is as follows:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! scope=&amp;quot;col&amp;quot; | Step&lt;br /&gt;
! scope=&amp;quot;col&amp;quot; | Purpose&lt;br /&gt;
! scope=&amp;quot;col&amp;quot; | Activities&lt;br /&gt;
! scope=&amp;quot;col&amp;quot; | Resources&lt;br /&gt;
! scope=&amp;quot;col&amp;quot; | Best Practices&lt;br /&gt;
|-&lt;br /&gt;
| Step 1 - '''Assess'''&lt;br /&gt;
| Ensure a proper start of the project &lt;br /&gt;
| '''Define the scope''' &lt;br /&gt;
Set the target of the effort (The entire enterprise, a particular application or project or team etc.)&lt;br /&gt;
&lt;br /&gt;
'''Identify Stakeholders'''&lt;br /&gt;
&lt;br /&gt;
Ensure that important stakeholders supposed to support and execute the project are identified and well aligned&lt;br /&gt;
&lt;br /&gt;
'''Spread the word'''&lt;br /&gt;
&lt;br /&gt;
Inform people about the initiative and provide them with information to understand what you will be doing&lt;br /&gt;
| '''Consider involving at least:'''&lt;br /&gt;
* Executive Sponsor&lt;br /&gt;
* Security Team &lt;br /&gt;
* Developers&lt;br /&gt;
* Architects &lt;br /&gt;
* Business Owners&lt;br /&gt;
* QA Testers&lt;br /&gt;
* Managers&lt;br /&gt;
&lt;br /&gt;
The OpenSAMM main site: http://www.opensamm.org/&lt;br /&gt;
&lt;br /&gt;
The model in .pdf: http://www.opensamm.org/&lt;br /&gt;
| Pre-screen software development maturity to have realistic expectations The smaller the scope, the easier the exercise&lt;br /&gt;
|-&lt;br /&gt;
| Step 2 - '''Assess'''&lt;br /&gt;
| Identify and understand the maturity of your chosen scope in each of the 12 software security practices&lt;br /&gt;
| '''Evaluate current practices'''&lt;br /&gt;
Organize interviews with relevant stakeholders to understand the current state of practice within your organization. You could evaluate this yourself if you understand the organization sufficiently well. SAMM provides   lightweight and detailed assessments (where the latter is an evidence-based evaluation) – use the detailed one only if you want to have absolute certainty about the scores. &lt;br /&gt;
&lt;br /&gt;
'''Determine maturity level'''&lt;br /&gt;
&lt;br /&gt;
Based on the outcome of the previous activity, determine for each security practice the maturity level according to the SAMM maturity scoring system. In a nutshell, when all activities below and within a maturity level have&lt;br /&gt;
been implemented, this level can be used for the overall score. When extra higher-level activities have been implemented without reaching a full next level, add a “+” to the rating.  &lt;br /&gt;
| The OpenSAMM toolbox http://LINK&lt;br /&gt;
&lt;br /&gt;
Online Self Assessment Tool&lt;br /&gt;
&lt;br /&gt;
https://ssa.asteriskinfosec.com.au&lt;br /&gt;
&lt;br /&gt;
Both of these resources provide you with:&lt;br /&gt;
* Assessment questions&lt;br /&gt;
* Maturity level calculation&lt;br /&gt;
| Ensure consistent assessment for different stakeholders and teams by using the same questions and interviewer &lt;br /&gt;
Consider using different formats to gather data (e.g., workshops vs. interviews.&lt;br /&gt;
Ensure interviewees understand  the particularities of activities.&lt;br /&gt;
Understand which activities are not applicable to the organization and take this into account in the overall scoring.&lt;br /&gt;
Anticipate/document  whether you plan to award partial credit, or just  document various judgement calls.&lt;br /&gt;
Repeat questions to several people to improve the assessment quality Consider making interviews anonymous to ensure honesty Don’t take questions too literally)&lt;br /&gt;
|-&lt;br /&gt;
| Step 3 - '''Set the target'''&lt;br /&gt;
| Develop a target score that you can use as a measuring stick to guide you to act on the “most important” activities for your situation&lt;br /&gt;
| '''Define the target'''&lt;br /&gt;
&lt;br /&gt;
Set or update the target by identifying which activities your organization should implement ideally. Typically this will include more lower-level than higher-level activities. Predefined roadmap templates can be used as a source for inspiration. Ensure that the total set of selected activities makes sense and take into account dependencies between activities. &lt;br /&gt;
&lt;br /&gt;
'''Estimate overall impact'''&lt;br /&gt;
&lt;br /&gt;
Estimate the impact of the chosen target on the organization. Try to express in budgetary arguments. &lt;br /&gt;
| See the How-To-Guide for  predefined templates Software Assurance Maturity Model (SAMM) Roadmap Chart Worksheet (part of the OpenSAMM Benchmarking as a comparative source)&lt;br /&gt;
| Take into account the organisation’s risk profile Respect dependencies between activities As a rough measure, the overall impact of a software assurance effort is estimated at 5 to 10% of the total development cost. &lt;br /&gt;
|-&lt;br /&gt;
| Step 4 - '''Define the plan'''&lt;br /&gt;
| Develop or update your plan to take your organization to the next level&lt;br /&gt;
| '''Determine change schedule'''&lt;br /&gt;
Choose a realistic change strategy in terms of number and duration of phases. A typical roadmap consists of 4-6 phases of 3 to 12 months.&lt;br /&gt;
&lt;br /&gt;
'''Develop / Update the roadmap plan'''&lt;br /&gt;
&lt;br /&gt;
Distribute the implementation of additional activities over the different roadmap phases, taking into account the effort required to implement them.. Try to balance the implementation effort over the different periods, and take dependencies between activities into account&lt;br /&gt;
| Software Assurance Maturity Model : A guide to building security into software development page 33: &lt;br /&gt;
http://www.opensamm.org/&lt;br /&gt;
&lt;br /&gt;
Project Plan&lt;br /&gt;
http://www.opensamm.org/downloads/&lt;br /&gt;
| Identify quick wins and plan them early on Start with awareness/training Adapt to coming release cycles / key projects&lt;br /&gt;
|-&lt;br /&gt;
| Step 5 - '''Implement'''&lt;br /&gt;
| Work the plan&lt;br /&gt;
| '''Implement activities'''&lt;br /&gt;
Implement all activities that are part of this period. Consider their  impact on processes, people, knowledge and tools. The SAMM model contains prescriptive advice on how to do this. OWASP projects may help to facilitate&lt;br /&gt;
this.&lt;br /&gt;
| Useful OWASP resources per activity are described at https://www.owasp.org&lt;br /&gt;
| Treat legacy software separately. Do not mandate migration unless really important. Avoid operational bottle-necks (in particular for the security team)&lt;br /&gt;
|- &lt;br /&gt;
| Step 6 - '''Roll out'''&lt;br /&gt;
| Ensure that improvements are available and effectively used within the organization&lt;br /&gt;
| '''Evangelize Improvements'''&lt;br /&gt;
Make the steps and improvements visible for everyone involved by organizing training and communicating.&lt;br /&gt;
&lt;br /&gt;
'''Measure effectiveness'''&lt;br /&gt;
&lt;br /&gt;
Measure the adoption and effectiveness of implemented improvements by analyzing usage and impact.&lt;br /&gt;
|&lt;br /&gt;
| Categorize applications according to their impact on the organization. Focus on high-impact applications. Use team champions to spread new activities throughout the organization&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
As part of a quick start effort, the first four phases (preparation, assess, setting the target and defining the plan) can be executed by a single person in a limited amount of time (1 to 2 days). Making sure that this is  supported in the organization, as well as the implementation and roll-out phases typically require much more time to execute.&lt;br /&gt;
&lt;br /&gt;
= Final Notes =&lt;br /&gt;
The best way to grasp SAMM is to start using it. This document has presented a number of concrete steps and supportive material to execute these. Now it’s your turn. We warmly invite you to spend a day or two on following  the first steps, and you will quickly understand and appreciate the added value of the model. Enjoy! Suggestions for improvements are very welcome. And if you’re interested, consider to join the mailinglist or become part of the OpenSAMM community&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
&lt;br /&gt;
{{Cheatsheet_Navigation}}&lt;br /&gt;
&lt;br /&gt;
[[Category:Cheatsheets]] [[Category:OWASP_Builders]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222084</id>
		<title>Security Champions</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Security_Champions&amp;diff=222084"/>
				<updated>2016-10-04T13:02:39Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;=Main= &amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt; &amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;link=&amp;lt;/...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:OWASP_Project_Header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Instructions are in RED text and should be removed from your document by deleting the text with the span tags. This document is intended to serve as an example of what is required of an OWASP project wiki page. The text in red serves as instructions, while the text in black serves as an example. Text in black is expected to be replaced entirely with information specific to your OWASP project.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==The OWASP Security Principles==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you need to add your more robust project description. A project description should outline the purpose of the project, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, and project leaders should ensure that the description is meaningful.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Inevitably applications are designed with security principles architects knew about, security folks included. However, as this project demonstrates there are far more than just a 'few' principles, most of which never make it into the design.&lt;br /&gt;
&lt;br /&gt;
For example, security design happens with perhaps a handful of principles:&lt;br /&gt;
&lt;br /&gt;
* Least Privilege&lt;br /&gt;
* Perimeter Security&lt;br /&gt;
* Defence in Depth&lt;br /&gt;
&lt;br /&gt;
However, we regularly see designs without '''separation of privilege'''!&lt;br /&gt;
&lt;br /&gt;
Think about that, most web applications today have all their eggs in a single basket. The business logic, the identities, passwords, products, policy enforcement, security rules are all found in the same application database that makes up the typical website! It is little wonder then, that attacks on the database have been so completely devastating, since there is no separation of privilege!&lt;br /&gt;
&lt;br /&gt;
The aim of this project, is to identify and describe a minimum functional set of principles that must be present in a secure design.&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This section must include a shorter description of what the project is, why the project was started, and what security issue is being helped by the project deliverable. This description will be used to promote the project so make sure the description represents your project in the best way possible. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''Although this is a sample template, the project is real! [http://owasp.github.io/Security-Principles Please contribute to this project.]&lt;br /&gt;
'''&lt;br /&gt;
&lt;br /&gt;
Over the course of my career, I have come across and collected a number of security ''aphorisms.'' These aphorisms constitute the fundamental principles of information security.&lt;br /&gt;
&lt;br /&gt;
None of the ideas or truths are mine, and unfortunately, I did not collect the citations. Initially, I would like to identify the correct citations for each aphorism.&lt;br /&gt;
&lt;br /&gt;
Additionally, many are re-statements of the same idea; thus, the 'collection of ideas' defines a fundamental principle. As such, I would also like to reverse engineer the principles from the aphorisms where appropriate, as well.&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project must be licensed under a community friendly or open source license.  For more information on OWASP recommended licenses, please see [https://www.owasp.org/index.php/OWASP_Licenses OWASP Licenses]. While OWASP does not promote any particular license over another, the vast majority of projects have chosen a Creative Commons license variant for documentation projects, or a GNU General Public License variant for tools and code projects.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''The OWASP Security Principles are free to use. In fact it is encouraged!!!&lt;br /&gt;
'' Additionally, I also encourage you to contribute back to the project. I have no monopoly on this knowledge; however, we all have pieces of this knowledge from our experience. Let's begin by putting our individual pieces together to make something great. Great things happen when people work together.&lt;br /&gt;
&lt;br /&gt;
The OWASP Security Principles are licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is OWASP Security Principles Project? ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Here you should add a short description of what your project actually does. What is the primary goal of your project, and why is it important?&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The end goal is to identify, cite, and document the fundamental principles of information security. Once this is well organised, I think it would be great to publish this through the [http://scriptogr.am/dennis-groves/post/owasp-press OWASP Press]. Of course, it will always remain freely available, and any money collected will go directly into the project to absorb costs with any remaining funds going to the OWASP Foundation.&lt;br /&gt;
&lt;br /&gt;
This document should serve as a guide to technical architects and designers outlining the fundamental principles of security.&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to slide presentations related to your project. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
AppSec USA 2013 [https://github.com/OWASP/Security-Principles/tree/master/Presentations/AppSec%20NYC%202013]&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project leader is the individual who decides to lead the project throughout its lifecycle. The project leader is responsible for communicating the project’s progress to the OWASP Foundation, and he/she is ultimately responsible for the project’s deliverables. The project leader must provide OWASP with his/her real name and contact e-mail address for his/her project application to be accepted, as OWASP prides itself on the openness of its products, operations, and members.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to other OWASP Projects that are similar to yours. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [[OWASP_CISO_Survey]]&lt;br /&gt;
&lt;br /&gt;
== Openhub ==&lt;br /&gt;
&lt;br /&gt;
* [https://www.openhub.net/orgs/OWASP OWASP Project Openhub]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to your repository.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The home of the OWASP Security Principles is on [https://github.com/OWASP/Security-Principles GitHub.] You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.&lt;br /&gt;
&lt;br /&gt;
However, if you like you may also download the master repository from the following links:&lt;br /&gt;
* [https://github.com/OWASP/Security-Principles/zipball/master .zip file.]&lt;br /&gt;
* [https://github.com/OWASP/Security-Principles/tarball/master .tgz file.]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you can link to press your project has been a part of. Appropriate press includes: Project Leader interviews, articles written about your project, and videos about your project. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* [20 Nov 2013] News 2&lt;br /&gt;
* [30 Sep 2013] News 1&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This is where you place links to where your project product can be downloaded or purchased, in the case of a book. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This project can be purchased as a print on demand book from Lulu.com&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Here is where you can let the community know what project stage your project is currently in, whether the project is a builder, breaker, or defender project, and what type of project you are running. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] &lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_DOC.jpg|link=]]   &lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Many projects have &amp;quot;Frequently Asked Questions&amp;quot; documents or pages. However, the point of such a document is not the questions. ''The point of a document like this are the '''answers'''''. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==How can I participate in your project?==&lt;br /&gt;
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. &lt;br /&gt;
&lt;br /&gt;
==If I am not a programmer can I participate in your project?==&lt;br /&gt;
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. &lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
&lt;br /&gt;
==Contributors==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	The success of OWASP is due to a community of enthusiasts and contributors that work to make our projects great. This is also true for the success of your project. &lt;br /&gt;
Be sure to give credit where credit is due, no matter how small! This should be a brief list of the most amazing people involved in your project. &lt;br /&gt;
Be sure to provide a link to a complete list of all the amazing people in your project's community as well.&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project  [https://github.com/OWASP/Security-Principles/graphs/contributors contributors is found here]. &lt;br /&gt;
&lt;br /&gt;
The first contributors to the project were:&lt;br /&gt;
&lt;br /&gt;
* [https://www.owasp.org/index.php/User:Dennis_Groves Dennis Groves]&lt;br /&gt;
* [https://github.com/sublimino Andrew Martin]&lt;br /&gt;
* [https://github.com/Lambdanaut Josh Thomas]&lt;br /&gt;
* '''YOUR NAME BELONGS HERE'''&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.&lt;br /&gt;
&amp;lt;/span&amp;gt; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active. &lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
As of October 2013, the priorities are:&lt;br /&gt;
* Finish the referencing for each principle.&lt;br /&gt;
* Update the Project Template.&lt;br /&gt;
* Use the OWASP Press to develop a book.&lt;br /&gt;
* Finish and publish the book on Lulu.&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of the OWASP Security Principles Project is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* Helping find references to some of the principles.&lt;br /&gt;
* Project administration support. &lt;br /&gt;
* Wiki editing support.&lt;br /&gt;
* Writing support for the book. &lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.--&amp;gt;&lt;br /&gt;
&amp;lt;span style=&amp;quot;color:#ff0000&amp;quot;&amp;gt;&lt;br /&gt;
	This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says &amp;quot;OWASP_Example_Project&amp;quot;. When in doubt, ask the OWASP Projects Manager. &lt;br /&gt;
Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project&lt;br /&gt;
&amp;lt;/span&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{{:Projects/OWASP_Example_Project_About_Page}} &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --&amp;gt;&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Positive_Security_Project&amp;diff=221772</id>
		<title>Positive Security Project</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Positive_Security_Project&amp;diff=221772"/>
				<updated>2016-09-25T14:19:24Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{taggedDocument&lt;br /&gt;
| type=historical&lt;br /&gt;
}}&lt;br /&gt;
&lt;br /&gt;
= Welcome to the Positive Security Project =&lt;br /&gt;
&lt;br /&gt;
A common approach on most companies is adequate the protection of their assets as part of a post mortem lessons learned process. A web site changes, data compromised and unavailability as a result of a DoS attack are common examples on a start point to accept the existence of security flaws and initiate the security enhancement to avoid future occurrences. Even in these cases the adequate security is not always performed as a consequence of the enhancement process and the most common result is to allocate efforts on the problem’s source and simply forget about the rest.&lt;br /&gt;
&lt;br /&gt;
The Positive Security Project was initiated on the OWASP Summer of Code 2008 as a long term initiative to support a continuous learning process for the market on adopt a “positive security attitude” as part of their common IT management practices through a marketing campaign to encourage a positive approach.&lt;br /&gt;
&lt;br /&gt;
The broader vision for this project is to work for change in the software market. To increase application security, we need to make it possible for people to make informed decisions about the software they buy. Then the market can work to encourage security. To enable informed decisions, we need real information about the people, process, and technology used to create an application. And that means we need positive disclosure. The negative approach to security leads to the penetrate-and-patch hamster wheel of pain security management process. The time has come to be positive and proactive.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Get Involved on Positive Security =&lt;br /&gt;
&lt;br /&gt;
'''What is Positive Security?'''&lt;br /&gt;
&lt;br /&gt;
Positive security focuses on verifying that security controls are present, properly implemented, and used in all the right places. It involves white lists and only allowing what's specifically allowed. And it involves disclosing what a company does to ensure the security of the software it produces (positive disclosure). Disclosing vulnerabilities (negative disclosure/full disclosure) has a role in the market, but the metrics produced are meaningless.&lt;br /&gt;
&lt;br /&gt;
'''How to Adopt a Positive Security Approach? (For Suppliers)'''&lt;br /&gt;
* An Overview of the Positive Security Approach - The Supplier Side&lt;br /&gt;
&lt;br /&gt;
'''How to Adopt a Positive Security Approach? (For Customers)'''&lt;br /&gt;
* An Overview of the Positive Security Approach - The Customer Side&lt;br /&gt;
* How to sell the Positive Security Approach within your company&lt;br /&gt;
* How to explain the Positive Security Approach amongst your IT colleagues&lt;br /&gt;
* How to explain the Positive Security Approach for your internal customers&lt;br /&gt;
&lt;br /&gt;
'''Public Resources on Positive Security (Companies Related)'''&lt;br /&gt;
* [http://msdn.microsoft.com/en-us/security/cc448177.aspx Microsoft Security Development Lifecycle (SDL)] (English)&lt;br /&gt;
&lt;br /&gt;
'''Public Resources on Positive Security (Government Related)'''&lt;br /&gt;
* [http://www.adacore.com/home/gnatpro/tokeneer/ The Tokeneer Project]: In order to demonstrate that developing highly secure systems to the level of rigor required by the higher assurance levels of the Common Criteria is possible, the NSA (National Security Agency) asked Praxis High Integrity Systems to undertake a research project to develop part of an existing secure system (the Tokeneer System) in accordance with Praxis’ Correctness by Construction development process. This development and research work has now been made available by the NSA to the software development and security communities in an effort to prove that it is possible to develop secure systems rigorously in a cost effective manner.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources on Positive Security (Community Related)'''&lt;br /&gt;
* [http://www.ejemplo.com Título del enlace]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The Positive Security Index&lt;br /&gt;
&lt;br /&gt;
= Updates =&lt;br /&gt;
&lt;br /&gt;
'''28 October 2008&lt;br /&gt;
'''&lt;br /&gt;
* Page layout changed to include more resources&lt;br /&gt;
&lt;br /&gt;
'''23 September 2008'''&lt;br /&gt;
&lt;br /&gt;
* The Top 50 Software Companies list was updated with relative information and links to companies' resources on Positive Security.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Get Involved =&lt;br /&gt;
&lt;br /&gt;
Everyone has something to contribute. Sharing public available information on how companies are dealing with the Positive Security Attitude is well appreciated and also the vice-versa, where companies simply don’t care about their security controls until a problem occurs and a considerable impact. If you want to contribute to the project as an author, reviewer or in any other fashion, please send a message to owasp (at) camargoneves.com explaining what you can do and how much effort you can allocate to this non-profit volunteer process.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Top 50 Software Companies =&lt;br /&gt;
&lt;br /&gt;
The Top 50 Software Companies were defined following The Big International Software Index, published at [http://www.softwaretop100.org/ Software Top 100 web site] and these companies are being studied to understand what kind of approach they maintain to deal with IT Security and if the material can be useful as reference for the Positive Security Project. This list was also defined as the reference for the [https://www.owasp.org/index.php/OWASP_Corporate_Application_Security_Rating_Guide OWASP Corporate Application Security Rating Guide].&lt;br /&gt;
&lt;br /&gt;
For each company listed, the following information are stated on this page:&lt;br /&gt;
&lt;br /&gt;
* '''Summary:''' A brief description of the company, normally copied from Wikipedia or their own website.&lt;br /&gt;
&lt;br /&gt;
* '''Related Websites:''' Links to these companies’ websites where information on Positive Security Approach is published and available for public use.&lt;br /&gt;
&lt;br /&gt;
* '''Related Resources:''' Documents, methodologies, presentations and all other resources directly related to the Positive Security approach which are available for the community.&lt;br /&gt;
&lt;br /&gt;
''Note: All links and supportive information was directly collected from the software companies' web sites without any change or adjustment. Please read it understanding that some marketing approach may be in use and apply your own critical view. :-)''&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== 01. Microsoft ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Microsoft Corporation is an American multinational computer technology corporation, which rose to dominate the home computer operating system market with MS-DOS in the mid-1980s, followed by the Windows line of operating systems. It develops, manufactures, licenses, and supports a wide range of software products for computing devices. Microsoft CTO and Senior Vice President Craig Mundie authored a whitepaper in 2002, defining the framework of the company’s Trustworthy Computing program. Four areas were identified as the initiative’s key “pillars”. Microsoft has subsequently organized its efforts to align with these goals. These key activities are set forth as: Security, Privacy, Reliability and Business Integrity. [http://en.wikipedia.org/wiki/Microsoft (Ref.1)] [http://en.wikipedia.org/wiki/Trustworthy_Computing (Ref.2)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.microsoft.com/security/default.mspx Microsoft Security Main Page]: Provides links and general information about several information security related initiatives and strategies at Microsoft.&lt;br /&gt;
&lt;br /&gt;
* [http://msdn.microsoft.com/en-us/security/cc448177.aspx Microsoft Security Development Lifecycle (SDL)]: Main website for Microsoft's SDL, a company-wide initiative and a mandatory policy since 2004. Combining a holistic and practical approach, SDL introduces security and privacy early and throughout the development process. &lt;br /&gt;
&lt;br /&gt;
'''Related Resources'''&lt;br /&gt;
* [http://msdn.microsoft.com/en-us/security/cc420639.aspx The Microsoft Security Development Lifecycle (SDL): Process Guidance]&lt;br /&gt;
&lt;br /&gt;
== 02. IBM ==&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
(03) Oracle&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(04) SAP&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(05) HP&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(06) Symantec&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(07) Computer Associates&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(08) Electronic Arts&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
	&lt;br /&gt;
(09) Adobe&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(10) Nintendo&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
	&lt;br /&gt;
(11) EMC&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(12) Autodesk&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(13) NCR&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(14) Activision&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(15) Cisco&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(16) SunGard&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(17) BMC&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(18) Intuit&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(19) Cadence&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(20) Dassault&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(21) THQ&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(22) Synopsys&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(23) Vivendi Universal Games&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(24) Take 2 Interactive&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(25) SAS Institute&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(26) Citrix&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(27) BEA&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(28) UGS&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(29)Cognos&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(30 Reynolds &amp;amp; Reynolds&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(31) Compuware&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(32) Trend Micro&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(33) Qualcomm&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(34) Apple&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(35) Novell&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(36) Sage&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(37) Misys&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(38) Infor&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(39) McAfee&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(40) Business Objects&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(41) Hyperion Solutions&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(42) Parametric Technology&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(43) Sybase&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(44) Fair Isaac&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(45) Checkpoint&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(46) Mentor Graphics&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(47) Software AG&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(48) Intergraph&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(49) Philips&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;br /&gt;
&lt;br /&gt;
(50) Eclipsys&lt;br /&gt;
&lt;br /&gt;
'''Summary'''&lt;br /&gt;
&lt;br /&gt;
Here is the text.&lt;br /&gt;
&lt;br /&gt;
'''Public Resources'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Resource]: Resource Description.&lt;br /&gt;
&lt;br /&gt;
'''Related Websites'''&lt;br /&gt;
&lt;br /&gt;
* [http://www.wikimedia.org Website]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&amp;diff=221407</id>
		<title>OWASP SAMM Project</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_SAMM_Project&amp;diff=221407"/>
				<updated>2016-09-16T18:10:18Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Main = &lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: flagship_big.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''OWASP SAMM v1.1 available in the downloads section!''' ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])&lt;br /&gt;
&lt;br /&gt;
The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for software security that is tailored to the specific risks facing the organization. SAMM helps you:&lt;br /&gt;
* '''Evaluate an organization’s existing software security practices'''&lt;br /&gt;
* '''Build a balanced software security assurance program in well-defined iterations'''&lt;br /&gt;
* '''Demonstrate concrete improvements to a security assurance program'''&lt;br /&gt;
* '''Define and measure security-related activities throughout an organization'''&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
''Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to help focus our resources and determine which components of our secure application development program to prioritize.'',  ('''Michael J. Craigue, Information Security &amp;amp; Compliance, Dell, Inc.''')&lt;br /&gt;
&lt;br /&gt;
Follow OWASP SAMM on twitter: [https://twitter.com/owaspsamm @owaspsamm]&lt;br /&gt;
&lt;br /&gt;
{{Social Media Links}}&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== Quick Download v1.1.1 ==&lt;br /&gt;
&lt;br /&gt;
[https://www.owasp.org/images/e/ec/SAMM_Core_V1-1-Final-1page.pdf SAMM Core Model]&amp;lt;br&amp;gt;&lt;br /&gt;
[https://www.owasp.org/images/2/2c/SAMM_How_To_V1-1-Final-1page.pdf How-To Guide] &amp;lt;br&amp;gt;&lt;br /&gt;
[https://www.owasp.org/images/8/89/SAMM_Quick_Start_V1-1-Final-1page.pdf Quick-Start Guide] &amp;lt;br&amp;gt;&lt;br /&gt;
[https://www.owasp.org/images/e/e3/OpenSAMM_Assessment_Toolbox_v1-1-1-Final.xlsx Updated SAMM Tool Box]&amp;lt;br&amp;gt;&lt;br /&gt;
[https://github.com/OWASP/samm OWASP SAMM on GitHub]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
Please see the [https://www.owasp.org/index.php/OWASP_SAMM_Project#News News] and [https://www.owasp.org/index.php/OWASP_SAMM_Project#Talks Talks] tabs&lt;br /&gt;
&lt;br /&gt;
== Change Log ==&lt;br /&gt;
* OWASP SAMM v1.1 Released! ([http://www.prnewswire.com/news-releases/owasp-releases-software-assurance-maturity-model-samm-version-11-for-improving-software-security-300236836.html Press Release])&lt;br /&gt;
* OpenSAMM v1.1 RC - [http://lists.owasp.org/pipermail/samm/2015-December/000758.html available for review]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
Questions? Please ask on the [https://lists.owasp.org/mailman/listinfo/samm SAMM Mailing List]&lt;br /&gt;
&lt;br /&gt;
== Project Leaders ==&lt;br /&gt;
&lt;br /&gt;
Project Leaders&amp;lt;br/&amp;gt;[https://www.owasp.org/index.php/User:Sdeleersnyder Seba Deleersnyder] [https://www.owasp.org/index.php/User:Pravir_Chandra Pravir Chandra] [https://www.owasp.org/index.php/Kuai_Hinojosa Kuai Hinojosa]  [https://www.owasp.org/index.php/User:Bart_De_Win Bart De Win] &lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
*&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; rowspan=&amp;quot;2&amp;quot; width=&amp;quot;50%&amp;quot; | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;center&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;center&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_DOC.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= Browse Online =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&lt;br /&gt;
The foundation of the model is built upon the core business functions of software development with security practices tied to each (see diagram below). The building blocks of the model are the three maturity levels defined for each of the twelve security practices. These define a wide variety of activities in which an organization could engage to reduce security risks and increase software assurance. Additional details are included to measure successful activity performance, understand the associated assurance benefits, estimate personnel and other costs.&lt;br /&gt;
&lt;br /&gt;
[[Image:SAMM-Overview.png|720px]]&lt;br /&gt;
&lt;br /&gt;
===== Click on any badge to learn more =====&lt;br /&gt;
&lt;br /&gt;
{| cellpadding=&amp;quot;1&amp;quot;&lt;br /&gt;
|[https://www.owasp.org/index.php/SAMM_-_Governance https://www.owasp.org/images/f/f7/G.png]&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Strategy &amp;amp; Metrics'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Strategy_&amp;amp;_Metrics|abbr=SM|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Policy &amp;amp; Compliance'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Policy_&amp;amp;_Compliance|abbr=PC|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Education &amp;amp; Guidance'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Education_&amp;amp;_Guidance|abbr=EG|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|[https://www.owasp.org/index.php/SAMM_-_Construction https://www.owasp.org/images/e/ee/C.png]&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Threat Assessment'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Threat_Assessment|abbr=TA|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Security Requirements'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Security_Requirements|abbr=SR|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Secure Architecture'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Secure_Architecture|abbr=SA|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|[https://www.owasp.org/index.php/SAMM_-_Verification https://www.owasp.org/images/8/83/V.png]&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Design Review'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Design_Review|abbr=DR|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Code Review'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Code_Review|abbr=CR|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Security Testing'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Security_Testing|abbr=ST|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|[https://www.owasp.org/index.php/SAMM_-_Deployment https://www.owasp.org/images/5/54/D.png]&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Vulnerability Management'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Vulnerability_Management|abbr=VM|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Environment Hardening'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Environment_Hardening|abbr=EH|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|align=&amp;quot;center&amp;quot;|'''Operational Enablement'''&lt;br /&gt;
|{{SAMM-BadgeList|name=Operational_Enablement|abbr=OE|padding=0}}&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
= Downloads =&lt;br /&gt;
&lt;br /&gt;
The latest work in progress can be found on Github: https://github.com/OWASP/opensamm&lt;br /&gt;
&lt;br /&gt;
Download SAMM v1.1&lt;br /&gt;
* [https://www.owasp.org/images/d/d8/OpenSAMM_Core_V1-1-Final.pdf SAMM Core Model] document, explaining the maturity model;&lt;br /&gt;
* [https://www.owasp.org/images/a/a7/OpenSAMM_How_To_V1-1-Final.pdf How-To Guide] with implementation guidance;&lt;br /&gt;
* [https://www.owasp.org/images/3/3f/OpenSAMM_Quick_Start_V1-1-Final.pdf Quick-Start Guide] with different steps to improve your secure software practice;&lt;br /&gt;
* [https://www.owasp.org/images/b/b9/OpenSAMM_Assessment_Toolbox_v1-1-Final.xlsx Updated SAMM Tool Box] to perform SAMM assessments and create SAMM roadmaps;&lt;br /&gt;
&lt;br /&gt;
Download SAMM v1.0:&lt;br /&gt;
* in [https://www.owasp.org/images/c/c0/SAMM-1.0.pdf English - PDF], [https://www.owasp.org/images/2/25/SAMM-1.0-en_US-0.3.xml.zip English - XML]&lt;br /&gt;
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-es_MX.pdf Spanish - PDF], [https://www.owasp.org/images/a/a1/SAMM-1.0-es_MX-0.3.xml.zip Spanish - XML]&lt;br /&gt;
* in [https://www.owasp.org/images/a/a9/SAMM-1.0-ja_JP.pdf Japanese - PDF], not available as XML&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Available resources to apply SAMM:&lt;br /&gt;
* Browse OWASP and other resources for SAMM Security practices: [[:Category:SAMM-Resources]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Trainings:&lt;br /&gt;
* Recent OWASP SAMM 1-Day training slide deck delivered by Bart De Win and Sebastien Deleersnyder at AppSec Europe 2014 in Cambridge&lt;br /&gt;
** Slide deck download [https://www.owasp.org/images/d/df/OpenSAMM_Training_vFINAL.pptx here]&lt;br /&gt;
** Training description download [https://www.owasp.org/images/7/7c/Training_-_Bootstrap_and_improve_your_SDLC_with_OpenSAMM.docx here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Assessments:&lt;br /&gt;
* SAMM v1.1 RC1 toolbox&lt;br /&gt;
** download the latest toolbox, including the updated questions [https://github.com/OWASP/opensamm/blob/master/v1.1/OpenSAMM_Assessment_Toolbox_v1-1-RC.xlsx here]&lt;br /&gt;
* Assessment Interview Template by Nick Coblentz for SAMM V1.0&lt;br /&gt;
** This [https://www.owasp.org/images/c/cf/20090607-SAMMAssessmentInterviewTemplate-1.0.xls spreadsheet] breaks down the assessment questionnaire from the SAMM framework into assertion statements that can be used to drive assessment interviews.&lt;br /&gt;
* Roadmap Chart Template by Colin Watson for SAMM V1.0&lt;br /&gt;
** This [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] provides a simple way to capture the data for a SAMM roadmap and automatically generate graphics similar to those that appear in the framework.&lt;br /&gt;
* Assessment Worksheet by Christian Frichot for SAMM V1.0&lt;br /&gt;
** This is an easy-to-use  [https://www.owasp.org/images/e/e2/20090610-Samm-roadmap-chart-template.xls spreadsheet] containing the assessment questionnaire from the SAMM framework. Features some auto-scoring to make the appearance very polished.&lt;br /&gt;
* Project Plan Template by Jim Weiler for SAMM V1.0&lt;br /&gt;
** This is a [https://www.owasp.org/images/3/33/SAMMProject.zip project plan template] (MS Project) that captures the activities from the SAMM levels. Useful for copying pieces into existing development project schedules.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Mappings:&lt;br /&gt;
* BSIMM-6 mapping to SAMM activities:&lt;br /&gt;
** Spreadsheet download [https://github.com/OWASP/opensamm/tree/master/v1.1/mapping here]&lt;br /&gt;
** Presentation with start of analysis download [https://www.owasp.org/images/6/66/OpenSAMM_-_BSIMM-V_mapping.pptx here]&lt;br /&gt;
* BSIMM mapping to SAMM during the 2011 Summit:&lt;br /&gt;
** This [https://www.owasp.org/images/2/2e/20110301-OpenSAMM-BSIMM-Mapping.xlsx spreadsheet] contains an activity-level mapping between OpenSAMM and BSIMM. Note that in some cases, multiple BSIMM activities map to a single SAMM activity (109 in BSIMM map to 72 in SAMM).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Tools:&lt;br /&gt;
*Javascript visualization framework for SAMM on [https://github.com/qudosoft-labs/SAMMCharts github]&lt;br /&gt;
&lt;br /&gt;
= Community =&lt;br /&gt;
&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
{{:Projects/OWASP SAMM Project/Pages/Community | Community}}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Summit =&lt;br /&gt;
&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&lt;br /&gt;
In 2016 we organized our second OWASP SAMM Summit in New York on 20-21 April, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2016 &amp;gt;here&amp;lt;] !!&lt;br /&gt;
&lt;br /&gt;
Read the wrap-up of the Summit here: https://docs.google.com/document/d/19_LC1euR7ZuazRYgeblhPE1Fv6E8N56Bu8zANq2JB30/edit&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In 2015 we organized our the first OWASP SAMM Summit in Dublin on 27-28 March, details [https://www.owasp.org/index.php/OWASP_SAMM_Summit_2015 &amp;gt;here&amp;lt;] !!&lt;br /&gt;
&lt;br /&gt;
Summit Notes:&lt;br /&gt;
* 28 Mar 2015 - https://docs.google.com/document/d/1pC4har75olF1WPZaqRfXFG9T3SS_qoEUvHkEynE0iTI/edit&lt;br /&gt;
* Summit outcome is described [http://www.opensamm.org/2015/04/opensamm-summit-dublin-outcome/ here]&lt;br /&gt;
''&amp;quot;The SAMM summit provided an opportunity to breathe new life into a framework that I use to facilitate my day-to-day work and support my customers.&amp;quot;'' Bruce C Jenkins, Fortify Security Lead, Hewlett-Packard Company&lt;br /&gt;
&lt;br /&gt;
Previous workshop Notes:&lt;br /&gt;
&lt;br /&gt;
During the AppSec conferences, the SAMM project team organises workshops for you to influence the direction SAMM evolves.&lt;br /&gt;
&lt;br /&gt;
This is also an excellent opportunity to exchange experiences with your peers.&lt;br /&gt;
&lt;br /&gt;
If you plan on attending http://appsec.eu  be sure to get involved in the SAMM workshop (scheduled on Jun-23).&lt;br /&gt;
* The agenda for the SAMM Workshop in Cambridge on 23-Jun-2014 is available [https://docs.google.com/document/d/1tXqIovpSuFqycVYetdGSC2PiPygySymiLUhHT5yHR2M/edit here].&lt;br /&gt;
&lt;br /&gt;
Previous workshop notes:&lt;br /&gt;
* The notes for the SAMM Workshop in New York on 21-Nov-2013 are available [https://docs.google.com/document/d/1PwoDVsWyhoWksBiLIRh8UOh-QCs8H7QMqrSUsS13WzU/edit here].&lt;br /&gt;
* The notes for the SAMM Workshop in Hamburg on 21-Aug-2013 are available [https://docs.google.com/document/d/12mB7FkmhcI04YDZle_VD90n1xcENgNhAGqZkCAb6EkM/edit here].&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Talks =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
{{:Projects/OWASP SAMM Project/Pages/Talks | Talks}}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= News =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
{{:Projects/OWASP SAMM Project/Pages/News | News}}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Languages =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
'''SAMM is available in the following languages:'''&lt;br /&gt;
&lt;br /&gt;
* English&lt;br /&gt;
* Spanish&lt;br /&gt;
* Japanese&lt;br /&gt;
&lt;br /&gt;
Carlos Allendes created a presentation in Spanish on SAMM during the 2011 LatAm tour, download the [https://www.owasp.org/images/c/cf/05_OWASP_LatamTur2011_OpenSAMM.pdf presentation].&lt;br /&gt;
Hubert Grégoire and Sebastien Gioria created a French translation of the OpenSAMM 1.0 Overview presentation available for download [https://www.owasp.org/images/f/fd/OpenSAMM-1.0-fr_FR.ppt here].&lt;br /&gt;
&lt;br /&gt;
You can use [http://crowdin.net/project/owasp-samm Crowdin] to help improve these translations or add new ones right now!&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Roadmap =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Updated roadmap:&lt;br /&gt;
Next 1.2 release, updated scoring:&lt;br /&gt;
* Recover source and move it to an asciidoctor based document.&lt;br /&gt;
* Clarification of maturity levels (syntactic changes to keep the text consistent)&lt;br /&gt;
* Not change activities but try to impose the current scoring system on existing activities, i.e. move from binary yes/no to the multi-tiered questions/answers of the current proposal. &lt;br /&gt;
* Show improvements with every activity introduced&lt;br /&gt;
* Adapt for the new scoring method&lt;br /&gt;
* Update questions for 4-tiers&lt;br /&gt;
* Review and where necessary clarify current questions&lt;br /&gt;
* Consider v1.1 remarks that were not withheld for the previous release&lt;br /&gt;
Targeted completion date: end of september in time for Appsec USA (October 11, 2016)&lt;br /&gt;
&lt;br /&gt;
SAMM version 2.0&lt;br /&gt;
* Core model changed&lt;br /&gt;
* Visualisations + flavours for a few development methodologies&lt;br /&gt;
* Update quickstart guide, TB, HTG. &lt;br /&gt;
* Success metrics: How well does the model work: Linked to the benchmarking project.&lt;br /&gt;
Timing: Target release appseceu 2017. Target rc release for samm summit 2017&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
= Get Involved =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Involvement in the development of SAMM is actively encouraged!&lt;br /&gt;
&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
&lt;br /&gt;
==Feedback==&lt;br /&gt;
&lt;br /&gt;
Please use the [https://lists.owasp.org/mailman/listinfo/samm Mailing List] for feedback:&lt;br /&gt;
* What do like?&lt;br /&gt;
* What don't you like?&lt;br /&gt;
* How can we make SAMM easier to use?&lt;br /&gt;
* How could SAMM be improved? &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Localization==&lt;br /&gt;
&lt;br /&gt;
Are you fluent in another language? Can you help translate SAMM into that language?&lt;br /&gt;
&lt;br /&gt;
You can use [http://crowdin.net/project/owasp-samm Crowdin] to do that!&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Project Sponsors =&lt;br /&gt;
[[Image:OwaspSAMM.png|right]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size:120%;border:none;margin: 0;color:#000&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==SAMM Adopters==&lt;br /&gt;
Current list of [https://www.owasp.org/index.php/OpenSAMM_Adopters OpenSAMM adopters]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
SAMM is developed and maintained by a worldwide team of volunteers.&lt;br /&gt;
&lt;br /&gt;
But we have also been helped by many organizations, either financially or by encouraging their employees to work on SAMM:&lt;br /&gt;
&lt;br /&gt;
==== Acknowledgements ====&lt;br /&gt;
We would like to thank the following sponsors who donated funds to our project:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[File:Belgium_Chapter.PNG|250px|link=https://www.owasp.org/index.php/Belgium]]&lt;br /&gt;
[[File:London_Chapter.PNG|250px|link=https://www.owasp.org/index.php/London]]&lt;br /&gt;
&lt;br /&gt;
[[File:Aspectsecurity.png|250px|link=http://www.aspectsecurity.com]]&lt;br /&gt;
[[File:Astech_Consulting_logo.png|250px|link=http://www.astechconsulting.com/]] &lt;br /&gt;
[[File:Denim_Group_logo.jpg|250px|link=http://www.denimgroup.com/]] &lt;br /&gt;
[[File:Gotham_Digital_Science_logo.jpg|250px|link=http://www.gdssecurity.com/]] &lt;br /&gt;
&lt;br /&gt;
{{MemberLinksv2|link=http://www.hpenterprisesecurity.com|logo=HP_Blue_RGB_150_SM.png|size=300px90px}} &lt;br /&gt;
[[File:NetSPI_logo.png|250px|link=http://www.netspi.com/]] &lt;br /&gt;
[[Image:PwC_logo_4colourprint_(2)_Resized_good_one.jpg|150px|link=http://www.pwc.com]]&lt;br /&gt;
[[File:SI_Logo_Stacked_Application_Security.jpg|250px|link=http://www.securityinnovation.com/]] &lt;br /&gt;
[[File:LogoToreon.jpg|250px|link=http://www.toreon.com]] &lt;br /&gt;
[[File:Veracode-samm.png|250px|link=http://www.veracode.com]] &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br/&amp;gt;&lt;br /&gt;
{{OWASP Book|6888083}}&lt;br /&gt;
&amp;lt;br/&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP_Project|Zed Attack Proxy Project]]&lt;br /&gt;
[[Category:OWASP_Tool]]&lt;br /&gt;
[[Category:OWASP_Release_Quality_Tool|OWASP Release Quality Tool]]&lt;br /&gt;
[[Category:OWASP_Download]]&lt;br /&gt;
[[Category:Popular]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218077</id>
		<title>Transport Layer Protection Cheat Sheet</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218077"/>
				<updated>2016-06-19T13:20:26Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Benefits */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt; __NOTOC__&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:Cheatsheets-header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' &lt;br /&gt;
= Introduction  =&lt;br /&gt;
 __TOC__{{TOC hidden}}&lt;br /&gt;
&lt;br /&gt;
This cheat sheet provides a simple model to follow when implementing transport layer protection for an application. Although the concept of SSL is known to many, the actual details and security specific decisions of implementation are often poorly understood and frequently result in insecure deployments. This article establishes clear rules which provide guidance on securely designing and configuring transport layer security for an application. This article is focused on the use of SSL/TLS between a web application and a web browser, but we also encourage the use of SSL/TLS or other network encryption technologies, such as VPN, on back end and other non-browser based connections.&amp;lt;br&amp;gt; &lt;br /&gt;
&lt;br /&gt;
== Architectural Decision  ==&lt;br /&gt;
&lt;br /&gt;
An architectural decision must be made to determine the appropriate method to protect data when it is being transmitted.  The most common options available to corporations are Virtual Private Networks (VPN) or a SSL/TLS model commonly used by web applications. The selected model is determined by the business needs of the particular organization. For example, a VPN connection may be the best design for a partnership between two companies that includes mutual access to a shared server over a variety of protocols. Conversely, an Internet facing enterprise web application would likely be best served by a SSL/TLS model. &lt;br /&gt;
&lt;br /&gt;
TLS is mainly a defence against man-in-the-middle attacks. An TLS Threat Model is one that starts with the question ''&amp;quot;What is the business impact of an attacker's ability to observe, intercept and manipulate the traffic between the client and the server&amp;quot;''.&lt;br /&gt;
&lt;br /&gt;
This cheat sheet will focus on security considerations when the SSL/TLS model is selected. This is a frequently used model for publicly accessible web applications.&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection with SSL/TLS  =&lt;br /&gt;
&lt;br /&gt;
== Benefits  ==&lt;br /&gt;
&lt;br /&gt;
The primary benefit of transport layer security is the protection of web application data from unauthorized disclosure and modification when it is transmitted between clients (web browsers) and the web application server, and between the web application server and back end and other non-browser based enterprise components. &lt;br /&gt;
&lt;br /&gt;
The server validation component of TLS provides authentication of the server to the client.  If configured to require client side certificates, TLS can also play a role in client authentication to the server. However, in practice client side certificates are not often used in lieu of username and password based authentication models for clients.&lt;br /&gt;
&lt;br /&gt;
TLS also provides two additional benefits that are commonly overlooked; integrity guarantees and replay prevention. A TLS stream of communication contains built-in controls to prevent tampering with any portion of the encrypted data. In addition, controls are also built-in to prevent a captured stream of TLS data from being replayed at a later time.&lt;br /&gt;
&lt;br /&gt;
It should be noted that TLS provides the above guarantees to data during transmission. TLS does not offer any of these security benefits to data that is at rest. Therefore appropriate security controls must be added to protect data while at rest within the application or within data stores.&lt;br /&gt;
&lt;br /&gt;
* Use TLS, as SSL is no longer considered usable for security&lt;br /&gt;
&lt;br /&gt;
* All pages must be served over HTTPS. This includes css, scripts, images, AJAX requests, POST data and third party includes. Failure to do so creates a vector for man-in-the-middle attacks.&lt;br /&gt;
&lt;br /&gt;
* Just protecting authenticated pages with HTTPS, is not enough. Once there is one request in HTTP, man-in-the-middle attacks are possible, with the attackers being able to prevent users from reaching the secured pages.&lt;br /&gt;
&lt;br /&gt;
* the [[HTTP Strict Transport Security]] Header must be used and [https://hstspreload.appspot.com/ pre loaded into browsers]. This will instruct compatible browsers to only use HTTPS, even if requested to use HTTP.&lt;br /&gt;
&lt;br /&gt;
* Cookies must be marked as Secure&lt;br /&gt;
&lt;br /&gt;
== Basic Requirements ==&lt;br /&gt;
&lt;br /&gt;
The basic requirements for using TLS are: access to a Public Key Infrastructure (PKI) in order to obtain certificates, access to a directory or an Online Certificate Status Protocol (OCSP) responder in order to check certificate revocation status, and agreement/ability to support a minimum configuration of protocol versions and protocol options for each version.&lt;br /&gt;
&lt;br /&gt;
== SSL vs. TLS  ==&lt;br /&gt;
&lt;br /&gt;
The terms, Secure Socket Layer (SSL) and Transport Layer Security (TLS) are often used interchangeably. In fact, SSL v3.1 is equivalent to TLS v1.0. However, different versions of SSL and TLS are supported by modern web browsers and by most modern web frameworks and platforms. For the purposes of this cheat sheet we will refer to the technology generically as TLS. Recommendations regarding the use of SSL and TLS protocols, as well as browser support for TLS, can be found in the rule below titled [[Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols| &amp;quot;Only Support Strong Protocols&amp;quot;]].&lt;br /&gt;
&lt;br /&gt;
[[Image:Asvs_cryptomodule.gif|thumb|350px|right|Cryptomodule Parts and Operation]]&lt;br /&gt;
&lt;br /&gt;
== When to Use a FIPS 140-2 Validated Cryptomodule ==&lt;br /&gt;
&lt;br /&gt;
If the web application may be the target of determined attackers (a common threat model for Internet accessible applications handling sensitive data), it is strongly advised to use TLS services that are provided by [http://csrc.nist.gov/groups/STM/cmvp/validation.html FIPS 140-2 validated cryptomodules]. &lt;br /&gt;
&lt;br /&gt;
A cryptomodule, whether it is a software library or a hardware device, basically consists of three parts:&lt;br /&gt;
&lt;br /&gt;
* Components that implement cryptographic algorithms (symmetric and asymmetric algorithms, hash algorithms, random number generator algorithms, and message authentication code algorithms) &lt;br /&gt;
* Components that call and manage cryptographic functions (inputs and outputs include cryptographic keys and so-called critical security parameters) &lt;br /&gt;
* A physical container around the components that implement cryptographic algorithms and the components that call and manage cryptographic functions&lt;br /&gt;
&lt;br /&gt;
The security of a cryptomodule and its services (and the web applications that call the cryptomodule) depend on the correct implementation and integration of each of these three parts. In addition, the cryptomodule must be used and accessed securely. The includes consideration for:&lt;br /&gt;
&lt;br /&gt;
* Calling and managing cryptographic functions&lt;br /&gt;
* Securely Handling inputs and output&lt;br /&gt;
* Ensuring the secure construction of the physical container around the components&lt;br /&gt;
&lt;br /&gt;
In order to leverage the benefits of TLS it is important to use a TLS service (e.g. library, web framework, web application server) which has been FIPS 140-2 validated. In addition, the cryptomodule must be installed, configured and operated in either an approved or an allowed mode to provide a high degree of certainty that the FIPS 140-2 validated cryptomodule is providing the expected security services in the expected manner.&lt;br /&gt;
&lt;br /&gt;
If the system is legally required to use FIPS 140-2 encryption (e.g., owned or operated by or on behalf of the U.S. Government) then TLS must be used and SSL disabled. Details on why SSL is unacceptable are described in Section 7.1 of [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program].&lt;br /&gt;
&lt;br /&gt;
Further reading on the use of TLS to protect highly sensitive data against determined attackers can be viewed in [http://csrc.nist.gov/publications/nistpubs/800-52/SP800-52.pdf SP800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
&lt;br /&gt;
== Secure Server Design  ==&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use TLS or Other Strong Transport Everywhere  ===&lt;br /&gt;
&lt;br /&gt;
All networks, both external and internal, must utilize TLS or an equivalent transport layer security mechanism for all communication. It is not sufficient to claim that access to the internal network is &amp;quot;restricted to employees&amp;quot;. Numerous recent data compromises have shown that the internal network can be breached by attackers. In these attacks, sniffers have been installed to access unencrypted sensitive data sent on the internal network.&lt;br /&gt;
&lt;br /&gt;
The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the &amp;quot;login landing page&amp;quot;, must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session. &lt;br /&gt;
&lt;br /&gt;
Even marketing or other low-security websites still require TLS. Lack of TLS leads to a lack of integrity which allows attackers to modify content in transit. Also, sites that do not provide TLS are marked lower in pagerank for SEO.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Provide Non-TLS Pages for Secure Content  ===&lt;br /&gt;
&lt;br /&gt;
All pages which are available over TLS must not be available over a non-TLS connection. A user may inadvertently bookmark or manually type a URL to a HTTP page (e.g. http://example.com/myaccount) within the authenticated portion of the application. If this request is processed by the application then the response, and any sensitive data, would be returned to the user over the clear text HTTP.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Mix TLS and Non-TLS Content  ===&lt;br /&gt;
&lt;br /&gt;
A page that is available over TLS must be comprised completely of content which is transmitted over TLS. The page must not contain any content that is transmitted over unencrypted HTTP. This includes content from unrelated third party sites. &lt;br /&gt;
&lt;br /&gt;
An attacker could intercept any of the data transmitted over the unencrypted HTTP and inject malicious content into the user's page. This malicious content would be included in the page even if the overall page is served over TLS. In addition, an attacker could steal the user's session cookie that is transmitted with any non-TLS requests. This is possible if the cookie's 'secure' flag is not set. See the rule 'Use &amp;quot;Secure&amp;quot; Cookie Flag'&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use &amp;quot;Secure&amp;quot; Cookie Flag  ===&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Secure&amp;quot; flag must be set for all user cookies. Failure to use the &amp;quot;secure&amp;quot; flag enables an attacker to access the session cookie by tricking the user's browser into submitting a request to an unencrypted page on the site. This attack is possible even if the server is not configured to offer HTTP content since the attacker is monitoring the requests and does not care if the server responds with a 404 or doesn't respond at all.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Keep Sensitive Data Out of the URL ===&lt;br /&gt;
&lt;br /&gt;
Sensitive data must not be transmitted via URL arguments. A more appropriate place is to store sensitive data in a server side repository or within the user's session.  When using TLS the URL arguments and values are encrypted during transit. However, there are two methods that the URL arguments and values could be exposed.&lt;br /&gt;
&lt;br /&gt;
1. The entire URL is cached within the local user's browser history. This may expose sensitive data to any other user of the workstation.&lt;br /&gt;
&lt;br /&gt;
2. The entire URL is exposed if the user clicks on a link to another HTTPS site. This may expose sensitive data within the referral field to the third party site. This exposure occurs in most browsers and will only occur on transitions between two TLS sites. &lt;br /&gt;
&lt;br /&gt;
For example, a user following a link on [http://owasp.org https://example.com] which leads to [http://owasp.org https://someOtherexample.com] would expose the full URL of [http://owasp.org https://example.com] (including URL arguments) in the referral header (within most browsers). This would not be the case if the user followed a link on [http://owasp.org https://example.com] to [http://owasp.org http://someHTTPexample.com]&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prevent Caching of Sensitive Data ===&lt;br /&gt;
&lt;br /&gt;
The TLS protocol provides confidentiality only for data in transit but it does not help with potential data leakage issues at the client or intermediary proxies. As a result, it is frequently prudent to instruct these nodes not to cache or persist sensitive data. One option is to add anticaching headers to relevant HTTP responses, (for example, &amp;quot;Cache-Control: no-cache, no-store&amp;quot; and &amp;quot;Expires: 0&amp;quot; for coverage of many modern browsers as of 2013). For compatibility with HTTP/1.0 (i.e., when user agents are really old or the webserver works around quirks by forcing HTTP/1.0) the response should also include the header &amp;quot;Pragma: no-cache&amp;quot;. More information is available in [https://tools.ietf.org/html/rfc2616 HTTP 1.1 RFC 2616], section 14.9.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use HTTP Strict Transport Security ===&lt;br /&gt;
&lt;br /&gt;
See: [[HTTP Strict Transport Security]]&lt;br /&gt;
&lt;br /&gt;
===Rule - Use Public Key Pinning===&lt;br /&gt;
&lt;br /&gt;
See: [[Certificate and Public Key Pinning]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;span id=&amp;quot;Server_Certificate_and_Protocol_Configuration&amp;quot;&amp;gt;&amp;lt;/span&amp;gt; &amp;lt;!-- backward compatible anchor --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Server Certificate ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Strong Keys &amp;amp; Protect Them ===&lt;br /&gt;
&lt;br /&gt;
The private key used to generate the cipher key must be sufficiently strong for the anticipated lifetime of the private key and corresponding certificate. The current best practice is to select a key size of at least 2048 bits. Additional information on key lifetimes and comparable key strengths can be found in [http://www.keylength.com/en/compare/], [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57]. In addition, the private key must be stored in a location that is protected from unauthorized access.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use a Certificate That Supports Required Domain Names ===&lt;br /&gt;
&lt;br /&gt;
A user should never be presented with a certificate error, including prompts to reconcile domain or hostname mismatches, or expired certificates. If the application is available at both [https://owasp.org https://www.example.com] and [https://owasp.org https://example.com] then an appropriate certificate, or certificates, must be presented to accommodate the situation. The presence of certificate errors desensitizes users to TLS error messages and increases the possibility an attacker could launch a convincing phishing or man-in-the-middle attack.&lt;br /&gt;
&lt;br /&gt;
For example, consider a web application accessible at [https://owasp.org https://abc.example.com] and [https://owasp.org https://xyz.example.com]. One certificate should be acquired for the host or server ''abc.example.com''; and a second certificate for host or server ''xyz.example.com''. In both cases, the hostname would be present in the Subject's Common Name (CN).&lt;br /&gt;
&lt;br /&gt;
Alternatively, the Subject Alternate Names (SANs) can be used to provide a specific listing of multiple names where the certificate is valid. In the example above, the certificate could list the Subject's CN as ''example.com'', and list two SANs: ''abc.example.com'' and ''xyz.example.com''. These certificates are sometimes referred to as &amp;quot;multiple domain certificates&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Fully Qualified Names in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Use fully qualified names in the DNS name field, and do not use unqualifed names (e.g., 'www'), local names (e.g., 'localhost'), or private IP addresses (e.g., 192.168.1.1) in the DNS name field. Unqualifed names, local names, or private IP addresses violate the certificate specification.&lt;br /&gt;
 &lt;br /&gt;
=== Rule - Do Not Use Wildcard Certificates ===&lt;br /&gt;
&lt;br /&gt;
You should refrain from using wildcard certificates. Though they are expedient at circumventing annoying user prompts, they also [[Least_privilege|violate the principal of least privilege]] and asks the user to trust all machines, including developer's machines, the secretary's machine in the lobby and the sign-in kiosk. Obtaining access to the private key is left as an exercise for the attacker, but its made much easier when stored on the file system unprotected.&lt;br /&gt;
&lt;br /&gt;
Statistics gathered by Qualys for [http://media.blackhat.com/bh-us-10/presentations/Ristic/BlackHat-USA-2010-Ristic-Qualys-SSL-Survey-HTTP-Rating-Guide-slides.pdf Internet SSL Survey 2010] indicate wildcard certificates have a 4.4% share, so the practice is not standard for public facing hosts. Finally, wildcard certificates violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Use RFC 1918 Addresses in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Certificates should not use private addresses. RFC 1918 is [https://tools.ietf.org/html/rfc1918 Address Allocation for Private Internets]. Private addresses are Internet Assigned Numbers Authority (IANA) reserved and include 192.168/16, 172.16/12, and 10/8.&lt;br /&gt;
&lt;br /&gt;
Certificates issued with private addresses violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines]. In addition, Peter Gutmann writes in in [http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf Engineering Security]: &amp;quot;This one is particularly troublesome because, in combination with the router-compromise attacks... and ...OSCP-defeating measures, it allows an attacker to spoof any EV-certificate site.&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use an Appropriate Certification Authority for the Application's User Base  ===&lt;br /&gt;
&lt;br /&gt;
An application user must never be presented with a warning that the certificate was signed by an unknown or untrusted authority. The application's user population must have access to the public certificate of the certification authority which issued the server's certificate. For Internet accessible websites, the most effective method of achieving this goal is to purchase the TLS certificate from a recognize certification authority. Popular Internet browsers already contain the public certificates of these recognized certification authorities. &lt;br /&gt;
&lt;br /&gt;
Internal applications with a limited user population can use an internal certification authority provided its public certificate is securely distributed to all users. However, remember that all certificates issued by this certification authority will be trusted by the users. Therefore, utilize controls to protect the private key and ensure that only authorized individuals have the ability to sign certificates. &lt;br /&gt;
&lt;br /&gt;
The use of self signed certificates is never acceptable. Self signed certificates negate the benefit of end-point authentication and also significantly decrease the ability for an individual to detect a man-in-the-middle attack. &lt;br /&gt;
&lt;br /&gt;
=== Rule - Always Provide All Needed Certificates ===&lt;br /&gt;
&lt;br /&gt;
Clients attempt to solve the problem of identifying a server or host using PKI and X509 certificate. When a user receives a server or host's certificate, the certificate must be validated back to a trusted root certification authority. This is known as path validation.&lt;br /&gt;
&lt;br /&gt;
There can be one or more intermediate certificates in between the end-entity (server or host) certificate and root certificate. In addition to validating both endpoints, the user will also have to validate all intermediate certificates. Validating all intermediate certificates can be tricky because the user may not have them locally. This is a well-known PKI issue called the “Which Directory?&amp;quot; problem.&lt;br /&gt;
&lt;br /&gt;
To avoid the “Which Directory?&amp;quot; problem, a server should provide the user with all required certificates used in a path validation.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Be aware of and have a plan for the SHA-1 deprecation plan  ===&lt;br /&gt;
&lt;br /&gt;
In order to avoid presenting end users with progressive certificate warnings, organizations must proactively address the browser vendor's upcoming SHA-1 deprecation plans. The Google Chrome plan is probably the most specific and aggressive at this point: [http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html Gradually sunsetting SHA-1]&lt;br /&gt;
&lt;br /&gt;
If your organization has no [https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility SHA256 compatibility issues] then it may be appropriate to move your site to a SHA256 signed certificate/chain.  If there are, or may be, issues - you should ensure that your SHA-1 certificates expire before 1/1/2017. &lt;br /&gt;
&lt;br /&gt;
== Server Protocol and Cipher Configuration ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Protocols ===&lt;br /&gt;
&lt;br /&gt;
SSL/TLS is a collection of protocols. Weaknesses have been identified with earlier SSL protocols, including [http://www.schneier.com/paper-ssl-revised.pdf SSLv2] and [http://www.yaksman.org/~lweith/ssl.pdf SSLv3], hence SSL versions 1, 2, and 3 should not longer be used. The best practice for transport layer protection is to only provide support for the TLS protocols - TLS 1.0, TLS 1.1 and TLS 1.2. This configuration will provide maximum protection against skilled and determined attackers and is appropriate for applications handling sensitive data or performing critical operations.&lt;br /&gt;
&lt;br /&gt;
[http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers Nearly all modern browsers support at least TLS 1.0]. As of February 2014, contemporary browsers (Chrome v20+, Firefox v27+, IE v8+, Opera v10+, and Safari v5+) [http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers support TLS 1.1 and TLS 1.2]. You should provide support for TLS 1.1 and TLS 1.2 to accommodate clients that support these protocols. The client and server (usually) negotiate the best protocol that is supported on both sides.&lt;br /&gt;
&lt;br /&gt;
TLS 1.0 is still widely used as the 'best' protocol by a lot of browsers that are not patched to the very latest version. It suffers from [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html CBC Chaining attacks and Padding Oracle attacks]. TLSv1.0 should only be used after risk analysis and acceptance. PCI DSS 3.1 [https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf prohibits] use of TLS 1.0 after June 30, 2016.&lt;br /&gt;
&lt;br /&gt;
Under no circumstances either SSLv2 or SSLv3 should be enabled as a protocol selection:&lt;br /&gt;
* The [http://www.schneier.com/paper-ssl-revised.pdf SSLv2 protocol is broken] and does not provide adequate transport layer protection.&lt;br /&gt;
* [http://www.yaksman.org/~lweith/ssl.pdf SSLv3 had been known for weaknesses] which severely compromise the channel's security long before the [https://www.openssl.org/~bodo/ssl-poodle.pdf 'POODLE'-Bug] finally stopped to tolerate this protocol by October 2014. Switching off SSLv3 terminates the support of legacy browsers like [https://www.ssllabs.com/ssltest/viewClient.html?name=IE&amp;amp;version=6&amp;amp;platform=XP IE6/XP] and elder (in their default configuration).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prefer Ephemeral Key Exchanges ===&lt;br /&gt;
&lt;br /&gt;
Ephemeral key exchanges are based on Diffie-Hellman and use per-session, temporary keys during the initial SSL/TLS handshake. They provide perfect forward secrecy (PFS), which means a compromise of the server's long term signing key does not compromise the confidentiality of past session (see [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]]). When the server uses an ephemeral key, the server will sign the temporary key with its long term key (the long term key is the customary key available in its certificate).&lt;br /&gt;
&lt;br /&gt;
Use cryptographic parameters (like DH-parameter) that use a secure length that match to the supported keylength of your certificate (&amp;gt;=2048 bits or equivalent Elliptic Curves). As some middleware had some issues with this, upgrade to the latest version. &lt;br /&gt;
Note: There are some legacy browsers or old Java versions that are not capable to cope with DH-Params &amp;gt;1024 bits, please read the [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]] how this can be solved.&lt;br /&gt;
&lt;br /&gt;
Do *not* use standardized DH-parameters like they are defined by RFCs 2409, 3526, or 5114. Generate your individual DH-parameters to get unique prime numbers (this may take a long time):&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
openssl dhparam 2048 -out dhparam2048.pem&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
Set the path to use this parameter file, e.g. when using Apache:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
SSLOpenSSLConfCmd DHParameters &amp;lt;path to dhparam2048.pem&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
  &lt;br /&gt;
If you have a server farm and are providing forward secrecy, then you might have to disable session resumption. For example, Apache writes the session id's and master secrets to disk so all servers in the farm can participate in resuming a session (there is currently no in-memory mechanism to achieve the sharing). Writing the session id and master secret to disk undermines forward secrecy.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Cryptographic Ciphers  ===&lt;br /&gt;
&lt;br /&gt;
Each protocol (TLSv1.0, TLSv1.1, TLSv1.2, etc) provides cipher suites. As of TLS 1.2, [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 there is support for over 300 suites (320+ and counting)], including [http://www.mail-archive.com/cryptography@randombit.net/msg03785.html national vanity cipher suites]. The strength of the encryption used within a TLS session is determined by the encryption cipher negotiated between the server and the browser. In order to ensure that only strong cryptographic ciphers are selected the server must be modified to disable the use of weak ciphers and to configure the ciphers in an adequate order. It is recommended to configure the server to only support strong ciphers and to use sufficiently large key sizes. In general, the following should be observed when selecting CipherSuites:&lt;br /&gt;
* Use the very latest recommendations, they may be volantile these days&lt;br /&gt;
* Setup your Policy to get a Whitelist for recommended Ciphers, e.g.:&lt;br /&gt;
** Activate to set the Cipher Order by the Server&lt;br /&gt;
** Highest Priority for Ciphers that support 'Forward Secrecy' (-&amp;gt; Support ephemeral Diffie-Hellman key exchange, see rule above) [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html]&lt;br /&gt;
** Favor DHE over ECDHE (and monitor the CPU usage, see Notes below), ECDHE lacks now of really reliable Elliptic Curves, see discussion about secp{224,256,384,521}r1 and secp256k1, cf. [http://safecurves.cr.yp.to], [https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929]. The solution might be to use [http://www.researchgate.net/profile/Johannes_Merkle/publication/260050106_Standardisierung_der_Brainpool-Kurven_fr_TLS_und_IPSec/file/60b7d52f36a0cc2fdd.pdf Brainpool Curves &amp;lt;nowiki&amp;gt;[German]&amp;lt;/nowiki&amp;gt;], defined for TLS in [https://tools.ietf.org/html/rfc7027 RFC 7027], or [http://eprint.iacr.org/2007/286 Edwards Curves]. The most promising candidates for the latter are [https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06 'Curve25519'] and [http://sourceforge.net/p/ed448goldilocks/wiki/Home/ Ed448-Goldilocks] (see  [https://tools.ietf.org/html/rfc7748 RFC 7748 - Elliptic Curves for Security]), that is not yet defined for TLS, cf. [http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 IANA] and [https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-05 DRAFT-ietf-tls-rfc4492bis] &amp;lt;!--- as at January 2016 ---&amp;gt;&lt;br /&gt;
** Use RSA-Keys (no DSA/DSS: they get very weak, if a bad entropy source is used during signing, cf. [https://projectbullrun.org/dual-ec/tls.html], [https://factorable.net/weakkeys12.conference.pdf]) &amp;lt;!--- as at June 2014 ---&amp;gt;&lt;br /&gt;
** Favor GCM over CBC regardless of the cipher size. In other words, use Authenticated Encryption with Associated Data (AEAD), e.g. AES-GCM, AES-CCM.&lt;br /&gt;
** Watch also for Stream Ciphers which XOR the key stream with plaintext (such as AES/CTR mode) &amp;lt;!--- Jim please check this ---&amp;gt;&lt;br /&gt;
** Priorize the ciphers by the sizes of the Cipher and the MAC&lt;br /&gt;
** Use SHA1 or above for digests, prefer SHA2 (or equivalent)&lt;br /&gt;
** Disable weak ciphers (which is implicitly done by this whitelist) without disabling legacy browsers and bots that have to be supported (find the best compromise), actually the cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) does this job.&lt;br /&gt;
*** Disable cipher suites that do not offer encryption (eNULL, NULL)&lt;br /&gt;
*** Disable cipher suites that do not offer authentication (aNULL). aNULL includes anonymous cipher suites ADH (Anonymous Diffie-Hellman) and AECDH (Anonymous Elliptic Curve Diffie Hellman).&lt;br /&gt;
*** Disable export level ciphers (EXP, eg. ciphers containing DES)&lt;br /&gt;
*** Disable key sizes smaller than 128 bits for encrypting payload traffic (see [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: TR-02102 Part 2 (German)])&lt;br /&gt;
*** Disable the use of MD5 as a hashing mechanism for payload traffic&lt;br /&gt;
*** Disable the use of IDEA Cipher Suites (see [https://tools.ietf.org/html/rfc5469])&lt;br /&gt;
*** Disable RC4 cipher suites (see [https://tools.ietf.org/html/rfc7465], [http://www.isg.rhul.ac.uk/tls/])&lt;br /&gt;
** Ciphers should be usable for DH-Pamameters &amp;gt;= 2048 bits, without blocking legacy browsers (The cipher ‘DHE-RSA-AES128-SHA’ is suppressed as some browsers like to use it but are not capable to cope with DH-Params &amp;gt; 1024 bits; Alternative option: Move 'DHE-RSA-AES128-SHA' and sometimes even 'DHE-RSA-AES256-SHA' behind RSA/AES (e.g. 'RSA-AES128-SHA'), if you are forced to support 'historic' clients with this issue.)&lt;br /&gt;
* Define a Cipher String that works with different Versions of your encryption tool, like openssl&lt;br /&gt;
* Verify your cipher string&lt;br /&gt;
** with an audit-tool, like [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
** listing it manually with your encryption software, e.g. openssl ciphers -v &amp;lt;cipher-string&amp;gt; (the result may differ by version), e.g.:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}} &lt;br /&gt;
openssl ciphers -v &amp;quot;EDH+aRSA+AESGCM:EDH+aRSA+AES:DHE-RSA-AES256-SHA:EECDH+aRSA+AESGCM:EECDH+aRSA+AES:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:RSA+AESGCM:RSA+AES+SHA:DES-CBC3-SHA:-DHE-RSA-AES128-SHA&amp;quot; &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;add optionally ':!aNULL:!eNULL:!LOW:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!ADH:!IDEA' to protect older Versions of OpenSSL&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;you may use openssl ciphers -V &amp;quot;...&amp;quot; for openssl &amp;gt;= 1.0.1:&lt;br /&gt;
&amp;lt;small&amp;gt;&lt;br /&gt;
 0x00,0x9F - DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9E - DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x6B - DHE-RSA-AES256-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA256&lt;br /&gt;
 0x00,0x39 - DHE-RSA-AES256-SHA          SSLv3   Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x67 - DHE-RSA-AES128-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0xC0,0x28 - ECDHE-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA384&lt;br /&gt;
 0xC0,0x14 - ECDHE-RSA-AES256-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0xC0,0x27 - ECDHE-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x13 - ECDHE-RSA-AES128-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x9D - AES256-GCM-SHA384           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9C - AES128-GCM-SHA256           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x35 - AES256-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x2F - AES128-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x0A - DES-CBC3-SHA                SSLv3   Kx=RSA    Au=RSA  Enc=3DES(168)   Mac=SHA1&lt;br /&gt;
&amp;lt;/small&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
&lt;br /&gt;
* Inform yourself how to securely configure the settings for your used services or hardware, e.g. [https://bettercrypto.org BetterCrypto.org: Applied Crypto Hardening (DRAFT)]&lt;br /&gt;
* Check new software and hardware versions for new security settings.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;b&amp;gt;Notes:&amp;lt;/b&amp;gt;&lt;br /&gt;
* According to my researches the most common browsers should be supported with this setting, too (see also [https://www.ssllabs.com/ssltest/index.html SSL Labs: SSL Server Test -&amp;gt; SSL Report -&amp;gt; Handshake Simulation]).&lt;br /&gt;
* Monitor the performance of your server, e.g. the TLS handshake with DHE hinders the CPU abt 2.4 times more than ECDHE, cf. [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html#some-benchmarks Vincent Bernat, 2011], [http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html nmav's Blog, 2011].&lt;br /&gt;
* Use of Ephemeral Diffie-Hellman key exchange will protect confidentiality of the transmitted plaintext data even if the corresponding RSA or DSS server private key got compromised. An attacker would have to perform active man-in-the-middle attack at the time of the key exchange to be able to extract the transmitted plaintext. All modern browsers support this key exchange with the notable exception of Internet Explorer prior to Windows Vista.&lt;br /&gt;
&lt;br /&gt;
Additional information can be obtained within the [https://tools.ietf.org/html/rfc5246 TLS 1.2 RFC 5246], [https://www.ssllabs.com/projects/best-practices/index.html SSL Labs: 'SSL/TLS Deployment Best Practices'], [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: 'TR-02102 Part 2 (German)'], [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report ENISA: 'Algorithms, Key Sizes and Parameters Report'], [https://tools.ietf.org/html/rfc7525 RFC 7525: Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)] and [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf FIPS 140-2 IG].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Support TLS-PSK and TLS-SRP for Mutual Authentication ===&lt;br /&gt;
&lt;br /&gt;
When using a shared secret or password offer TLS-PSK (Pre-Shared Key) or TLS-SRP (Secure Remote Password), which are known as Password Authenticated Key Exchange (PAKEs). TLS-PSK and TLS-SRP properly bind the channel, which refers to the cryptographic binding between the outer tunnel and the inner authentication protocol. IANA currently reserves [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 79 PSK cipehr suites] and [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 9 SRP cipher suites].&lt;br /&gt;
&lt;br /&gt;
Basic authentication places the user's password on the wire in the plain text after a server authenticates itself. Basic authentication only provides unilateral authentication. In contrast, both TLS-PSK and TLS-SRP provide mutual authentication, meaning each party proves it knows the password without placing the password on the wire in the plain text.&lt;br /&gt;
&lt;br /&gt;
Finally, using a PAKE removes the need to trust an outside party, such as a Certification Authority (CA).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Secure Renegotiations  ===&lt;br /&gt;
&lt;br /&gt;
A design weakness in TLS, identified as [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555 CVE-2009-3555], allows an attacker to inject a plaintext of his choice into a TLS session of a victim. In the HTTPS context the attacker might be able to inject his own HTTP requests on behalf of the victim. The issue can be mitigated either by disabling support for TLS renegotiations or by supporting only renegotiations compliant with [https://tools.ietf.org/html/rfc5746 RFC 5746]. All modern browsers have been updated to comply with this RFC.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Disable Compression ===&lt;br /&gt;
&lt;br /&gt;
Compression Ratio Info-leak Made Easy (CRIME) is an exploit against the data compression scheme used by the TLS and SPDY protocols. The exploit allows an adversary to recover user authentication cookies from HTTPS. The recovered cookie can be subsequently used for session hijacking attacks.&lt;br /&gt;
&lt;br /&gt;
== Test your overall TLS/SSL setup and your Certificate ==&lt;br /&gt;
This section shows the most common references only. For more tools and such, please refer to [[#Tools|Tools]].&lt;br /&gt;
&lt;br /&gt;
* [[Testing_for_SSL-TLS_%28OWASP-CM-001%29 | OWASP Testing Guide: Chapter on SSL/TLS Testing]]&lt;br /&gt;
* [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
* other Tools: [[Testing_for_Weak_SSL/TSL_Ciphers,_Insufficient_Transport_Layer_Protection_%28OWASP-EN-002%29#References| Testing for Weak SSL/TSL Ciphers, Insufficient Transport Layer Protection (OWASP-EN-002) (DRAFT)]] - References - Tools&lt;br /&gt;
&lt;br /&gt;
== Client (Browser) Configuration  ==&lt;br /&gt;
&lt;br /&gt;
The validation procedures to ensure that a certificate is valid are complex and difficult to correctly perform.  In a typical web application model, these checks will be performed by the client's web browser in accordance with local browser settings and are out of the control of the application. However, these items do need to be addressed in the following scenarios:&lt;br /&gt;
&lt;br /&gt;
* The application server establishes connections to other applications over TLS for purposes such as web services or any exchange of data&lt;br /&gt;
* A thick client application is connecting to a server via TLS&lt;br /&gt;
&lt;br /&gt;
In these situations extensive certificate validation checks must occur in order to establish the validity of the certificate. Consult the following resources to assist in the design and testing of this functionality. The NIST PKI testing site includes a full test suite of certificates and expected outcomes of the test cases.&lt;br /&gt;
* [http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html NIST PKI Testing]&lt;br /&gt;
* [https://tools.ietf.org/html/rfc5280 IETF RFC 5280]&lt;br /&gt;
&lt;br /&gt;
As specified in the above guidance, if the certificate can not be validated for any reason then the connection between the client and server must be dropped. Any data exchanged over a connection where the certificate has not properly been validated could be exposed to unauthorized access or modification.&lt;br /&gt;
&lt;br /&gt;
== Additional Controls  ==&lt;br /&gt;
&lt;br /&gt;
=== Extended Validation Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Extended validation certificates (EV Certificates) proffer an enhanced investigation by the issuer into the requesting party due to the industry's race to the bottom. The purpose of EV certificates is to provide the user with greater assurance that the owner of the certificate is a verified legal entity for the site. Browsers with support for EV certificates distinguish an EV certificate in a variety of ways. Internet Explorer will color a portion of the URL in green, while Mozilla will add a green portion to the left of the URL indicating the company name. &lt;br /&gt;
&lt;br /&gt;
High value websites should consider the use of EV certificates to enhance customer confidence in the certificate. It should also be noted that EV certificates do not provide any greater technical security for the TLS. The purpose of the EV certificate is to increase user confidence that the target site is indeed who it claims to be.&lt;br /&gt;
&lt;br /&gt;
=== Client-Side Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Client side certificates can be used with TLS to prove the identity of the client to the server. Referred to as &amp;quot;two-way TLS&amp;quot;, this configuration requires the client to provide their certificate to the server, in addition to the server providing their's to the client. If client certificates are used, ensure that the same validation of the client certificate is performed by the server, as indicated for the validation of server certificates above. In addition, the server should be configured to drop the TLS connection if the client certificate cannot be verified or is not provided. &lt;br /&gt;
&lt;br /&gt;
The use of client side certificates is relatively rare currently due to the complexities of certificate generation, safe distribution, client side configuration, certificate revocation and reissuance, and the fact that clients can only authenticate on machines where their client side certificate is installed. Such certificates are typically used for very high value connections that have small user populations.&lt;br /&gt;
&lt;br /&gt;
=== Certificate and Public Key Pinning ===&lt;br /&gt;
&lt;br /&gt;
Hybrid and native applications can take advantage of [[Certificate_and_Public_Key_Pinning|certificate and public key pinning]]. Pinning associates a host (for example, server) with an identity (for example, certificate or public key), and allows an application to leverage knowledge of the pre-existing relationship. At runtime, the application would inspect the certificate or public key received after connecting to the server. If the certificate or public key is expected, then the application would proceed as normal. If unexpected, the application would stop using the channel and close the connection since an adversary could control the channel or server.&lt;br /&gt;
&lt;br /&gt;
Pinning still requires customary X509 checks, such as revocation, since CRLs and OCSP provides real time status information. Otherwise, an application could possibly (1) accept a known bad certificate; or (2) require an out-of-band update, which could result in a lengthy App Store approval.&lt;br /&gt;
&lt;br /&gt;
Browser based applications are at a disadvantage since most browsers do not allow the user to leverage pre-existing relationships and ''a priori'' knowledge. In addition, Javascript and Websockets do not expose methods to for a web app to query the underlying secure connection information (such as the certificate or public key). It is noteworthy that Chromium based browsers perform pinning on selected sites, but the list is currently maintained by the vendor.&lt;br /&gt;
&lt;br /&gt;
For more information, please see the [[Pinning Cheat Sheet]].&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection for Back End and Other Connections  =&lt;br /&gt;
&lt;br /&gt;
Although not the focus of this cheat sheet, it should be stressed that transport layer protection is necessary for back-end connections and any other connection where sensitive data is exchanged or where user identity is established. Failure to implement an effective and robust transport layer security will expose sensitive data and undermine the effectiveness of any authentication or access control mechanism. &lt;br /&gt;
&lt;br /&gt;
== Secure Internal Network Fallacy  ==&lt;br /&gt;
&lt;br /&gt;
The internal network of a corporation is not immune to attacks. Many recent high profile intrusions, where thousands of sensitive customer records were compromised, have been perpetrated by attackers that have gained internal network access and then used sniffers to capture unencrypted data as it traversed the internal network.&lt;br /&gt;
&lt;br /&gt;
== Protocol and Cipher Configuration for Back End and Other Connections ==&lt;br /&gt;
It is important to provide TLS for server-to-server communication in addition to client-to-server communication. Secure the 'client side' configuration of your server that is used for backend and other connections according to [[#Server_Protocol_and_Cipher_Configuration | Server Protocol and Cipher Configuration]]. Be sure to deactivate insecure protocols and ciphers. (e.g. Only support a minimum strong configuration when your server acts as 'client').&lt;br /&gt;
&lt;br /&gt;
= Tools =&lt;br /&gt;
=== local/offline ===&lt;br /&gt;
* [[O-Saft|O-Saft - OWASP SSL advanced forensic tool]]&lt;br /&gt;
* [http://sourceforge.net/projects/sslscan/ SSLScan - Fast SSL Scanner]&lt;br /&gt;
* [https://github.com/iSECPartners/sslyze SSLyze]&lt;br /&gt;
* [http://www.g-sec.lu/sslaudit/sslaudit.zip SSL Audit]&lt;br /&gt;
&lt;br /&gt;
=== Online ===&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
&lt;br /&gt;
* [https://www.htbridge.com/ssl/ High-Tech Bridge online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port]&lt;br /&gt;
&lt;br /&gt;
= Related Articles  =&lt;br /&gt;
&lt;br /&gt;
* Mozilla – [https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations Mozilla Recommended Configurations]&lt;br /&gt;
* OWASP – [[Testing for SSL-TLS (OWASP-CM-001)|Testing for SSL-TLS]], and OWASP [[Guide to Cryptography]] &lt;br /&gt;
* OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]&lt;br /&gt;
* OWASP – ASVS Article on [[Why you need to use a FIPS 140-2 validated cryptomodule]]&lt;br /&gt;
* SSL Labs – [https://www.ssllabs.com/projects/best-practices/index.html SSL/TLS Deployment Best Practices]&lt;br /&gt;
* SSL Labs – [http://www.ssllabs.com/projects/rating-guide/index.html SSL Server Rating Guide]&lt;br /&gt;
* ENISA – [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report Algorithms, Key Sizes and Parameters Report]&lt;br /&gt;
* BSI   – [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI TR-02102 Part 2 (German)]&lt;br /&gt;
* yaSSL – [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html Differences between SSL and TLS Protocol Versions]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/PubsSPs.html#800-52 SP 800-52 Rev. 1 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf FIPS 140-2 Security Requirements for Cryptographic Modules]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57 Recommendation for Key Management, Revision 3], [http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-57-Part%203-Rev.1 Public DRAFT]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/drafts.html#sp800-95 SP 800-95 Guide to Secure Web Services] &lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5280 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc2246 RFC 2246 The Transport Layer Security (TLS) Protocol Version 1.0 (JAN 1999)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc4346 RFC 4346 The Transport Layer Security (TLS) Protocol Version 1.1 (APR 2006)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5246 RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 (AUG 2008)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc7525 RFC 7525 Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)]&lt;br /&gt;
* bettercrypto - [https://bettercrypto.org Applied Crypto Hardening: HOWTO for secure crypto settings of the most common services (DRAFT)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Authors and Primary Editors  =&lt;br /&gt;
&lt;br /&gt;
Torsten Gigler - torsten.gigler[at]owasp.org&amp;lt;br/&amp;gt;&lt;br /&gt;
Michael Coates - michael.coates[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Dave Wichers - dave.wichers[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Tyler Reguly -treguly[at]sslfail.com&lt;br /&gt;
&lt;br /&gt;
== Other Cheatsheets ==&lt;br /&gt;
&lt;br /&gt;
{{Cheatsheet_Navigation_Body}}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Cheatsheets]]&lt;br /&gt;
[[Category:OWASP Best Practices]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218076</id>
		<title>Transport Layer Protection Cheat Sheet</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218076"/>
				<updated>2016-06-19T12:45:16Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Reworded bullet points to re-enforce the concept that we need to be doing 100% TLS&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt; __NOTOC__&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:Cheatsheets-header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' &lt;br /&gt;
= Introduction  =&lt;br /&gt;
 __TOC__{{TOC hidden}}&lt;br /&gt;
&lt;br /&gt;
This cheat sheet provides a simple model to follow when implementing transport layer protection for an application. Although the concept of SSL is known to many, the actual details and security specific decisions of implementation are often poorly understood and frequently result in insecure deployments. This article establishes clear rules which provide guidance on securely designing and configuring transport layer security for an application. This article is focused on the use of SSL/TLS between a web application and a web browser, but we also encourage the use of SSL/TLS or other network encryption technologies, such as VPN, on back end and other non-browser based connections.&amp;lt;br&amp;gt; &lt;br /&gt;
&lt;br /&gt;
== Architectural Decision  ==&lt;br /&gt;
&lt;br /&gt;
An architectural decision must be made to determine the appropriate method to protect data when it is being transmitted.  The most common options available to corporations are Virtual Private Networks (VPN) or a SSL/TLS model commonly used by web applications. The selected model is determined by the business needs of the particular organization. For example, a VPN connection may be the best design for a partnership between two companies that includes mutual access to a shared server over a variety of protocols. Conversely, an Internet facing enterprise web application would likely be best served by a SSL/TLS model. &lt;br /&gt;
&lt;br /&gt;
TLS is mainly a defence against man-in-the-middle attacks. An TLS Threat Model is one that starts with the question ''&amp;quot;What is the business impact of an attacker's ability to observe, intercept and manipulate the traffic between the client and the server&amp;quot;''.&lt;br /&gt;
&lt;br /&gt;
This cheat sheet will focus on security considerations when the SSL/TLS model is selected. This is a frequently used model for publicly accessible web applications.&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection with SSL/TLS  =&lt;br /&gt;
&lt;br /&gt;
== Benefits  ==&lt;br /&gt;
&lt;br /&gt;
The primary benefit of transport layer security is the protection of web application data from unauthorized disclosure and modification when it is transmitted between clients (web browsers) and the web application server, and between the web application server and back end and other non-browser based enterprise components. &lt;br /&gt;
&lt;br /&gt;
The server validation component of TLS provides authentication of the server to the client.  If configured to require client side certificates, TLS can also play a role in client authentication to the server. However, in practice client side certificates are not often used in lieu of username and password based authentication models for clients.&lt;br /&gt;
&lt;br /&gt;
TLS also provides two additional benefits that are commonly overlooked; integrity guarantees and replay prevention. A TLS stream of communication contains built-in controls to prevent tampering with any portion of the encrypted data. In addition, controls are also built-in to prevent a captured stream of TLS data from being replayed at a later time.&lt;br /&gt;
&lt;br /&gt;
It should be noted that TLS provides the above guarantees to data during transmission. TLS does not offer any of these security benefits to data that is at rest. Therefore appropriate security controls must be added to protect data while at rest within the application or within data stores.&lt;br /&gt;
&lt;br /&gt;
* Use TLS, as SSL is no longer considered usable for security&lt;br /&gt;
&lt;br /&gt;
* All pages must be served over HTTPS. This includes css, scripts, images, AJAX requests, POST data. Failure to do so creates a vector for man-in-the-middle attacks.&lt;br /&gt;
&lt;br /&gt;
* Just protecting authenticated pages with HTTPS, is not enough. Once there is one request in HTTP, man-in-the-middle attacks are possible, with the attackers being able to prevent users from reaching the secured pages.&lt;br /&gt;
&lt;br /&gt;
* the [[HTTP Strict Transport Security]] Header must be used and [https://hstspreload.appspot.com/ pre loaded into browsers]. This will instruct compatible browsers to only use HTTPS, even if requested to use HTTP.&lt;br /&gt;
&lt;br /&gt;
* Cookies must be marked as Secure&lt;br /&gt;
&lt;br /&gt;
== Basic Requirements ==&lt;br /&gt;
&lt;br /&gt;
The basic requirements for using TLS are: access to a Public Key Infrastructure (PKI) in order to obtain certificates, access to a directory or an Online Certificate Status Protocol (OCSP) responder in order to check certificate revocation status, and agreement/ability to support a minimum configuration of protocol versions and protocol options for each version.&lt;br /&gt;
&lt;br /&gt;
== SSL vs. TLS  ==&lt;br /&gt;
&lt;br /&gt;
The terms, Secure Socket Layer (SSL) and Transport Layer Security (TLS) are often used interchangeably. In fact, SSL v3.1 is equivalent to TLS v1.0. However, different versions of SSL and TLS are supported by modern web browsers and by most modern web frameworks and platforms. For the purposes of this cheat sheet we will refer to the technology generically as TLS. Recommendations regarding the use of SSL and TLS protocols, as well as browser support for TLS, can be found in the rule below titled [[Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols| &amp;quot;Only Support Strong Protocols&amp;quot;]].&lt;br /&gt;
&lt;br /&gt;
[[Image:Asvs_cryptomodule.gif|thumb|350px|right|Cryptomodule Parts and Operation]]&lt;br /&gt;
&lt;br /&gt;
== When to Use a FIPS 140-2 Validated Cryptomodule ==&lt;br /&gt;
&lt;br /&gt;
If the web application may be the target of determined attackers (a common threat model for Internet accessible applications handling sensitive data), it is strongly advised to use TLS services that are provided by [http://csrc.nist.gov/groups/STM/cmvp/validation.html FIPS 140-2 validated cryptomodules]. &lt;br /&gt;
&lt;br /&gt;
A cryptomodule, whether it is a software library or a hardware device, basically consists of three parts:&lt;br /&gt;
&lt;br /&gt;
* Components that implement cryptographic algorithms (symmetric and asymmetric algorithms, hash algorithms, random number generator algorithms, and message authentication code algorithms) &lt;br /&gt;
* Components that call and manage cryptographic functions (inputs and outputs include cryptographic keys and so-called critical security parameters) &lt;br /&gt;
* A physical container around the components that implement cryptographic algorithms and the components that call and manage cryptographic functions&lt;br /&gt;
&lt;br /&gt;
The security of a cryptomodule and its services (and the web applications that call the cryptomodule) depend on the correct implementation and integration of each of these three parts. In addition, the cryptomodule must be used and accessed securely. The includes consideration for:&lt;br /&gt;
&lt;br /&gt;
* Calling and managing cryptographic functions&lt;br /&gt;
* Securely Handling inputs and output&lt;br /&gt;
* Ensuring the secure construction of the physical container around the components&lt;br /&gt;
&lt;br /&gt;
In order to leverage the benefits of TLS it is important to use a TLS service (e.g. library, web framework, web application server) which has been FIPS 140-2 validated. In addition, the cryptomodule must be installed, configured and operated in either an approved or an allowed mode to provide a high degree of certainty that the FIPS 140-2 validated cryptomodule is providing the expected security services in the expected manner.&lt;br /&gt;
&lt;br /&gt;
If the system is legally required to use FIPS 140-2 encryption (e.g., owned or operated by or on behalf of the U.S. Government) then TLS must be used and SSL disabled. Details on why SSL is unacceptable are described in Section 7.1 of [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program].&lt;br /&gt;
&lt;br /&gt;
Further reading on the use of TLS to protect highly sensitive data against determined attackers can be viewed in [http://csrc.nist.gov/publications/nistpubs/800-52/SP800-52.pdf SP800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
&lt;br /&gt;
== Secure Server Design  ==&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use TLS or Other Strong Transport Everywhere  ===&lt;br /&gt;
&lt;br /&gt;
All networks, both external and internal, must utilize TLS or an equivalent transport layer security mechanism for all communication. It is not sufficient to claim that access to the internal network is &amp;quot;restricted to employees&amp;quot;. Numerous recent data compromises have shown that the internal network can be breached by attackers. In these attacks, sniffers have been installed to access unencrypted sensitive data sent on the internal network.&lt;br /&gt;
&lt;br /&gt;
The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the &amp;quot;login landing page&amp;quot;, must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session. &lt;br /&gt;
&lt;br /&gt;
Even marketing or other low-security websites still require TLS. Lack of TLS leads to a lack of integrity which allows attackers to modify content in transit. Also, sites that do not provide TLS are marked lower in pagerank for SEO.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Provide Non-TLS Pages for Secure Content  ===&lt;br /&gt;
&lt;br /&gt;
All pages which are available over TLS must not be available over a non-TLS connection. A user may inadvertently bookmark or manually type a URL to a HTTP page (e.g. http://example.com/myaccount) within the authenticated portion of the application. If this request is processed by the application then the response, and any sensitive data, would be returned to the user over the clear text HTTP.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Mix TLS and Non-TLS Content  ===&lt;br /&gt;
&lt;br /&gt;
A page that is available over TLS must be comprised completely of content which is transmitted over TLS. The page must not contain any content that is transmitted over unencrypted HTTP. This includes content from unrelated third party sites. &lt;br /&gt;
&lt;br /&gt;
An attacker could intercept any of the data transmitted over the unencrypted HTTP and inject malicious content into the user's page. This malicious content would be included in the page even if the overall page is served over TLS. In addition, an attacker could steal the user's session cookie that is transmitted with any non-TLS requests. This is possible if the cookie's 'secure' flag is not set. See the rule 'Use &amp;quot;Secure&amp;quot; Cookie Flag'&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use &amp;quot;Secure&amp;quot; Cookie Flag  ===&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Secure&amp;quot; flag must be set for all user cookies. Failure to use the &amp;quot;secure&amp;quot; flag enables an attacker to access the session cookie by tricking the user's browser into submitting a request to an unencrypted page on the site. This attack is possible even if the server is not configured to offer HTTP content since the attacker is monitoring the requests and does not care if the server responds with a 404 or doesn't respond at all.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Keep Sensitive Data Out of the URL ===&lt;br /&gt;
&lt;br /&gt;
Sensitive data must not be transmitted via URL arguments. A more appropriate place is to store sensitive data in a server side repository or within the user's session.  When using TLS the URL arguments and values are encrypted during transit. However, there are two methods that the URL arguments and values could be exposed.&lt;br /&gt;
&lt;br /&gt;
1. The entire URL is cached within the local user's browser history. This may expose sensitive data to any other user of the workstation.&lt;br /&gt;
&lt;br /&gt;
2. The entire URL is exposed if the user clicks on a link to another HTTPS site. This may expose sensitive data within the referral field to the third party site. This exposure occurs in most browsers and will only occur on transitions between two TLS sites. &lt;br /&gt;
&lt;br /&gt;
For example, a user following a link on [http://owasp.org https://example.com] which leads to [http://owasp.org https://someOtherexample.com] would expose the full URL of [http://owasp.org https://example.com] (including URL arguments) in the referral header (within most browsers). This would not be the case if the user followed a link on [http://owasp.org https://example.com] to [http://owasp.org http://someHTTPexample.com]&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prevent Caching of Sensitive Data ===&lt;br /&gt;
&lt;br /&gt;
The TLS protocol provides confidentiality only for data in transit but it does not help with potential data leakage issues at the client or intermediary proxies. As a result, it is frequently prudent to instruct these nodes not to cache or persist sensitive data. One option is to add anticaching headers to relevant HTTP responses, (for example, &amp;quot;Cache-Control: no-cache, no-store&amp;quot; and &amp;quot;Expires: 0&amp;quot; for coverage of many modern browsers as of 2013). For compatibility with HTTP/1.0 (i.e., when user agents are really old or the webserver works around quirks by forcing HTTP/1.0) the response should also include the header &amp;quot;Pragma: no-cache&amp;quot;. More information is available in [https://tools.ietf.org/html/rfc2616 HTTP 1.1 RFC 2616], section 14.9.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use HTTP Strict Transport Security ===&lt;br /&gt;
&lt;br /&gt;
See: [[HTTP Strict Transport Security]]&lt;br /&gt;
&lt;br /&gt;
===Rule - Use Public Key Pinning===&lt;br /&gt;
&lt;br /&gt;
See: [[Certificate and Public Key Pinning]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;span id=&amp;quot;Server_Certificate_and_Protocol_Configuration&amp;quot;&amp;gt;&amp;lt;/span&amp;gt; &amp;lt;!-- backward compatible anchor --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Server Certificate ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Strong Keys &amp;amp; Protect Them ===&lt;br /&gt;
&lt;br /&gt;
The private key used to generate the cipher key must be sufficiently strong for the anticipated lifetime of the private key and corresponding certificate. The current best practice is to select a key size of at least 2048 bits. Additional information on key lifetimes and comparable key strengths can be found in [http://www.keylength.com/en/compare/], [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57]. In addition, the private key must be stored in a location that is protected from unauthorized access.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use a Certificate That Supports Required Domain Names ===&lt;br /&gt;
&lt;br /&gt;
A user should never be presented with a certificate error, including prompts to reconcile domain or hostname mismatches, or expired certificates. If the application is available at both [https://owasp.org https://www.example.com] and [https://owasp.org https://example.com] then an appropriate certificate, or certificates, must be presented to accommodate the situation. The presence of certificate errors desensitizes users to TLS error messages and increases the possibility an attacker could launch a convincing phishing or man-in-the-middle attack.&lt;br /&gt;
&lt;br /&gt;
For example, consider a web application accessible at [https://owasp.org https://abc.example.com] and [https://owasp.org https://xyz.example.com]. One certificate should be acquired for the host or server ''abc.example.com''; and a second certificate for host or server ''xyz.example.com''. In both cases, the hostname would be present in the Subject's Common Name (CN).&lt;br /&gt;
&lt;br /&gt;
Alternatively, the Subject Alternate Names (SANs) can be used to provide a specific listing of multiple names where the certificate is valid. In the example above, the certificate could list the Subject's CN as ''example.com'', and list two SANs: ''abc.example.com'' and ''xyz.example.com''. These certificates are sometimes referred to as &amp;quot;multiple domain certificates&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Fully Qualified Names in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Use fully qualified names in the DNS name field, and do not use unqualifed names (e.g., 'www'), local names (e.g., 'localhost'), or private IP addresses (e.g., 192.168.1.1) in the DNS name field. Unqualifed names, local names, or private IP addresses violate the certificate specification.&lt;br /&gt;
 &lt;br /&gt;
=== Rule - Do Not Use Wildcard Certificates ===&lt;br /&gt;
&lt;br /&gt;
You should refrain from using wildcard certificates. Though they are expedient at circumventing annoying user prompts, they also [[Least_privilege|violate the principal of least privilege]] and asks the user to trust all machines, including developer's machines, the secretary's machine in the lobby and the sign-in kiosk. Obtaining access to the private key is left as an exercise for the attacker, but its made much easier when stored on the file system unprotected.&lt;br /&gt;
&lt;br /&gt;
Statistics gathered by Qualys for [http://media.blackhat.com/bh-us-10/presentations/Ristic/BlackHat-USA-2010-Ristic-Qualys-SSL-Survey-HTTP-Rating-Guide-slides.pdf Internet SSL Survey 2010] indicate wildcard certificates have a 4.4% share, so the practice is not standard for public facing hosts. Finally, wildcard certificates violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Use RFC 1918 Addresses in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Certificates should not use private addresses. RFC 1918 is [https://tools.ietf.org/html/rfc1918 Address Allocation for Private Internets]. Private addresses are Internet Assigned Numbers Authority (IANA) reserved and include 192.168/16, 172.16/12, and 10/8.&lt;br /&gt;
&lt;br /&gt;
Certificates issued with private addresses violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines]. In addition, Peter Gutmann writes in in [http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf Engineering Security]: &amp;quot;This one is particularly troublesome because, in combination with the router-compromise attacks... and ...OSCP-defeating measures, it allows an attacker to spoof any EV-certificate site.&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use an Appropriate Certification Authority for the Application's User Base  ===&lt;br /&gt;
&lt;br /&gt;
An application user must never be presented with a warning that the certificate was signed by an unknown or untrusted authority. The application's user population must have access to the public certificate of the certification authority which issued the server's certificate. For Internet accessible websites, the most effective method of achieving this goal is to purchase the TLS certificate from a recognize certification authority. Popular Internet browsers already contain the public certificates of these recognized certification authorities. &lt;br /&gt;
&lt;br /&gt;
Internal applications with a limited user population can use an internal certification authority provided its public certificate is securely distributed to all users. However, remember that all certificates issued by this certification authority will be trusted by the users. Therefore, utilize controls to protect the private key and ensure that only authorized individuals have the ability to sign certificates. &lt;br /&gt;
&lt;br /&gt;
The use of self signed certificates is never acceptable. Self signed certificates negate the benefit of end-point authentication and also significantly decrease the ability for an individual to detect a man-in-the-middle attack. &lt;br /&gt;
&lt;br /&gt;
=== Rule - Always Provide All Needed Certificates ===&lt;br /&gt;
&lt;br /&gt;
Clients attempt to solve the problem of identifying a server or host using PKI and X509 certificate. When a user receives a server or host's certificate, the certificate must be validated back to a trusted root certification authority. This is known as path validation.&lt;br /&gt;
&lt;br /&gt;
There can be one or more intermediate certificates in between the end-entity (server or host) certificate and root certificate. In addition to validating both endpoints, the user will also have to validate all intermediate certificates. Validating all intermediate certificates can be tricky because the user may not have them locally. This is a well-known PKI issue called the “Which Directory?&amp;quot; problem.&lt;br /&gt;
&lt;br /&gt;
To avoid the “Which Directory?&amp;quot; problem, a server should provide the user with all required certificates used in a path validation.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Be aware of and have a plan for the SHA-1 deprecation plan  ===&lt;br /&gt;
&lt;br /&gt;
In order to avoid presenting end users with progressive certificate warnings, organizations must proactively address the browser vendor's upcoming SHA-1 deprecation plans. The Google Chrome plan is probably the most specific and aggressive at this point: [http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html Gradually sunsetting SHA-1]&lt;br /&gt;
&lt;br /&gt;
If your organization has no [https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility SHA256 compatibility issues] then it may be appropriate to move your site to a SHA256 signed certificate/chain.  If there are, or may be, issues - you should ensure that your SHA-1 certificates expire before 1/1/2017. &lt;br /&gt;
&lt;br /&gt;
== Server Protocol and Cipher Configuration ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Protocols ===&lt;br /&gt;
&lt;br /&gt;
SSL/TLS is a collection of protocols. Weaknesses have been identified with earlier SSL protocols, including [http://www.schneier.com/paper-ssl-revised.pdf SSLv2] and [http://www.yaksman.org/~lweith/ssl.pdf SSLv3], hence SSL versions 1, 2, and 3 should not longer be used. The best practice for transport layer protection is to only provide support for the TLS protocols - TLS 1.0, TLS 1.1 and TLS 1.2. This configuration will provide maximum protection against skilled and determined attackers and is appropriate for applications handling sensitive data or performing critical operations.&lt;br /&gt;
&lt;br /&gt;
[http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers Nearly all modern browsers support at least TLS 1.0]. As of February 2014, contemporary browsers (Chrome v20+, Firefox v27+, IE v8+, Opera v10+, and Safari v5+) [http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers support TLS 1.1 and TLS 1.2]. You should provide support for TLS 1.1 and TLS 1.2 to accommodate clients that support these protocols. The client and server (usually) negotiate the best protocol that is supported on both sides.&lt;br /&gt;
&lt;br /&gt;
TLS 1.0 is still widely used as the 'best' protocol by a lot of browsers that are not patched to the very latest version. It suffers from [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html CBC Chaining attacks and Padding Oracle attacks]. TLSv1.0 should only be used after risk analysis and acceptance. PCI DSS 3.1 [https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf prohibits] use of TLS 1.0 after June 30, 2016.&lt;br /&gt;
&lt;br /&gt;
Under no circumstances either SSLv2 or SSLv3 should be enabled as a protocol selection:&lt;br /&gt;
* The [http://www.schneier.com/paper-ssl-revised.pdf SSLv2 protocol is broken] and does not provide adequate transport layer protection.&lt;br /&gt;
* [http://www.yaksman.org/~lweith/ssl.pdf SSLv3 had been known for weaknesses] which severely compromise the channel's security long before the [https://www.openssl.org/~bodo/ssl-poodle.pdf 'POODLE'-Bug] finally stopped to tolerate this protocol by October 2014. Switching off SSLv3 terminates the support of legacy browsers like [https://www.ssllabs.com/ssltest/viewClient.html?name=IE&amp;amp;version=6&amp;amp;platform=XP IE6/XP] and elder (in their default configuration).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prefer Ephemeral Key Exchanges ===&lt;br /&gt;
&lt;br /&gt;
Ephemeral key exchanges are based on Diffie-Hellman and use per-session, temporary keys during the initial SSL/TLS handshake. They provide perfect forward secrecy (PFS), which means a compromise of the server's long term signing key does not compromise the confidentiality of past session (see [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]]). When the server uses an ephemeral key, the server will sign the temporary key with its long term key (the long term key is the customary key available in its certificate).&lt;br /&gt;
&lt;br /&gt;
Use cryptographic parameters (like DH-parameter) that use a secure length that match to the supported keylength of your certificate (&amp;gt;=2048 bits or equivalent Elliptic Curves). As some middleware had some issues with this, upgrade to the latest version. &lt;br /&gt;
Note: There are some legacy browsers or old Java versions that are not capable to cope with DH-Params &amp;gt;1024 bits, please read the [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]] how this can be solved.&lt;br /&gt;
&lt;br /&gt;
Do *not* use standardized DH-parameters like they are defined by RFCs 2409, 3526, or 5114. Generate your individual DH-parameters to get unique prime numbers (this may take a long time):&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
openssl dhparam 2048 -out dhparam2048.pem&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
Set the path to use this parameter file, e.g. when using Apache:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
SSLOpenSSLConfCmd DHParameters &amp;lt;path to dhparam2048.pem&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
  &lt;br /&gt;
If you have a server farm and are providing forward secrecy, then you might have to disable session resumption. For example, Apache writes the session id's and master secrets to disk so all servers in the farm can participate in resuming a session (there is currently no in-memory mechanism to achieve the sharing). Writing the session id and master secret to disk undermines forward secrecy.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Cryptographic Ciphers  ===&lt;br /&gt;
&lt;br /&gt;
Each protocol (TLSv1.0, TLSv1.1, TLSv1.2, etc) provides cipher suites. As of TLS 1.2, [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 there is support for over 300 suites (320+ and counting)], including [http://www.mail-archive.com/cryptography@randombit.net/msg03785.html national vanity cipher suites]. The strength of the encryption used within a TLS session is determined by the encryption cipher negotiated between the server and the browser. In order to ensure that only strong cryptographic ciphers are selected the server must be modified to disable the use of weak ciphers and to configure the ciphers in an adequate order. It is recommended to configure the server to only support strong ciphers and to use sufficiently large key sizes. In general, the following should be observed when selecting CipherSuites:&lt;br /&gt;
* Use the very latest recommendations, they may be volantile these days&lt;br /&gt;
* Setup your Policy to get a Whitelist for recommended Ciphers, e.g.:&lt;br /&gt;
** Activate to set the Cipher Order by the Server&lt;br /&gt;
** Highest Priority for Ciphers that support 'Forward Secrecy' (-&amp;gt; Support ephemeral Diffie-Hellman key exchange, see rule above) [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html]&lt;br /&gt;
** Favor DHE over ECDHE (and monitor the CPU usage, see Notes below), ECDHE lacks now of really reliable Elliptic Curves, see discussion about secp{224,256,384,521}r1 and secp256k1, cf. [http://safecurves.cr.yp.to], [https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929]. The solution might be to use [http://www.researchgate.net/profile/Johannes_Merkle/publication/260050106_Standardisierung_der_Brainpool-Kurven_fr_TLS_und_IPSec/file/60b7d52f36a0cc2fdd.pdf Brainpool Curves &amp;lt;nowiki&amp;gt;[German]&amp;lt;/nowiki&amp;gt;], defined for TLS in [https://tools.ietf.org/html/rfc7027 RFC 7027], or [http://eprint.iacr.org/2007/286 Edwards Curves]. The most promising candidates for the latter are [https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06 'Curve25519'] and [http://sourceforge.net/p/ed448goldilocks/wiki/Home/ Ed448-Goldilocks] (see  [https://tools.ietf.org/html/rfc7748 RFC 7748 - Elliptic Curves for Security]), that is not yet defined for TLS, cf. [http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 IANA] and [https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-05 DRAFT-ietf-tls-rfc4492bis] &amp;lt;!--- as at January 2016 ---&amp;gt;&lt;br /&gt;
** Use RSA-Keys (no DSA/DSS: they get very weak, if a bad entropy source is used during signing, cf. [https://projectbullrun.org/dual-ec/tls.html], [https://factorable.net/weakkeys12.conference.pdf]) &amp;lt;!--- as at June 2014 ---&amp;gt;&lt;br /&gt;
** Favor GCM over CBC regardless of the cipher size. In other words, use Authenticated Encryption with Associated Data (AEAD), e.g. AES-GCM, AES-CCM.&lt;br /&gt;
** Watch also for Stream Ciphers which XOR the key stream with plaintext (such as AES/CTR mode) &amp;lt;!--- Jim please check this ---&amp;gt;&lt;br /&gt;
** Priorize the ciphers by the sizes of the Cipher and the MAC&lt;br /&gt;
** Use SHA1 or above for digests, prefer SHA2 (or equivalent)&lt;br /&gt;
** Disable weak ciphers (which is implicitly done by this whitelist) without disabling legacy browsers and bots that have to be supported (find the best compromise), actually the cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) does this job.&lt;br /&gt;
*** Disable cipher suites that do not offer encryption (eNULL, NULL)&lt;br /&gt;
*** Disable cipher suites that do not offer authentication (aNULL). aNULL includes anonymous cipher suites ADH (Anonymous Diffie-Hellman) and AECDH (Anonymous Elliptic Curve Diffie Hellman).&lt;br /&gt;
*** Disable export level ciphers (EXP, eg. ciphers containing DES)&lt;br /&gt;
*** Disable key sizes smaller than 128 bits for encrypting payload traffic (see [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: TR-02102 Part 2 (German)])&lt;br /&gt;
*** Disable the use of MD5 as a hashing mechanism for payload traffic&lt;br /&gt;
*** Disable the use of IDEA Cipher Suites (see [https://tools.ietf.org/html/rfc5469])&lt;br /&gt;
*** Disable RC4 cipher suites (see [https://tools.ietf.org/html/rfc7465], [http://www.isg.rhul.ac.uk/tls/])&lt;br /&gt;
** Ciphers should be usable for DH-Pamameters &amp;gt;= 2048 bits, without blocking legacy browsers (The cipher ‘DHE-RSA-AES128-SHA’ is suppressed as some browsers like to use it but are not capable to cope with DH-Params &amp;gt; 1024 bits; Alternative option: Move 'DHE-RSA-AES128-SHA' and sometimes even 'DHE-RSA-AES256-SHA' behind RSA/AES (e.g. 'RSA-AES128-SHA'), if you are forced to support 'historic' clients with this issue.)&lt;br /&gt;
* Define a Cipher String that works with different Versions of your encryption tool, like openssl&lt;br /&gt;
* Verify your cipher string&lt;br /&gt;
** with an audit-tool, like [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
** listing it manually with your encryption software, e.g. openssl ciphers -v &amp;lt;cipher-string&amp;gt; (the result may differ by version), e.g.:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}} &lt;br /&gt;
openssl ciphers -v &amp;quot;EDH+aRSA+AESGCM:EDH+aRSA+AES:DHE-RSA-AES256-SHA:EECDH+aRSA+AESGCM:EECDH+aRSA+AES:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:RSA+AESGCM:RSA+AES+SHA:DES-CBC3-SHA:-DHE-RSA-AES128-SHA&amp;quot; &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;add optionally ':!aNULL:!eNULL:!LOW:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!ADH:!IDEA' to protect older Versions of OpenSSL&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;you may use openssl ciphers -V &amp;quot;...&amp;quot; for openssl &amp;gt;= 1.0.1:&lt;br /&gt;
&amp;lt;small&amp;gt;&lt;br /&gt;
 0x00,0x9F - DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9E - DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x6B - DHE-RSA-AES256-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA256&lt;br /&gt;
 0x00,0x39 - DHE-RSA-AES256-SHA          SSLv3   Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x67 - DHE-RSA-AES128-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0xC0,0x28 - ECDHE-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA384&lt;br /&gt;
 0xC0,0x14 - ECDHE-RSA-AES256-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0xC0,0x27 - ECDHE-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x13 - ECDHE-RSA-AES128-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x9D - AES256-GCM-SHA384           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9C - AES128-GCM-SHA256           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x35 - AES256-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x2F - AES128-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x0A - DES-CBC3-SHA                SSLv3   Kx=RSA    Au=RSA  Enc=3DES(168)   Mac=SHA1&lt;br /&gt;
&amp;lt;/small&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
&lt;br /&gt;
* Inform yourself how to securely configure the settings for your used services or hardware, e.g. [https://bettercrypto.org BetterCrypto.org: Applied Crypto Hardening (DRAFT)]&lt;br /&gt;
* Check new software and hardware versions for new security settings.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;b&amp;gt;Notes:&amp;lt;/b&amp;gt;&lt;br /&gt;
* According to my researches the most common browsers should be supported with this setting, too (see also [https://www.ssllabs.com/ssltest/index.html SSL Labs: SSL Server Test -&amp;gt; SSL Report -&amp;gt; Handshake Simulation]).&lt;br /&gt;
* Monitor the performance of your server, e.g. the TLS handshake with DHE hinders the CPU abt 2.4 times more than ECDHE, cf. [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html#some-benchmarks Vincent Bernat, 2011], [http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html nmav's Blog, 2011].&lt;br /&gt;
* Use of Ephemeral Diffie-Hellman key exchange will protect confidentiality of the transmitted plaintext data even if the corresponding RSA or DSS server private key got compromised. An attacker would have to perform active man-in-the-middle attack at the time of the key exchange to be able to extract the transmitted plaintext. All modern browsers support this key exchange with the notable exception of Internet Explorer prior to Windows Vista.&lt;br /&gt;
&lt;br /&gt;
Additional information can be obtained within the [https://tools.ietf.org/html/rfc5246 TLS 1.2 RFC 5246], [https://www.ssllabs.com/projects/best-practices/index.html SSL Labs: 'SSL/TLS Deployment Best Practices'], [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: 'TR-02102 Part 2 (German)'], [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report ENISA: 'Algorithms, Key Sizes and Parameters Report'], [https://tools.ietf.org/html/rfc7525 RFC 7525: Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)] and [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf FIPS 140-2 IG].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Support TLS-PSK and TLS-SRP for Mutual Authentication ===&lt;br /&gt;
&lt;br /&gt;
When using a shared secret or password offer TLS-PSK (Pre-Shared Key) or TLS-SRP (Secure Remote Password), which are known as Password Authenticated Key Exchange (PAKEs). TLS-PSK and TLS-SRP properly bind the channel, which refers to the cryptographic binding between the outer tunnel and the inner authentication protocol. IANA currently reserves [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 79 PSK cipehr suites] and [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 9 SRP cipher suites].&lt;br /&gt;
&lt;br /&gt;
Basic authentication places the user's password on the wire in the plain text after a server authenticates itself. Basic authentication only provides unilateral authentication. In contrast, both TLS-PSK and TLS-SRP provide mutual authentication, meaning each party proves it knows the password without placing the password on the wire in the plain text.&lt;br /&gt;
&lt;br /&gt;
Finally, using a PAKE removes the need to trust an outside party, such as a Certification Authority (CA).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Secure Renegotiations  ===&lt;br /&gt;
&lt;br /&gt;
A design weakness in TLS, identified as [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555 CVE-2009-3555], allows an attacker to inject a plaintext of his choice into a TLS session of a victim. In the HTTPS context the attacker might be able to inject his own HTTP requests on behalf of the victim. The issue can be mitigated either by disabling support for TLS renegotiations or by supporting only renegotiations compliant with [https://tools.ietf.org/html/rfc5746 RFC 5746]. All modern browsers have been updated to comply with this RFC.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Disable Compression ===&lt;br /&gt;
&lt;br /&gt;
Compression Ratio Info-leak Made Easy (CRIME) is an exploit against the data compression scheme used by the TLS and SPDY protocols. The exploit allows an adversary to recover user authentication cookies from HTTPS. The recovered cookie can be subsequently used for session hijacking attacks.&lt;br /&gt;
&lt;br /&gt;
== Test your overall TLS/SSL setup and your Certificate ==&lt;br /&gt;
This section shows the most common references only. For more tools and such, please refer to [[#Tools|Tools]].&lt;br /&gt;
&lt;br /&gt;
* [[Testing_for_SSL-TLS_%28OWASP-CM-001%29 | OWASP Testing Guide: Chapter on SSL/TLS Testing]]&lt;br /&gt;
* [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
* other Tools: [[Testing_for_Weak_SSL/TSL_Ciphers,_Insufficient_Transport_Layer_Protection_%28OWASP-EN-002%29#References| Testing for Weak SSL/TSL Ciphers, Insufficient Transport Layer Protection (OWASP-EN-002) (DRAFT)]] - References - Tools&lt;br /&gt;
&lt;br /&gt;
== Client (Browser) Configuration  ==&lt;br /&gt;
&lt;br /&gt;
The validation procedures to ensure that a certificate is valid are complex and difficult to correctly perform.  In a typical web application model, these checks will be performed by the client's web browser in accordance with local browser settings and are out of the control of the application. However, these items do need to be addressed in the following scenarios:&lt;br /&gt;
&lt;br /&gt;
* The application server establishes connections to other applications over TLS for purposes such as web services or any exchange of data&lt;br /&gt;
* A thick client application is connecting to a server via TLS&lt;br /&gt;
&lt;br /&gt;
In these situations extensive certificate validation checks must occur in order to establish the validity of the certificate. Consult the following resources to assist in the design and testing of this functionality. The NIST PKI testing site includes a full test suite of certificates and expected outcomes of the test cases.&lt;br /&gt;
* [http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html NIST PKI Testing]&lt;br /&gt;
* [https://tools.ietf.org/html/rfc5280 IETF RFC 5280]&lt;br /&gt;
&lt;br /&gt;
As specified in the above guidance, if the certificate can not be validated for any reason then the connection between the client and server must be dropped. Any data exchanged over a connection where the certificate has not properly been validated could be exposed to unauthorized access or modification.&lt;br /&gt;
&lt;br /&gt;
== Additional Controls  ==&lt;br /&gt;
&lt;br /&gt;
=== Extended Validation Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Extended validation certificates (EV Certificates) proffer an enhanced investigation by the issuer into the requesting party due to the industry's race to the bottom. The purpose of EV certificates is to provide the user with greater assurance that the owner of the certificate is a verified legal entity for the site. Browsers with support for EV certificates distinguish an EV certificate in a variety of ways. Internet Explorer will color a portion of the URL in green, while Mozilla will add a green portion to the left of the URL indicating the company name. &lt;br /&gt;
&lt;br /&gt;
High value websites should consider the use of EV certificates to enhance customer confidence in the certificate. It should also be noted that EV certificates do not provide any greater technical security for the TLS. The purpose of the EV certificate is to increase user confidence that the target site is indeed who it claims to be.&lt;br /&gt;
&lt;br /&gt;
=== Client-Side Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Client side certificates can be used with TLS to prove the identity of the client to the server. Referred to as &amp;quot;two-way TLS&amp;quot;, this configuration requires the client to provide their certificate to the server, in addition to the server providing their's to the client. If client certificates are used, ensure that the same validation of the client certificate is performed by the server, as indicated for the validation of server certificates above. In addition, the server should be configured to drop the TLS connection if the client certificate cannot be verified or is not provided. &lt;br /&gt;
&lt;br /&gt;
The use of client side certificates is relatively rare currently due to the complexities of certificate generation, safe distribution, client side configuration, certificate revocation and reissuance, and the fact that clients can only authenticate on machines where their client side certificate is installed. Such certificates are typically used for very high value connections that have small user populations.&lt;br /&gt;
&lt;br /&gt;
=== Certificate and Public Key Pinning ===&lt;br /&gt;
&lt;br /&gt;
Hybrid and native applications can take advantage of [[Certificate_and_Public_Key_Pinning|certificate and public key pinning]]. Pinning associates a host (for example, server) with an identity (for example, certificate or public key), and allows an application to leverage knowledge of the pre-existing relationship. At runtime, the application would inspect the certificate or public key received after connecting to the server. If the certificate or public key is expected, then the application would proceed as normal. If unexpected, the application would stop using the channel and close the connection since an adversary could control the channel or server.&lt;br /&gt;
&lt;br /&gt;
Pinning still requires customary X509 checks, such as revocation, since CRLs and OCSP provides real time status information. Otherwise, an application could possibly (1) accept a known bad certificate; or (2) require an out-of-band update, which could result in a lengthy App Store approval.&lt;br /&gt;
&lt;br /&gt;
Browser based applications are at a disadvantage since most browsers do not allow the user to leverage pre-existing relationships and ''a priori'' knowledge. In addition, Javascript and Websockets do not expose methods to for a web app to query the underlying secure connection information (such as the certificate or public key). It is noteworthy that Chromium based browsers perform pinning on selected sites, but the list is currently maintained by the vendor.&lt;br /&gt;
&lt;br /&gt;
For more information, please see the [[Pinning Cheat Sheet]].&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection for Back End and Other Connections  =&lt;br /&gt;
&lt;br /&gt;
Although not the focus of this cheat sheet, it should be stressed that transport layer protection is necessary for back-end connections and any other connection where sensitive data is exchanged or where user identity is established. Failure to implement an effective and robust transport layer security will expose sensitive data and undermine the effectiveness of any authentication or access control mechanism. &lt;br /&gt;
&lt;br /&gt;
== Secure Internal Network Fallacy  ==&lt;br /&gt;
&lt;br /&gt;
The internal network of a corporation is not immune to attacks. Many recent high profile intrusions, where thousands of sensitive customer records were compromised, have been perpetrated by attackers that have gained internal network access and then used sniffers to capture unencrypted data as it traversed the internal network.&lt;br /&gt;
&lt;br /&gt;
== Protocol and Cipher Configuration for Back End and Other Connections ==&lt;br /&gt;
It is important to provide TLS for server-to-server communication in addition to client-to-server communication. Secure the 'client side' configuration of your server that is used for backend and other connections according to [[#Server_Protocol_and_Cipher_Configuration | Server Protocol and Cipher Configuration]]. Be sure to deactivate insecure protocols and ciphers. (e.g. Only support a minimum strong configuration when your server acts as 'client').&lt;br /&gt;
&lt;br /&gt;
= Tools =&lt;br /&gt;
=== local/offline ===&lt;br /&gt;
* [[O-Saft|O-Saft - OWASP SSL advanced forensic tool]]&lt;br /&gt;
* [http://sourceforge.net/projects/sslscan/ SSLScan - Fast SSL Scanner]&lt;br /&gt;
* [https://github.com/iSECPartners/sslyze SSLyze]&lt;br /&gt;
* [http://www.g-sec.lu/sslaudit/sslaudit.zip SSL Audit]&lt;br /&gt;
&lt;br /&gt;
=== Online ===&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
&lt;br /&gt;
* [https://www.htbridge.com/ssl/ High-Tech Bridge online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port]&lt;br /&gt;
&lt;br /&gt;
= Related Articles  =&lt;br /&gt;
&lt;br /&gt;
* Mozilla – [https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations Mozilla Recommended Configurations]&lt;br /&gt;
* OWASP – [[Testing for SSL-TLS (OWASP-CM-001)|Testing for SSL-TLS]], and OWASP [[Guide to Cryptography]] &lt;br /&gt;
* OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]&lt;br /&gt;
* OWASP – ASVS Article on [[Why you need to use a FIPS 140-2 validated cryptomodule]]&lt;br /&gt;
* SSL Labs – [https://www.ssllabs.com/projects/best-practices/index.html SSL/TLS Deployment Best Practices]&lt;br /&gt;
* SSL Labs – [http://www.ssllabs.com/projects/rating-guide/index.html SSL Server Rating Guide]&lt;br /&gt;
* ENISA – [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report Algorithms, Key Sizes and Parameters Report]&lt;br /&gt;
* BSI   – [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI TR-02102 Part 2 (German)]&lt;br /&gt;
* yaSSL – [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html Differences between SSL and TLS Protocol Versions]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/PubsSPs.html#800-52 SP 800-52 Rev. 1 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf FIPS 140-2 Security Requirements for Cryptographic Modules]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57 Recommendation for Key Management, Revision 3], [http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-57-Part%203-Rev.1 Public DRAFT]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/drafts.html#sp800-95 SP 800-95 Guide to Secure Web Services] &lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5280 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc2246 RFC 2246 The Transport Layer Security (TLS) Protocol Version 1.0 (JAN 1999)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc4346 RFC 4346 The Transport Layer Security (TLS) Protocol Version 1.1 (APR 2006)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5246 RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 (AUG 2008)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc7525 RFC 7525 Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)]&lt;br /&gt;
* bettercrypto - [https://bettercrypto.org Applied Crypto Hardening: HOWTO for secure crypto settings of the most common services (DRAFT)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Authors and Primary Editors  =&lt;br /&gt;
&lt;br /&gt;
Torsten Gigler - torsten.gigler[at]owasp.org&amp;lt;br/&amp;gt;&lt;br /&gt;
Michael Coates - michael.coates[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Dave Wichers - dave.wichers[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Tyler Reguly -treguly[at]sslfail.com&lt;br /&gt;
&lt;br /&gt;
== Other Cheatsheets ==&lt;br /&gt;
&lt;br /&gt;
{{Cheatsheet_Navigation_Body}}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Cheatsheets]]&lt;br /&gt;
[[Category:OWASP Best Practices]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218075</id>
		<title>Transport Layer Protection Cheat Sheet</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&amp;diff=218075"/>
				<updated>2016-06-19T12:29:33Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Added note about TLS being there to protect agains man-in-the-middle&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt; __NOTOC__&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:Cheatsheets-header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' &lt;br /&gt;
= Introduction  =&lt;br /&gt;
 __TOC__{{TOC hidden}}&lt;br /&gt;
&lt;br /&gt;
This cheat sheet provides a simple model to follow when implementing transport layer protection for an application. Although the concept of SSL is known to many, the actual details and security specific decisions of implementation are often poorly understood and frequently result in insecure deployments. This article establishes clear rules which provide guidance on securely designing and configuring transport layer security for an application. This article is focused on the use of SSL/TLS between a web application and a web browser, but we also encourage the use of SSL/TLS or other network encryption technologies, such as VPN, on back end and other non-browser based connections.&amp;lt;br&amp;gt; &lt;br /&gt;
&lt;br /&gt;
== Architectural Decision  ==&lt;br /&gt;
&lt;br /&gt;
An architectural decision must be made to determine the appropriate method to protect data when it is being transmitted.  The most common options available to corporations are Virtual Private Networks (VPN) or a SSL/TLS model commonly used by web applications. The selected model is determined by the business needs of the particular organization. For example, a VPN connection may be the best design for a partnership between two companies that includes mutual access to a shared server over a variety of protocols. Conversely, an Internet facing enterprise web application would likely be best served by a SSL/TLS model. &lt;br /&gt;
&lt;br /&gt;
TLS is mainly a defence against man-in-the-middle attacks. An TLS Threat Model is one that starts with the question ''&amp;quot;What is the business impact of an attacker's ability to observe, intercept and manipulate the traffic between the client and the server&amp;quot;''.&lt;br /&gt;
&lt;br /&gt;
This cheat sheet will focus on security considerations when the SSL/TLS model is selected. This is a frequently used model for publicly accessible web applications.&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection with SSL/TLS  =&lt;br /&gt;
&lt;br /&gt;
== Benefits  ==&lt;br /&gt;
&lt;br /&gt;
The primary benefit of transport layer security is the protection of web application data from unauthorized disclosure and modification when it is transmitted between clients (web browsers) and the web application server, and between the web application server and back end and other non-browser based enterprise components. &lt;br /&gt;
&lt;br /&gt;
The server validation component of TLS provides authentication of the server to the client.  If configured to require client side certificates, TLS can also play a role in client authentication to the server. However, in practice client side certificates are not often used in lieu of username and password based authentication models for clients.&lt;br /&gt;
&lt;br /&gt;
TLS also provides two additional benefits that are commonly overlooked; integrity guarantees and replay prevention. A TLS stream of communication contains built-in controls to prevent tampering with any portion of the encrypted data. In addition, controls are also built-in to prevent a captured stream of TLS data from being replayed at a later time.&lt;br /&gt;
&lt;br /&gt;
It should be noted that TLS provides the above guarantees to data during transmission. TLS does not offer any of these security benefits to data that is at rest. Therefore appropriate security controls must be added to protect data while at rest within the application or within data stores.&lt;br /&gt;
&lt;br /&gt;
* Use TLS (as SSL is no longer considered usable for security) where information is to be transmitted over an encrypted channel eg cardholder data, personally identifiable information, any information that is not classified as &amp;quot;public&amp;quot; on your information classification policy&lt;br /&gt;
&lt;br /&gt;
* All points from the login page to the logout page must be served over HTTPS.&lt;br /&gt;
&lt;br /&gt;
* Ensure that the page where a user completes the login form is accessed over HTTPS. This is in addition to POST'ing the form over HTTPS.&lt;br /&gt;
&lt;br /&gt;
* All authenticated pages must be served over HTTPS. This includes css, scripts, images. Failure to do so creates a vector for man in the middle attack and also causes the browser to display a mixed SSL warning message.&lt;br /&gt;
&lt;br /&gt;
* Be careful about the way you switch between HTTP and HTTPs pages as these transitions are a potentail target for attacks&lt;br /&gt;
&lt;br /&gt;
* Applications that are served exclusively over HTTPS should utilize HSTS to instruct compatible browsers to not allow HTTP connections to the domain&lt;br /&gt;
&lt;br /&gt;
== Basic Requirements ==&lt;br /&gt;
&lt;br /&gt;
The basic requirements for using TLS are: access to a Public Key Infrastructure (PKI) in order to obtain certificates, access to a directory or an Online Certificate Status Protocol (OCSP) responder in order to check certificate revocation status, and agreement/ability to support a minimum configuration of protocol versions and protocol options for each version.&lt;br /&gt;
&lt;br /&gt;
== SSL vs. TLS  ==&lt;br /&gt;
&lt;br /&gt;
The terms, Secure Socket Layer (SSL) and Transport Layer Security (TLS) are often used interchangeably. In fact, SSL v3.1 is equivalent to TLS v1.0. However, different versions of SSL and TLS are supported by modern web browsers and by most modern web frameworks and platforms. For the purposes of this cheat sheet we will refer to the technology generically as TLS. Recommendations regarding the use of SSL and TLS protocols, as well as browser support for TLS, can be found in the rule below titled [[Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols| &amp;quot;Only Support Strong Protocols&amp;quot;]].&lt;br /&gt;
&lt;br /&gt;
[[Image:Asvs_cryptomodule.gif|thumb|350px|right|Cryptomodule Parts and Operation]]&lt;br /&gt;
&lt;br /&gt;
== When to Use a FIPS 140-2 Validated Cryptomodule ==&lt;br /&gt;
&lt;br /&gt;
If the web application may be the target of determined attackers (a common threat model for Internet accessible applications handling sensitive data), it is strongly advised to use TLS services that are provided by [http://csrc.nist.gov/groups/STM/cmvp/validation.html FIPS 140-2 validated cryptomodules]. &lt;br /&gt;
&lt;br /&gt;
A cryptomodule, whether it is a software library or a hardware device, basically consists of three parts:&lt;br /&gt;
&lt;br /&gt;
* Components that implement cryptographic algorithms (symmetric and asymmetric algorithms, hash algorithms, random number generator algorithms, and message authentication code algorithms) &lt;br /&gt;
* Components that call and manage cryptographic functions (inputs and outputs include cryptographic keys and so-called critical security parameters) &lt;br /&gt;
* A physical container around the components that implement cryptographic algorithms and the components that call and manage cryptographic functions&lt;br /&gt;
&lt;br /&gt;
The security of a cryptomodule and its services (and the web applications that call the cryptomodule) depend on the correct implementation and integration of each of these three parts. In addition, the cryptomodule must be used and accessed securely. The includes consideration for:&lt;br /&gt;
&lt;br /&gt;
* Calling and managing cryptographic functions&lt;br /&gt;
* Securely Handling inputs and output&lt;br /&gt;
* Ensuring the secure construction of the physical container around the components&lt;br /&gt;
&lt;br /&gt;
In order to leverage the benefits of TLS it is important to use a TLS service (e.g. library, web framework, web application server) which has been FIPS 140-2 validated. In addition, the cryptomodule must be installed, configured and operated in either an approved or an allowed mode to provide a high degree of certainty that the FIPS 140-2 validated cryptomodule is providing the expected security services in the expected manner.&lt;br /&gt;
&lt;br /&gt;
If the system is legally required to use FIPS 140-2 encryption (e.g., owned or operated by or on behalf of the U.S. Government) then TLS must be used and SSL disabled. Details on why SSL is unacceptable are described in Section 7.1 of [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program].&lt;br /&gt;
&lt;br /&gt;
Further reading on the use of TLS to protect highly sensitive data against determined attackers can be viewed in [http://csrc.nist.gov/publications/nistpubs/800-52/SP800-52.pdf SP800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
&lt;br /&gt;
== Secure Server Design  ==&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use TLS or Other Strong Transport Everywhere  ===&lt;br /&gt;
&lt;br /&gt;
All networks, both external and internal, must utilize TLS or an equivalent transport layer security mechanism for all communication. It is not sufficient to claim that access to the internal network is &amp;quot;restricted to employees&amp;quot;. Numerous recent data compromises have shown that the internal network can be breached by attackers. In these attacks, sniffers have been installed to access unencrypted sensitive data sent on the internal network.&lt;br /&gt;
&lt;br /&gt;
The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the &amp;quot;login landing page&amp;quot;, must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session. &lt;br /&gt;
&lt;br /&gt;
Even marketing or other low-security websites still require TLS. Lack of TLS leads to a lack of integrity which allows attackers to modify content in transit. Also, sites that do not provide TLS are marked lower in pagerank for SEO.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Provide Non-TLS Pages for Secure Content  ===&lt;br /&gt;
&lt;br /&gt;
All pages which are available over TLS must not be available over a non-TLS connection. A user may inadvertently bookmark or manually type a URL to a HTTP page (e.g. http://example.com/myaccount) within the authenticated portion of the application. If this request is processed by the application then the response, and any sensitive data, would be returned to the user over the clear text HTTP.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Mix TLS and Non-TLS Content  ===&lt;br /&gt;
&lt;br /&gt;
A page that is available over TLS must be comprised completely of content which is transmitted over TLS. The page must not contain any content that is transmitted over unencrypted HTTP. This includes content from unrelated third party sites. &lt;br /&gt;
&lt;br /&gt;
An attacker could intercept any of the data transmitted over the unencrypted HTTP and inject malicious content into the user's page. This malicious content would be included in the page even if the overall page is served over TLS. In addition, an attacker could steal the user's session cookie that is transmitted with any non-TLS requests. This is possible if the cookie's 'secure' flag is not set. See the rule 'Use &amp;quot;Secure&amp;quot; Cookie Flag'&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use &amp;quot;Secure&amp;quot; Cookie Flag  ===&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Secure&amp;quot; flag must be set for all user cookies. Failure to use the &amp;quot;secure&amp;quot; flag enables an attacker to access the session cookie by tricking the user's browser into submitting a request to an unencrypted page on the site. This attack is possible even if the server is not configured to offer HTTP content since the attacker is monitoring the requests and does not care if the server responds with a 404 or doesn't respond at all.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Keep Sensitive Data Out of the URL ===&lt;br /&gt;
&lt;br /&gt;
Sensitive data must not be transmitted via URL arguments. A more appropriate place is to store sensitive data in a server side repository or within the user's session.  When using TLS the URL arguments and values are encrypted during transit. However, there are two methods that the URL arguments and values could be exposed.&lt;br /&gt;
&lt;br /&gt;
1. The entire URL is cached within the local user's browser history. This may expose sensitive data to any other user of the workstation.&lt;br /&gt;
&lt;br /&gt;
2. The entire URL is exposed if the user clicks on a link to another HTTPS site. This may expose sensitive data within the referral field to the third party site. This exposure occurs in most browsers and will only occur on transitions between two TLS sites. &lt;br /&gt;
&lt;br /&gt;
For example, a user following a link on [http://owasp.org https://example.com] which leads to [http://owasp.org https://someOtherexample.com] would expose the full URL of [http://owasp.org https://example.com] (including URL arguments) in the referral header (within most browsers). This would not be the case if the user followed a link on [http://owasp.org https://example.com] to [http://owasp.org http://someHTTPexample.com]&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prevent Caching of Sensitive Data ===&lt;br /&gt;
&lt;br /&gt;
The TLS protocol provides confidentiality only for data in transit but it does not help with potential data leakage issues at the client or intermediary proxies. As a result, it is frequently prudent to instruct these nodes not to cache or persist sensitive data. One option is to add anticaching headers to relevant HTTP responses, (for example, &amp;quot;Cache-Control: no-cache, no-store&amp;quot; and &amp;quot;Expires: 0&amp;quot; for coverage of many modern browsers as of 2013). For compatibility with HTTP/1.0 (i.e., when user agents are really old or the webserver works around quirks by forcing HTTP/1.0) the response should also include the header &amp;quot;Pragma: no-cache&amp;quot;. More information is available in [https://tools.ietf.org/html/rfc2616 HTTP 1.1 RFC 2616], section 14.9.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use HTTP Strict Transport Security ===&lt;br /&gt;
&lt;br /&gt;
See: [[HTTP Strict Transport Security]]&lt;br /&gt;
&lt;br /&gt;
===Rule - Use Public Key Pinning===&lt;br /&gt;
&lt;br /&gt;
See: [[Certificate and Public Key Pinning]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;span id=&amp;quot;Server_Certificate_and_Protocol_Configuration&amp;quot;&amp;gt;&amp;lt;/span&amp;gt; &amp;lt;!-- backward compatible anchor --&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Server Certificate ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Strong Keys &amp;amp; Protect Them ===&lt;br /&gt;
&lt;br /&gt;
The private key used to generate the cipher key must be sufficiently strong for the anticipated lifetime of the private key and corresponding certificate. The current best practice is to select a key size of at least 2048 bits. Additional information on key lifetimes and comparable key strengths can be found in [http://www.keylength.com/en/compare/], [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57]. In addition, the private key must be stored in a location that is protected from unauthorized access.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use a Certificate That Supports Required Domain Names ===&lt;br /&gt;
&lt;br /&gt;
A user should never be presented with a certificate error, including prompts to reconcile domain or hostname mismatches, or expired certificates. If the application is available at both [https://owasp.org https://www.example.com] and [https://owasp.org https://example.com] then an appropriate certificate, or certificates, must be presented to accommodate the situation. The presence of certificate errors desensitizes users to TLS error messages and increases the possibility an attacker could launch a convincing phishing or man-in-the-middle attack.&lt;br /&gt;
&lt;br /&gt;
For example, consider a web application accessible at [https://owasp.org https://abc.example.com] and [https://owasp.org https://xyz.example.com]. One certificate should be acquired for the host or server ''abc.example.com''; and a second certificate for host or server ''xyz.example.com''. In both cases, the hostname would be present in the Subject's Common Name (CN).&lt;br /&gt;
&lt;br /&gt;
Alternatively, the Subject Alternate Names (SANs) can be used to provide a specific listing of multiple names where the certificate is valid. In the example above, the certificate could list the Subject's CN as ''example.com'', and list two SANs: ''abc.example.com'' and ''xyz.example.com''. These certificates are sometimes referred to as &amp;quot;multiple domain certificates&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use Fully Qualified Names in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Use fully qualified names in the DNS name field, and do not use unqualifed names (e.g., 'www'), local names (e.g., 'localhost'), or private IP addresses (e.g., 192.168.1.1) in the DNS name field. Unqualifed names, local names, or private IP addresses violate the certificate specification.&lt;br /&gt;
 &lt;br /&gt;
=== Rule - Do Not Use Wildcard Certificates ===&lt;br /&gt;
&lt;br /&gt;
You should refrain from using wildcard certificates. Though they are expedient at circumventing annoying user prompts, they also [[Least_privilege|violate the principal of least privilege]] and asks the user to trust all machines, including developer's machines, the secretary's machine in the lobby and the sign-in kiosk. Obtaining access to the private key is left as an exercise for the attacker, but its made much easier when stored on the file system unprotected.&lt;br /&gt;
&lt;br /&gt;
Statistics gathered by Qualys for [http://media.blackhat.com/bh-us-10/presentations/Ristic/BlackHat-USA-2010-Ristic-Qualys-SSL-Survey-HTTP-Rating-Guide-slides.pdf Internet SSL Survey 2010] indicate wildcard certificates have a 4.4% share, so the practice is not standard for public facing hosts. Finally, wildcard certificates violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Do Not Use RFC 1918 Addresses in Certificates ===&lt;br /&gt;
&lt;br /&gt;
Certificates should not use private addresses. RFC 1918 is [https://tools.ietf.org/html/rfc1918 Address Allocation for Private Internets]. Private addresses are Internet Assigned Numbers Authority (IANA) reserved and include 192.168/16, 172.16/12, and 10/8.&lt;br /&gt;
&lt;br /&gt;
Certificates issued with private addresses violate [https://www.cabforum.org/EV_Certificate_Guidelines.pdf EV Certificate Guidelines]. In addition, Peter Gutmann writes in in [http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf Engineering Security]: &amp;quot;This one is particularly troublesome because, in combination with the router-compromise attacks... and ...OSCP-defeating measures, it allows an attacker to spoof any EV-certificate site.&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=== Rule - Use an Appropriate Certification Authority for the Application's User Base  ===&lt;br /&gt;
&lt;br /&gt;
An application user must never be presented with a warning that the certificate was signed by an unknown or untrusted authority. The application's user population must have access to the public certificate of the certification authority which issued the server's certificate. For Internet accessible websites, the most effective method of achieving this goal is to purchase the TLS certificate from a recognize certification authority. Popular Internet browsers already contain the public certificates of these recognized certification authorities. &lt;br /&gt;
&lt;br /&gt;
Internal applications with a limited user population can use an internal certification authority provided its public certificate is securely distributed to all users. However, remember that all certificates issued by this certification authority will be trusted by the users. Therefore, utilize controls to protect the private key and ensure that only authorized individuals have the ability to sign certificates. &lt;br /&gt;
&lt;br /&gt;
The use of self signed certificates is never acceptable. Self signed certificates negate the benefit of end-point authentication and also significantly decrease the ability for an individual to detect a man-in-the-middle attack. &lt;br /&gt;
&lt;br /&gt;
=== Rule - Always Provide All Needed Certificates ===&lt;br /&gt;
&lt;br /&gt;
Clients attempt to solve the problem of identifying a server or host using PKI and X509 certificate. When a user receives a server or host's certificate, the certificate must be validated back to a trusted root certification authority. This is known as path validation.&lt;br /&gt;
&lt;br /&gt;
There can be one or more intermediate certificates in between the end-entity (server or host) certificate and root certificate. In addition to validating both endpoints, the user will also have to validate all intermediate certificates. Validating all intermediate certificates can be tricky because the user may not have them locally. This is a well-known PKI issue called the “Which Directory?&amp;quot; problem.&lt;br /&gt;
&lt;br /&gt;
To avoid the “Which Directory?&amp;quot; problem, a server should provide the user with all required certificates used in a path validation.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Be aware of and have a plan for the SHA-1 deprecation plan  ===&lt;br /&gt;
&lt;br /&gt;
In order to avoid presenting end users with progressive certificate warnings, organizations must proactively address the browser vendor's upcoming SHA-1 deprecation plans. The Google Chrome plan is probably the most specific and aggressive at this point: [http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html Gradually sunsetting SHA-1]&lt;br /&gt;
&lt;br /&gt;
If your organization has no [https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility SHA256 compatibility issues] then it may be appropriate to move your site to a SHA256 signed certificate/chain.  If there are, or may be, issues - you should ensure that your SHA-1 certificates expire before 1/1/2017. &lt;br /&gt;
&lt;br /&gt;
== Server Protocol and Cipher Configuration ==&lt;br /&gt;
Note: If using a FIPS 140-2 cryptomodule disregard the following rules and defer to the recommended configuration for the particular cryptomodule. Nevertheless we recommend to use this rules to audit your configuration.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Protocols ===&lt;br /&gt;
&lt;br /&gt;
SSL/TLS is a collection of protocols. Weaknesses have been identified with earlier SSL protocols, including [http://www.schneier.com/paper-ssl-revised.pdf SSLv2] and [http://www.yaksman.org/~lweith/ssl.pdf SSLv3], hence SSL versions 1, 2, and 3 should not longer be used. The best practice for transport layer protection is to only provide support for the TLS protocols - TLS 1.0, TLS 1.1 and TLS 1.2. This configuration will provide maximum protection against skilled and determined attackers and is appropriate for applications handling sensitive data or performing critical operations.&lt;br /&gt;
&lt;br /&gt;
[http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers Nearly all modern browsers support at least TLS 1.0]. As of February 2014, contemporary browsers (Chrome v20+, Firefox v27+, IE v8+, Opera v10+, and Safari v5+) [http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers support TLS 1.1 and TLS 1.2]. You should provide support for TLS 1.1 and TLS 1.2 to accommodate clients that support these protocols. The client and server (usually) negotiate the best protocol that is supported on both sides.&lt;br /&gt;
&lt;br /&gt;
TLS 1.0 is still widely used as the 'best' protocol by a lot of browsers that are not patched to the very latest version. It suffers from [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html CBC Chaining attacks and Padding Oracle attacks]. TLSv1.0 should only be used after risk analysis and acceptance. PCI DSS 3.1 [https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf prohibits] use of TLS 1.0 after June 30, 2016.&lt;br /&gt;
&lt;br /&gt;
Under no circumstances either SSLv2 or SSLv3 should be enabled as a protocol selection:&lt;br /&gt;
* The [http://www.schneier.com/paper-ssl-revised.pdf SSLv2 protocol is broken] and does not provide adequate transport layer protection.&lt;br /&gt;
* [http://www.yaksman.org/~lweith/ssl.pdf SSLv3 had been known for weaknesses] which severely compromise the channel's security long before the [https://www.openssl.org/~bodo/ssl-poodle.pdf 'POODLE'-Bug] finally stopped to tolerate this protocol by October 2014. Switching off SSLv3 terminates the support of legacy browsers like [https://www.ssllabs.com/ssltest/viewClient.html?name=IE&amp;amp;version=6&amp;amp;platform=XP IE6/XP] and elder (in their default configuration).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Prefer Ephemeral Key Exchanges ===&lt;br /&gt;
&lt;br /&gt;
Ephemeral key exchanges are based on Diffie-Hellman and use per-session, temporary keys during the initial SSL/TLS handshake. They provide perfect forward secrecy (PFS), which means a compromise of the server's long term signing key does not compromise the confidentiality of past session (see [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]]). When the server uses an ephemeral key, the server will sign the temporary key with its long term key (the long term key is the customary key available in its certificate).&lt;br /&gt;
&lt;br /&gt;
Use cryptographic parameters (like DH-parameter) that use a secure length that match to the supported keylength of your certificate (&amp;gt;=2048 bits or equivalent Elliptic Curves). As some middleware had some issues with this, upgrade to the latest version. &lt;br /&gt;
Note: There are some legacy browsers or old Java versions that are not capable to cope with DH-Params &amp;gt;1024 bits, please read the [[#Rule_-_Only_Support_Strong_Cryptographic_Ciphers | following rule]] how this can be solved.&lt;br /&gt;
&lt;br /&gt;
Do *not* use standardized DH-parameters like they are defined by RFCs 2409, 3526, or 5114. Generate your individual DH-parameters to get unique prime numbers (this may take a long time):&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
openssl dhparam 2048 -out dhparam2048.pem&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
Set the path to use this parameter file, e.g. when using Apache:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}}&lt;br /&gt;
SSLOpenSSLConfCmd DHParameters &amp;lt;path to dhparam2048.pem&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
  &lt;br /&gt;
If you have a server farm and are providing forward secrecy, then you might have to disable session resumption. For example, Apache writes the session id's and master secrets to disk so all servers in the farm can participate in resuming a session (there is currently no in-memory mechanism to achieve the sharing). Writing the session id and master secret to disk undermines forward secrecy.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Strong Cryptographic Ciphers  ===&lt;br /&gt;
&lt;br /&gt;
Each protocol (TLSv1.0, TLSv1.1, TLSv1.2, etc) provides cipher suites. As of TLS 1.2, [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 there is support for over 300 suites (320+ and counting)], including [http://www.mail-archive.com/cryptography@randombit.net/msg03785.html national vanity cipher suites]. The strength of the encryption used within a TLS session is determined by the encryption cipher negotiated between the server and the browser. In order to ensure that only strong cryptographic ciphers are selected the server must be modified to disable the use of weak ciphers and to configure the ciphers in an adequate order. It is recommended to configure the server to only support strong ciphers and to use sufficiently large key sizes. In general, the following should be observed when selecting CipherSuites:&lt;br /&gt;
* Use the very latest recommendations, they may be volantile these days&lt;br /&gt;
* Setup your Policy to get a Whitelist for recommended Ciphers, e.g.:&lt;br /&gt;
** Activate to set the Cipher Order by the Server&lt;br /&gt;
** Highest Priority for Ciphers that support 'Forward Secrecy' (-&amp;gt; Support ephemeral Diffie-Hellman key exchange, see rule above) [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html]&lt;br /&gt;
** Favor DHE over ECDHE (and monitor the CPU usage, see Notes below), ECDHE lacks now of really reliable Elliptic Curves, see discussion about secp{224,256,384,521}r1 and secp256k1, cf. [http://safecurves.cr.yp.to], [https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929]. The solution might be to use [http://www.researchgate.net/profile/Johannes_Merkle/publication/260050106_Standardisierung_der_Brainpool-Kurven_fr_TLS_und_IPSec/file/60b7d52f36a0cc2fdd.pdf Brainpool Curves &amp;lt;nowiki&amp;gt;[German]&amp;lt;/nowiki&amp;gt;], defined for TLS in [https://tools.ietf.org/html/rfc7027 RFC 7027], or [http://eprint.iacr.org/2007/286 Edwards Curves]. The most promising candidates for the latter are [https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06 'Curve25519'] and [http://sourceforge.net/p/ed448goldilocks/wiki/Home/ Ed448-Goldilocks] (see  [https://tools.ietf.org/html/rfc7748 RFC 7748 - Elliptic Curves for Security]), that is not yet defined for TLS, cf. [http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 IANA] and [https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-05 DRAFT-ietf-tls-rfc4492bis] &amp;lt;!--- as at January 2016 ---&amp;gt;&lt;br /&gt;
** Use RSA-Keys (no DSA/DSS: they get very weak, if a bad entropy source is used during signing, cf. [https://projectbullrun.org/dual-ec/tls.html], [https://factorable.net/weakkeys12.conference.pdf]) &amp;lt;!--- as at June 2014 ---&amp;gt;&lt;br /&gt;
** Favor GCM over CBC regardless of the cipher size. In other words, use Authenticated Encryption with Associated Data (AEAD), e.g. AES-GCM, AES-CCM.&lt;br /&gt;
** Watch also for Stream Ciphers which XOR the key stream with plaintext (such as AES/CTR mode) &amp;lt;!--- Jim please check this ---&amp;gt;&lt;br /&gt;
** Priorize the ciphers by the sizes of the Cipher and the MAC&lt;br /&gt;
** Use SHA1 or above for digests, prefer SHA2 (or equivalent)&lt;br /&gt;
** Disable weak ciphers (which is implicitly done by this whitelist) without disabling legacy browsers and bots that have to be supported (find the best compromise), actually the cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) does this job.&lt;br /&gt;
*** Disable cipher suites that do not offer encryption (eNULL, NULL)&lt;br /&gt;
*** Disable cipher suites that do not offer authentication (aNULL). aNULL includes anonymous cipher suites ADH (Anonymous Diffie-Hellman) and AECDH (Anonymous Elliptic Curve Diffie Hellman).&lt;br /&gt;
*** Disable export level ciphers (EXP, eg. ciphers containing DES)&lt;br /&gt;
*** Disable key sizes smaller than 128 bits for encrypting payload traffic (see [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: TR-02102 Part 2 (German)])&lt;br /&gt;
*** Disable the use of MD5 as a hashing mechanism for payload traffic&lt;br /&gt;
*** Disable the use of IDEA Cipher Suites (see [https://tools.ietf.org/html/rfc5469])&lt;br /&gt;
*** Disable RC4 cipher suites (see [https://tools.ietf.org/html/rfc7465], [http://www.isg.rhul.ac.uk/tls/])&lt;br /&gt;
** Ciphers should be usable for DH-Pamameters &amp;gt;= 2048 bits, without blocking legacy browsers (The cipher ‘DHE-RSA-AES128-SHA’ is suppressed as some browsers like to use it but are not capable to cope with DH-Params &amp;gt; 1024 bits; Alternative option: Move 'DHE-RSA-AES128-SHA' and sometimes even 'DHE-RSA-AES256-SHA' behind RSA/AES (e.g. 'RSA-AES128-SHA'), if you are forced to support 'historic' clients with this issue.)&lt;br /&gt;
* Define a Cipher String that works with different Versions of your encryption tool, like openssl&lt;br /&gt;
* Verify your cipher string&lt;br /&gt;
** with an audit-tool, like [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
** listing it manually with your encryption software, e.g. openssl ciphers -v &amp;lt;cipher-string&amp;gt; (the result may differ by version), e.g.:&lt;br /&gt;
{{Top_10_2010:ExampleBeginTemplate|year=2013}} &lt;br /&gt;
openssl ciphers -v &amp;quot;EDH+aRSA+AESGCM:EDH+aRSA+AES:DHE-RSA-AES256-SHA:EECDH+aRSA+AESGCM:EECDH+aRSA+AES:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:RSA+AESGCM:RSA+AES+SHA:DES-CBC3-SHA:-DHE-RSA-AES128-SHA&amp;quot; &amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;add optionally ':!aNULL:!eNULL:!LOW:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!ADH:!IDEA' to protect older Versions of OpenSSL&amp;lt;br&amp;gt;&lt;br /&gt;
&amp;lt;nowiki&amp;gt;#&amp;lt;/nowiki&amp;gt;you may use openssl ciphers -V &amp;quot;...&amp;quot; for openssl &amp;gt;= 1.0.1:&lt;br /&gt;
&amp;lt;small&amp;gt;&lt;br /&gt;
 0x00,0x9F - DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9E - DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x6B - DHE-RSA-AES256-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA256&lt;br /&gt;
 0x00,0x39 - DHE-RSA-AES256-SHA          SSLv3   Kx=DH     Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x67 - DHE-RSA-AES128-SHA256       TLSv1.2 Kx=DH     Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH   Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0xC0,0x28 - ECDHE-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA384&lt;br /&gt;
 0xC0,0x14 - ECDHE-RSA-AES256-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0xC0,0x27 - ECDHE-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA256&lt;br /&gt;
 0xC0,0x13 - ECDHE-RSA-AES128-SHA        SSLv3   Kx=ECDH   Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x9D - AES256-GCM-SHA384           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(256) Mac=AEAD&lt;br /&gt;
 0x00,0x9C - AES128-GCM-SHA256           TLSv1.2 Kx=RSA    Au=RSA  Enc=AESGCM(128) Mac=AEAD&lt;br /&gt;
 0x00,0x35 - AES256-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(256)    Mac=SHA1&lt;br /&gt;
 0x00,0x2F - AES128-SHA                  SSLv3   Kx=RSA    Au=RSA  Enc=AES(128)    Mac=SHA1&lt;br /&gt;
 0x00,0x0A - DES-CBC3-SHA                SSLv3   Kx=RSA    Au=RSA  Enc=3DES(168)   Mac=SHA1&lt;br /&gt;
&amp;lt;/small&amp;gt;&lt;br /&gt;
{{Top_10_2010:ExampleEndTemplate}}&lt;br /&gt;
&lt;br /&gt;
* Inform yourself how to securely configure the settings for your used services or hardware, e.g. [https://bettercrypto.org BetterCrypto.org: Applied Crypto Hardening (DRAFT)]&lt;br /&gt;
* Check new software and hardware versions for new security settings.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;b&amp;gt;Notes:&amp;lt;/b&amp;gt;&lt;br /&gt;
* According to my researches the most common browsers should be supported with this setting, too (see also [https://www.ssllabs.com/ssltest/index.html SSL Labs: SSL Server Test -&amp;gt; SSL Report -&amp;gt; Handshake Simulation]).&lt;br /&gt;
* Monitor the performance of your server, e.g. the TLS handshake with DHE hinders the CPU abt 2.4 times more than ECDHE, cf. [http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html#some-benchmarks Vincent Bernat, 2011], [http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html nmav's Blog, 2011].&lt;br /&gt;
* Use of Ephemeral Diffie-Hellman key exchange will protect confidentiality of the transmitted plaintext data even if the corresponding RSA or DSS server private key got compromised. An attacker would have to perform active man-in-the-middle attack at the time of the key exchange to be able to extract the transmitted plaintext. All modern browsers support this key exchange with the notable exception of Internet Explorer prior to Windows Vista.&lt;br /&gt;
&lt;br /&gt;
Additional information can be obtained within the [https://tools.ietf.org/html/rfc5246 TLS 1.2 RFC 5246], [https://www.ssllabs.com/projects/best-practices/index.html SSL Labs: 'SSL/TLS Deployment Best Practices'], [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI: 'TR-02102 Part 2 (German)'], [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report ENISA: 'Algorithms, Key Sizes and Parameters Report'], [https://tools.ietf.org/html/rfc7525 RFC 7525: Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)] and [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf FIPS 140-2 IG].&lt;br /&gt;
&lt;br /&gt;
=== Rule - Support TLS-PSK and TLS-SRP for Mutual Authentication ===&lt;br /&gt;
&lt;br /&gt;
When using a shared secret or password offer TLS-PSK (Pre-Shared Key) or TLS-SRP (Secure Remote Password), which are known as Password Authenticated Key Exchange (PAKEs). TLS-PSK and TLS-SRP properly bind the channel, which refers to the cryptographic binding between the outer tunnel and the inner authentication protocol. IANA currently reserves [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 79 PSK cipehr suites] and [http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-3 9 SRP cipher suites].&lt;br /&gt;
&lt;br /&gt;
Basic authentication places the user's password on the wire in the plain text after a server authenticates itself. Basic authentication only provides unilateral authentication. In contrast, both TLS-PSK and TLS-SRP provide mutual authentication, meaning each party proves it knows the password without placing the password on the wire in the plain text.&lt;br /&gt;
&lt;br /&gt;
Finally, using a PAKE removes the need to trust an outside party, such as a Certification Authority (CA).&lt;br /&gt;
&lt;br /&gt;
=== Rule - Only Support Secure Renegotiations  ===&lt;br /&gt;
&lt;br /&gt;
A design weakness in TLS, identified as [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555 CVE-2009-3555], allows an attacker to inject a plaintext of his choice into a TLS session of a victim. In the HTTPS context the attacker might be able to inject his own HTTP requests on behalf of the victim. The issue can be mitigated either by disabling support for TLS renegotiations or by supporting only renegotiations compliant with [https://tools.ietf.org/html/rfc5746 RFC 5746]. All modern browsers have been updated to comply with this RFC.&lt;br /&gt;
&lt;br /&gt;
=== Rule - Disable Compression ===&lt;br /&gt;
&lt;br /&gt;
Compression Ratio Info-leak Made Easy (CRIME) is an exploit against the data compression scheme used by the TLS and SPDY protocols. The exploit allows an adversary to recover user authentication cookies from HTTPS. The recovered cookie can be subsequently used for session hijacking attacks.&lt;br /&gt;
&lt;br /&gt;
== Test your overall TLS/SSL setup and your Certificate ==&lt;br /&gt;
This section shows the most common references only. For more tools and such, please refer to [[#Tools|Tools]].&lt;br /&gt;
&lt;br /&gt;
* [[Testing_for_SSL-TLS_%28OWASP-CM-001%29 | OWASP Testing Guide: Chapter on SSL/TLS Testing]]&lt;br /&gt;
* [[O-Saft|OWASP 'O-Saft' (OWASP SSL audit for testers / OWASP SSL advanced forensic tool)]]&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
* other Tools: [[Testing_for_Weak_SSL/TSL_Ciphers,_Insufficient_Transport_Layer_Protection_%28OWASP-EN-002%29#References| Testing for Weak SSL/TSL Ciphers, Insufficient Transport Layer Protection (OWASP-EN-002) (DRAFT)]] - References - Tools&lt;br /&gt;
&lt;br /&gt;
== Client (Browser) Configuration  ==&lt;br /&gt;
&lt;br /&gt;
The validation procedures to ensure that a certificate is valid are complex and difficult to correctly perform.  In a typical web application model, these checks will be performed by the client's web browser in accordance with local browser settings and are out of the control of the application. However, these items do need to be addressed in the following scenarios:&lt;br /&gt;
&lt;br /&gt;
* The application server establishes connections to other applications over TLS for purposes such as web services or any exchange of data&lt;br /&gt;
* A thick client application is connecting to a server via TLS&lt;br /&gt;
&lt;br /&gt;
In these situations extensive certificate validation checks must occur in order to establish the validity of the certificate. Consult the following resources to assist in the design and testing of this functionality. The NIST PKI testing site includes a full test suite of certificates and expected outcomes of the test cases.&lt;br /&gt;
* [http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html NIST PKI Testing]&lt;br /&gt;
* [https://tools.ietf.org/html/rfc5280 IETF RFC 5280]&lt;br /&gt;
&lt;br /&gt;
As specified in the above guidance, if the certificate can not be validated for any reason then the connection between the client and server must be dropped. Any data exchanged over a connection where the certificate has not properly been validated could be exposed to unauthorized access or modification.&lt;br /&gt;
&lt;br /&gt;
== Additional Controls  ==&lt;br /&gt;
&lt;br /&gt;
=== Extended Validation Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Extended validation certificates (EV Certificates) proffer an enhanced investigation by the issuer into the requesting party due to the industry's race to the bottom. The purpose of EV certificates is to provide the user with greater assurance that the owner of the certificate is a verified legal entity for the site. Browsers with support for EV certificates distinguish an EV certificate in a variety of ways. Internet Explorer will color a portion of the URL in green, while Mozilla will add a green portion to the left of the URL indicating the company name. &lt;br /&gt;
&lt;br /&gt;
High value websites should consider the use of EV certificates to enhance customer confidence in the certificate. It should also be noted that EV certificates do not provide any greater technical security for the TLS. The purpose of the EV certificate is to increase user confidence that the target site is indeed who it claims to be.&lt;br /&gt;
&lt;br /&gt;
=== Client-Side Certificates  ===&lt;br /&gt;
&lt;br /&gt;
Client side certificates can be used with TLS to prove the identity of the client to the server. Referred to as &amp;quot;two-way TLS&amp;quot;, this configuration requires the client to provide their certificate to the server, in addition to the server providing their's to the client. If client certificates are used, ensure that the same validation of the client certificate is performed by the server, as indicated for the validation of server certificates above. In addition, the server should be configured to drop the TLS connection if the client certificate cannot be verified or is not provided. &lt;br /&gt;
&lt;br /&gt;
The use of client side certificates is relatively rare currently due to the complexities of certificate generation, safe distribution, client side configuration, certificate revocation and reissuance, and the fact that clients can only authenticate on machines where their client side certificate is installed. Such certificates are typically used for very high value connections that have small user populations.&lt;br /&gt;
&lt;br /&gt;
=== Certificate and Public Key Pinning ===&lt;br /&gt;
&lt;br /&gt;
Hybrid and native applications can take advantage of [[Certificate_and_Public_Key_Pinning|certificate and public key pinning]]. Pinning associates a host (for example, server) with an identity (for example, certificate or public key), and allows an application to leverage knowledge of the pre-existing relationship. At runtime, the application would inspect the certificate or public key received after connecting to the server. If the certificate or public key is expected, then the application would proceed as normal. If unexpected, the application would stop using the channel and close the connection since an adversary could control the channel or server.&lt;br /&gt;
&lt;br /&gt;
Pinning still requires customary X509 checks, such as revocation, since CRLs and OCSP provides real time status information. Otherwise, an application could possibly (1) accept a known bad certificate; or (2) require an out-of-band update, which could result in a lengthy App Store approval.&lt;br /&gt;
&lt;br /&gt;
Browser based applications are at a disadvantage since most browsers do not allow the user to leverage pre-existing relationships and ''a priori'' knowledge. In addition, Javascript and Websockets do not expose methods to for a web app to query the underlying secure connection information (such as the certificate or public key). It is noteworthy that Chromium based browsers perform pinning on selected sites, but the list is currently maintained by the vendor.&lt;br /&gt;
&lt;br /&gt;
For more information, please see the [[Pinning Cheat Sheet]].&lt;br /&gt;
&lt;br /&gt;
= Providing Transport Layer Protection for Back End and Other Connections  =&lt;br /&gt;
&lt;br /&gt;
Although not the focus of this cheat sheet, it should be stressed that transport layer protection is necessary for back-end connections and any other connection where sensitive data is exchanged or where user identity is established. Failure to implement an effective and robust transport layer security will expose sensitive data and undermine the effectiveness of any authentication or access control mechanism. &lt;br /&gt;
&lt;br /&gt;
== Secure Internal Network Fallacy  ==&lt;br /&gt;
&lt;br /&gt;
The internal network of a corporation is not immune to attacks. Many recent high profile intrusions, where thousands of sensitive customer records were compromised, have been perpetrated by attackers that have gained internal network access and then used sniffers to capture unencrypted data as it traversed the internal network.&lt;br /&gt;
&lt;br /&gt;
== Protocol and Cipher Configuration for Back End and Other Connections ==&lt;br /&gt;
It is important to provide TLS for server-to-server communication in addition to client-to-server communication. Secure the 'client side' configuration of your server that is used for backend and other connections according to [[#Server_Protocol_and_Cipher_Configuration | Server Protocol and Cipher Configuration]]. Be sure to deactivate insecure protocols and ciphers. (e.g. Only support a minimum strong configuration when your server acts as 'client').&lt;br /&gt;
&lt;br /&gt;
= Tools =&lt;br /&gt;
=== local/offline ===&lt;br /&gt;
* [[O-Saft|O-Saft - OWASP SSL advanced forensic tool]]&lt;br /&gt;
* [http://sourceforge.net/projects/sslscan/ SSLScan - Fast SSL Scanner]&lt;br /&gt;
* [https://github.com/iSECPartners/sslyze SSLyze]&lt;br /&gt;
* [http://www.g-sec.lu/sslaudit/sslaudit.zip SSL Audit]&lt;br /&gt;
&lt;br /&gt;
=== Online ===&lt;br /&gt;
* [https://www.ssllabs.com/ssltest SSL LABS Server Test]&lt;br /&gt;
&lt;br /&gt;
* [https://www.htbridge.com/ssl/ High-Tech Bridge online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port]&lt;br /&gt;
&lt;br /&gt;
= Related Articles  =&lt;br /&gt;
&lt;br /&gt;
* Mozilla – [https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations Mozilla Recommended Configurations]&lt;br /&gt;
* OWASP – [[Testing for SSL-TLS (OWASP-CM-001)|Testing for SSL-TLS]], and OWASP [[Guide to Cryptography]] &lt;br /&gt;
* OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]&lt;br /&gt;
* OWASP – ASVS Article on [[Why you need to use a FIPS 140-2 validated cryptomodule]]&lt;br /&gt;
* SSL Labs – [https://www.ssllabs.com/projects/best-practices/index.html SSL/TLS Deployment Best Practices]&lt;br /&gt;
* SSL Labs – [http://www.ssllabs.com/projects/rating-guide/index.html SSL Server Rating Guide]&lt;br /&gt;
* ENISA – [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report Algorithms, Key Sizes and Parameters Report]&lt;br /&gt;
* BSI   – [https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf BSI TR-02102 Part 2 (German)]&lt;br /&gt;
* yaSSL – [http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html Differences between SSL and TLS Protocol Versions]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/PubsSPs.html#800-52 SP 800-52 Rev. 1 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf FIPS 140-2 Security Requirements for Cryptographic Modules]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf NIST SP 800-57 Recommendation for Key Management, Revision 3], [http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-57-Part%203-Rev.1 Public DRAFT]&lt;br /&gt;
* NIST – [http://csrc.nist.gov/publications/drafts.html#sp800-95 SP 800-95 Guide to Secure Web Services] &lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5280 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc2246 RFC 2246 The Transport Layer Security (TLS) Protocol Version 1.0 (JAN 1999)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc4346 RFC 4346 The Transport Layer Security (TLS) Protocol Version 1.1 (APR 2006)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc5246 RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 (AUG 2008)]&lt;br /&gt;
* IETF – [https://tools.ietf.org/html/rfc7525 RFC 7525 Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)]&lt;br /&gt;
* bettercrypto - [https://bettercrypto.org Applied Crypto Hardening: HOWTO for secure crypto settings of the most common services (DRAFT)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Authors and Primary Editors  =&lt;br /&gt;
&lt;br /&gt;
Torsten Gigler - torsten.gigler[at]owasp.org&amp;lt;br/&amp;gt;&lt;br /&gt;
Michael Coates - michael.coates[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Dave Wichers - dave.wichers[at]owasp.org &amp;lt;br/&amp;gt;&lt;br /&gt;
Tyler Reguly -treguly[at]sslfail.com&lt;br /&gt;
&lt;br /&gt;
== Other Cheatsheets ==&lt;br /&gt;
&lt;br /&gt;
{{Cheatsheet_Navigation_Body}}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Cheatsheets]]&lt;br /&gt;
[[Category:OWASP Best Practices]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=217983</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=217983"/>
				<updated>2016-06-16T09:01:38Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''May 2016 - v6.0''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2+Platform+Installer+v6.0.msi O2 Platform installer v6.0] - this is a windows msi installer which requires admin privs&lt;br /&gt;
&lt;br /&gt;
'''April 2013 - v5.5''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Downloads=&lt;br /&gt;
&lt;br /&gt;
'''May 2016 - v6.0''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2+Platform+Installer+v6.0.msi O2 Platform installer v6.0] - this is a windows msi installer which requires admin privs&lt;br /&gt;
&lt;br /&gt;
'''April 2013 - v5.5''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
All download files are hosted at BinTray: https://bintray.com/o2-platform&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- hiding the ones below since they need work done&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216901</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216901"/>
				<updated>2016-05-15T16:28:16Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Main */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.5''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Downloads=&lt;br /&gt;
&lt;br /&gt;
'''Latest Release: April 2013 - v5.5''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
All download files are hosted at BinTray: https://bintray.com/o2-platform&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- hiding the ones below since they need work done&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216900</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216900"/>
				<updated>2016-05-15T16:27:25Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Downloads */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Downloads=&lt;br /&gt;
&lt;br /&gt;
'''Latest Release: April 2013 - v5.5''':  [https://bintray.com/o2-platform/Main-Exe/download_file?file_path=O2_Platform_5.5_RC1.zip O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
All download files are hosted at BinTray: https://bintray.com/o2-platform&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- hiding the ones below since they need work done&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216899</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216899"/>
				<updated>2016-05-15T15:57:54Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Downloads */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Downloads=&lt;br /&gt;
&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
All download files are hosted at BinTray: https://bintray.com/o2-platform&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!-- hiding the ones below since they need work done&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216898</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216898"/>
				<updated>2016-05-15T15:42:19Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
Collection of Open Source modules that help Web Application Security Professionals to maximize their efforts and quickly obtain high visibility into an application's security profile.&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Downloads=&lt;br /&gt;
&amp;lt;!-- hiding the ones below since they need work done&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216897</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=216897"/>
				<updated>2016-05-15T15:40:34Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Main */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:90px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File: lab_big.jpg|link=OWASP_Project_Stages#tab.3DLab_Projects]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security tests and scripts. &lt;br /&gt;
&lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 3.5 for the main apis and 4.5 for the installer&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
[http://www.slideshare.net/DinisCruz/owasp-o2-platform-november-2010 Owasp O2 Platform ] - Automating Security Knowledge through Unit Tests&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
== Ohloh (OpenHub) ==&lt;br /&gt;
&lt;br /&gt;
see https://www.openhub.net/p/o2platform&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]][[Category:SAMM-CR-2]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Deserialization_of_untrusted_data&amp;diff=216201</id>
		<title>Deserialization of untrusted data</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Deserialization_of_untrusted_data&amp;diff=216201"/>
				<updated>2016-05-02T11:57:47Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Added link to 'Java Deserialization Vulnerabilities - The Forgotten Bug Class' to References&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Template:Vulnerability}}&lt;br /&gt;
{{Template:SecureSoftware}}&lt;br /&gt;
&lt;br /&gt;
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''&lt;br /&gt;
&lt;br /&gt;
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
&lt;br /&gt;
Data which is untrusted cannot be trusted to be well formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.&lt;br /&gt;
&lt;br /&gt;
'''Consequences'''&lt;br /&gt;
&lt;br /&gt;
* Availability: The logic of deserialization could be abused to create recursive object graphs or never provide data expected to terminate reading.&lt;br /&gt;
* Authorization: Potentially code could make assumptions that information in the deserialized object about the data is valid. Functions which make this dangerous assumption could be exploited.&lt;br /&gt;
* Access control (instruction processing): malicious objects can abuse the logic of custom deserializers in order to affect code execution.&lt;br /&gt;
&lt;br /&gt;
'''Exposure period'''&lt;br /&gt;
&lt;br /&gt;
* Requirements specification: A deserialization library could be used which provides a cryptographic framework to seal serialized data. &lt;br /&gt;
* Implementation: Not using the safe deserialization/serializing data features of a language can create data integrity problems. &lt;br /&gt;
* Implementation: Not using the protection accessor functions of an object can cause data integrity problems &lt;br /&gt;
* Implementation: Not protecting your objects from default overloaded functions - which may provide for raw output streams of objects - may cause data confidentiality problems. &lt;br /&gt;
* Implementation: Not making fields transient can often cause data confidentiality problems.&lt;br /&gt;
&lt;br /&gt;
'''Platform'''&lt;br /&gt;
&lt;br /&gt;
* Languages: C, C++, Java, Python, Ruby (and probably others)&lt;br /&gt;
* Operating platforms: Any&lt;br /&gt;
&lt;br /&gt;
'''Required resources'''&lt;br /&gt;
&lt;br /&gt;
Any&lt;br /&gt;
&lt;br /&gt;
'''Severity'''&lt;br /&gt;
&lt;br /&gt;
High&lt;br /&gt;
&lt;br /&gt;
'''Likelihood of exploit'''&lt;br /&gt;
&lt;br /&gt;
Medium&lt;br /&gt;
&lt;br /&gt;
It is often convenient to serialize objects for convenient communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security - which is of course a dangerous security assumption.&lt;br /&gt;
&lt;br /&gt;
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the non-transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.&lt;br /&gt;
&lt;br /&gt;
==Risk Factors==&lt;br /&gt;
&lt;br /&gt;
* Does the deserialization take place before authentication?&lt;br /&gt;
* Does the deserialization limit which types can be deserialized?&lt;br /&gt;
* Does the deserialization host have types available which can be repurposed towards malicious ends? Sometimes, these types are called &amp;quot;gadgets&amp;quot;, considering their similarity to abusable bits of code that already exist in machine code in [https://en.wikipedia.org/wiki/Return-oriented_programming Return-Oriented-Programming] attacks.&lt;br /&gt;
&lt;br /&gt;
==Examples==&lt;br /&gt;
&lt;br /&gt;
The following is an example from Adobe's BlazeDS AMF deserialization vulnerability ([https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2092 CVE-2011-2092]). You can specify arbitrary classes and properties for a BlazeDS application to deserialize. This particular payload creates an instance of a JFrame object on the target server. The created JFrame object will have a &amp;quot;defaultCloseOperation&amp;quot; of value 3 -- which indicates that the JVM should exit when this JFrame window is closed.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[RemoteClass(alias=&amp;quot;javax.swing.JFrame&amp;quot;)]&lt;br /&gt;
public class JFrame {&lt;br /&gt;
   public var title:String = &amp;quot;Gotcha!&amp;quot;;&lt;br /&gt;
   public var defaultCloseOperation:int = 3;&lt;br /&gt;
   public var visible:Boolean = true;&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The next example is one that is much more likely to be seen in custom code. This code reads an object from an untrusted source, and then casts it to an AcmeObject:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
InputStream is = request.getInputStream();&lt;br /&gt;
ObjectInputStream ois = new ObjectInputStream(is);&lt;br /&gt;
AcmeObject acme = (AcmeObject)ois.readObject();&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Unfortunately, the casting operation to AcmeObject occurs after the deserialization process ends. Therefore, it's not useful in preventing any attacks that happen during deserialization from occurring. It's possible that behavior in custom deserialization protocols (for instance, by overriding Serializable#readObject() in Java) can be re-purposed towards malicious ends. Researchers have found [http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ complex object graphs which, when deserialized, can lead to remote code execution] in most Java software.&lt;br /&gt;
&lt;br /&gt;
The next example is a denial-of-service attack against any Java application that allows deserialization. The HashSet called &amp;quot;root&amp;quot; in the following code sample has members that are recursively linked to each other. When deserializing this &amp;quot;root&amp;quot; object, the JVM will begin creating a recursive object graph. It will never complete, and consume CPU indefinitely.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Set root = new HashSet();&lt;br /&gt;
Set s1 = root;&lt;br /&gt;
Set s2 = new HashSet();&lt;br /&gt;
for (int i = 0; i &amp;lt; 100; i++) {&lt;br /&gt;
  Set t1 = new HashSet();&lt;br /&gt;
  Set t2 = new HashSet();&lt;br /&gt;
  t1.add(&amp;quot;foo&amp;quot;); // make it not equal to t2&lt;br /&gt;
  s1.add(t1);&lt;br /&gt;
  s1.add(t2);&lt;br /&gt;
  s2.add(t1);&lt;br /&gt;
  s2.add(t2);&lt;br /&gt;
  s1 = t1;&lt;br /&gt;
  s2 = t2;&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Another example of a denial-of-service attack against any Java application that allows deserialization:  &lt;br /&gt;
&lt;br /&gt;
By crafting a stream, such that it contains an ArrayList with a size of Integer.MAX_VALUE, even if all elements are null or the same object, an internal array of length MAX_VALUE will be created, on some JVM's this will cause an OutOfMemoryError prior to deserialization of the elements, this doesn't require much data in the inputStream.  Many collection classes and object arrays can be manipulated in similar wasy, as they create their capacity prior to reading in elements, few sanity checks are performed.&lt;br /&gt;
&lt;br /&gt;
It's not like the JVM folks aren't aware, they're just hamstrung by backward compatibility with deployed code.&lt;br /&gt;
&lt;br /&gt;
A quote from ArrayList source (GPL2 license with classpath exception):&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
    /**&lt;br /&gt;
     * The maximum size of array to allocate.&lt;br /&gt;
     * Some VMs reserve some header words in an array.&lt;br /&gt;
     * Attempts to allocate larger arrays may result in&lt;br /&gt;
     * OutOfMemoryError: Requested array size exceeds VM limit&lt;br /&gt;
     */&lt;br /&gt;
    private static final int MAX_ARRAY_SIZE = Integer.MAX_VALUE - 8;&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Even if ObjectInputStream is overridden to perform look ahead deserialization with a white-list, ObjectInputStream itself, will allow an attacker to create a multidimensional array, with a size of Integer.MAX_VALUE and every array element it contains, to do the same, even if these arrays all contain the same object element reference (passing reference to cached, previously serialized objects, minimizes the stream bytes transferred), it will very quickly consume all available memory in the JVM.&lt;br /&gt;
&lt;br /&gt;
Fortunately ObjectInputStream can be completely re-implemented and overridden by subclassing, in this case the entire functionality of ObjectInputStream has to also be re-implemented to read [https://docs.oracle.com/javase/7/docs/platform/serialization the Java serialization protocol].  &lt;br /&gt;
&lt;br /&gt;
Since Java's Serialization uses implicit construction, whereby the first non serializable no argument super class constructor is invoked to create a child class instance (along with some unsafe magic), it prevents classes from checking their invariant's until after construction has completed.  For this reason, the standard implicit java Serialization API is flawed from a security perspective.&lt;br /&gt;
&lt;br /&gt;
It is possible to create an ObjectInputStream that is backward compatible with current Serializable Object's serial form, for security, it requires a new deserialization API, the exclusion of circular references, limits placed on array lengths and the object cache, all while allowing classes to check their invariants prior to objects being created, such that no object can be created in an illegal state.  In addition administrators will need to be able to reduce the classes available for deserialization to only those required to limit the attack surface, similar to white-listing or using Permission's.&lt;br /&gt;
&lt;br /&gt;
==Related [[Controls]]==&lt;br /&gt;
&lt;br /&gt;
* Requirements specification: A deserialization library could be used which provides a cryptographic framework to seal serialized data. &lt;br /&gt;
* Implementation: Use the signing features of a language to assure that deserialized data has not been tainted. &lt;br /&gt;
* Implementation: When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe. &lt;br /&gt;
* Implementation: Explicitly define final [http://docs.oracle.com/javase/7/docs/api/java/io/Serializable.html readObject()] to prevent deserialization. &lt;br /&gt;
&lt;br /&gt;
An example of this is:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
private final void readObject(ObjectInputStream in)&lt;br /&gt;
throws java.io.IOException {&lt;br /&gt;
     throw new java.io.IOException(&amp;quot;Cannot be deserialized&amp;quot;);&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
* Implementation: Make fields transient to protect them from deserialization.&lt;br /&gt;
* Implementation: In your code, override the [http://docs.oracle.com/javase/7/docs/api/java/io/ObjectInputStream.html ObjectInputStream#resolveClass()] method to prevent arbitrary classes from being deserialized. This safe behavior can be wrapped in a library like [https://github.com/ikkisoft/SerialKiller SerialKiller].&lt;br /&gt;
* Implementation: Use a safe replacement for the generic readObject() method as seen [http://www.contrastsecurity.com/security-influencers/java-serialization-vulnerability-threatens-millions-of-applications here]. Note that this addresses &amp;quot;billion laughs&amp;quot; type attacks by checking input length and number of objects deserialized.&lt;br /&gt;
* Implementation: Use a Java agent to override the internals of ObjectInputStream to prevent exploitation of known dangerous types as seen in [https://github.com/Contrast-Security-OSS/contrast-rO0 rO0] and [https://github.com/kantega/notsoserial NotSoSerial]&lt;br /&gt;
* Implementation: Participate in the reimplementation of ObjectInputStream; Atomic Serialization is designed with security in mind from the outset, while maintaining Object Serial Form compatibility; note this is not a drop in replacement like those above, but likely to be the most secure option.&lt;br /&gt;
&lt;br /&gt;
==References==&lt;br /&gt;
* [http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#websphere FoxGlove vulnerability announcement]&lt;br /&gt;
* [http://wouter.coekaerts.be/2011/amf-arbitrary-code-execution JFrame DoS example by Wouter Coekaerts]&lt;br /&gt;
* [https://gist.github.com/coekie/a27cc406fc9f3dc7a70d HashSet Billion-Laughs Style DoS example by Wouter Coekaerts]&lt;br /&gt;
* [https://github.com/ikkisoft/SerialKiller Safe ObjectInputStream implementation that allows policy-based deserialization]&lt;br /&gt;
* [https://github.com/Contrast-Security-OSS/contrast-rO0 rO0, a Java agent that protects applications from deserialization attacks]&lt;br /&gt;
* [https://github.com/kantega/notsoserial NotSoSerial, a Java agent that protects applications from deserialization attacks]&lt;br /&gt;
* [https://github.com/pfirmstone/river-internet/tree/Input-validation-for-Serialization/src/org/apache/river/api/io Atomic Serialization using constructor with input validation, no circular references, Permission limited scope limited object cache and array length limits, with stream resets]&lt;br /&gt;
[[Category:Input Validation Vulnerability]]&lt;br /&gt;
*[http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilitesruhrseceditionv10 Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)]&lt;br /&gt;
&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP ASDR Project]]&lt;br /&gt;
[[Category:Vulnerability]]&lt;br /&gt;
[[Category:Range and Type Error Vulnerability]]&lt;br /&gt;
[[Category:OWASP_CLASP_Project]]&lt;br /&gt;
[[Category:Code Snippet]]&lt;br /&gt;
[[Category:Java]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=User:Dinis.cruz&amp;diff=211613</id>
		<title>User:Dinis.cruz</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=User:Dinis.cruz&amp;diff=211613"/>
				<updated>2016-03-23T08:32:37Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Bio */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hello, Welcome to my page where you can find more details about who I am and what I do at OWASP. You can contact me on dinis.cruz at owasp.org or dinis at ddplus.net&lt;br /&gt;
&lt;br /&gt;
To see my wiki contributions, [[:Special:Contributions/Dinis.cruz|click here]].&lt;br /&gt;
&lt;br /&gt;
My most updated [http://uk.linkedin.com/in/diniscruz CV is at LinkedIn] and here is the [http://dl.dropbox.com/u/12988346/Personal/Dinis%20Cruz%20%28CV%20-%20October%202010%29.pdf PDF version]&lt;br /&gt;
 &lt;br /&gt;
== Current OWASP Involvement ==&lt;br /&gt;
&lt;br /&gt;
I am currently involved in a number of OWASP areas:&lt;br /&gt;
&lt;br /&gt;
* leader of the [[OWASP O2 Platform]] project&lt;br /&gt;
* published the [[Summit_2011/Open_letter_to_WebAppSec_Tool_and_Services_vendors:_Release_your_schemas_and_allow_automation | Open letter to WebAppSec Tool and Services vendors: Release your schemas and allow automation]]&lt;br /&gt;
&lt;br /&gt;
== Past OWASP involvement ==&lt;br /&gt;
* participant of the OWASP [[Global Projects Committee]]&lt;br /&gt;
* chair of the [[OWASP Connections Committee]]&lt;br /&gt;
* member of the [[About_The_Open_Web_Application_Security_Project#Global_Board_Members|OWASP Board]]&lt;br /&gt;
* Organized the [[OWASP Summit 2011]] in Portugal&lt;br /&gt;
* leader of the OWASP [[London]] chapter (2006/2007) - but have passed the leadership to Ivan from ModSecurity, who passed it to Justin. &lt;br /&gt;
* leader of the OWASP .NET Project&lt;br /&gt;
* main developer of a number of OWASP .NET tools&lt;br /&gt;
* helped to organize the [[OWASP EU Summit 2008]] in Portugal&lt;br /&gt;
* helped to organize the past OWASP Sponsorship programs:&lt;br /&gt;
** [[OWASP Season of Code 2009]]&lt;br /&gt;
** [[OWASP Summer of Code 2008]]&lt;br /&gt;
** [[OWASP Spring Of Code 2007]]&lt;br /&gt;
** [[OWASP Autumn Of Code 2006]]&lt;br /&gt;
&lt;br /&gt;
== Bio ==&lt;br /&gt;
&lt;br /&gt;
===Current version (2016)===&lt;br /&gt;
&lt;br /&gt;
Dinis Cruz is focused on creating Application Security teams and providing Application Security assurance across the Software Development Lifecycle (from development, to operations, to business processes, to board-level decisions). &lt;br /&gt;
&lt;br /&gt;
His focus is in the alignment of the business’s risk appetite with the reality created by the Applications developed by internal or outsourced development teams&lt;br /&gt;
&lt;br /&gt;
Assurance and Testing are at the epicentre of his Application Security activities:&lt;br /&gt;
&lt;br /&gt;
* Threat Modeling (security architecture, design review, asset discovery, attack surface mapping, authorisation/authentication visualisation), &lt;br /&gt;
* Application Security assessments (aka code-driven pen-tests)&lt;br /&gt;
* Static/dynamic code analysis tools customisation, deployment and use&lt;br /&gt;
* Developer Education&lt;br /&gt;
* Secure coding standards and best practices&lt;br /&gt;
* RISK management workflows (aka custom JIRA issue workflows)&lt;br /&gt;
* Finding sweet spots where security activities are aligned with development/business needs (for example: DevOps, stand-alone QA environments, application visualisation, performance/resilience)&lt;br /&gt;
* Creating and nurturing a network of Security Champions (across all teams), to allow the scaling and sharing of Application Security knowledge&lt;br /&gt;
* Managing Application Security services provided to the business (staffed in-house of via 3rd party consultancies)&lt;br /&gt;
* Increasing existing logging and visualisation solutions in order to monitor, report and react to security incidents&lt;br /&gt;
&lt;br /&gt;
With professional development experience (.NET, Java, NodeJS) and management experience, Dinis is able to move from highly technical threads with developers, to design reviews with architects, all the way to business strategy sessions with senior C-Level executives. &lt;br /&gt;
&lt;br /&gt;
===Old version (Nov 2013)===&lt;br /&gt;
&lt;br /&gt;
Dinis Cruz is a Developer and Application Security Engineer focused on how to develop secure applications. A key drive is on 'Automating Application Security Knowledge and Workflows' which is the main concept behind the OWASP O2 Platform and Security Innovation's TeamMentor (Dinis is the main developer and architect of both Applications). &lt;br /&gt;
&lt;br /&gt;
Current day job is with Security Innovation where Dinis tries to promote openness, quality and sharing as part a core tenet of TeamMentor's application development environment. &lt;br /&gt;
&lt;br /&gt;
After many years (and multiple roles) Dinis is still very active at OWASP, currently leading the O2 Platform project and helping out other projects and initiatives. &lt;br /&gt;
&lt;br /&gt;
After failing to scale his own security knowledge, learned Git, created security vulnerabilities in code published to production servers, delivered training to developers, and building multiple CI (Continuous Integration) environments; Dinis had the epiphany that the key to application security is &amp;quot;Secure Continuous Delivery: Developer’s Immediate Connection to What They’re Creating&amp;quot;. This 'Immediate Connection/Feedback' concept is deep rooted in the development of the O2 Platform/TeamMentor, and is something that will keep Dinis busy for many years.&lt;br /&gt;
&lt;br /&gt;
=== Old version (circa 2010) ===&lt;br /&gt;
Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development.&lt;br /&gt;
&lt;br /&gt;
For the past couple years Dinis has focused on the field of Static Source Code Analysis and Dynamic Website Assessments (aka penetration testing), and is the main developer of the [[OWASP O2 Platform]] which is an Open Source project that is focused on 'Automating Security Consultants Knowledge/Workflows' and 'Allowing non-security experts to access and consume Security Knowledge'. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between: the multiple WebAppSec tools, the Security consultants and the final users (from management to developers).  &lt;br /&gt;
&lt;br /&gt;
Past industry experience include: running a small Software/Consultancy business, acting as CTO for a Portuguese University, being part of a Security Assessment team (Pentesting and Source Code Assessment) for a global Bank (ABN AMRO), taking the role of Directory of Advanced Technologies at Ounce Labs (acquired by IBM), performing Web Application security assessments on a large number of languages/technologies/frameworks and being a very active participant and enabler at OWASP.&lt;br /&gt;
&lt;br /&gt;
Dinis is an active trainer on .Net security, having written and delivered courses for Ounce Labs, IOActive, Foundstone, Intense School and KPMG  (at multiple locations including BlackHat). Dinis has also delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences. &lt;br /&gt;
&lt;br /&gt;
As a security researcher Dinis created a number of innovative tools and research documents, and has responsible disclosed a number of Critical vulnerabilities on Commercial Applications (for example Microsoft's Advisory [http://www.microsoft.com/technet/security/Bulletin/MS07-040.mspx MS07-040] on the .NET Framework, or the [http://www.springsource.com/security/spring-mvc Spring MVC Auto-Binding] issue)&lt;br /&gt;
&lt;br /&gt;
At OWASP, Dinis is the leader of the [[OWASP O2 Platform]] project, member of the OWASP [[Global Projects Committee]], chair of the [[OWASP Connections Committee]] and member of the OWASP Board (and has been a key driven on a number of major OWASP Initiatives: OWASP Seasons of Code, OWASP Summit 2008 in Portugal, OWASP Community building and OWASP Chapter-lead Training)&lt;br /&gt;
&lt;br /&gt;
== Security vulnerability research==&lt;br /&gt;
*  [http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx Microsoft Security Bulletin MS07-040 - Critical]&lt;br /&gt;
*  [http://www.springsource.com/security/spring-mvc Spring MVC Auto-Binding] &lt;br /&gt;
== Interviews &amp;amp; Media quotes ==&lt;br /&gt;
&lt;br /&gt;
* [http://reddevnews.com/blogs/weblog.aspx?blog=1473  Asked and Answered: More Secure .NET Development], Redmond Developer News, 24/Oct/07&lt;br /&gt;
* [http://www.darkreading.com/document.asp?doc_id=135797&amp;amp;WT.svl=news1_1 OWASP Preps Framework for Website Security Certification], Dark Reading, 08/Oct/07&lt;br /&gt;
* [http://www.ddj.com/security/202300130 Security, .NET, and the OWASP Project] , Dr.Dobb's Portal , 05/Oct/07&lt;br /&gt;
* [http://www.sans.edu/resources/securitylab/dinis_cruz.php Security Laboratory: Thought Leaders in Software Security Series], SANS, 11/Jun/07&lt;br /&gt;
* [http://myappsecurity.blogspot.com/2007/07/reflection-on-dinis-cruz.html Reflection on Dinis Cruz], Anurag Agarwal Blog, 02/Jul/07&lt;br /&gt;
&lt;br /&gt;
== Videos ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.youtube.com/watch?v=nHHDXMcrYgs The Value of Code Scanning], SANS,  24/Aug/07&lt;br /&gt;
* [http://video.google.com/videoplay?docid=-4836024642453442602 'Live Demo Of An Web Application Security Review (And Source Code Analysis)'] , OWASP Turkey Chapter, 31/Jul/07&lt;br /&gt;
* [http://video.google.com/videoplay?docid=7782803854278645697| On OWASP] , OWASP Turkey Chapter, 31/Jul/07&lt;br /&gt;
* [http://video.google.co.uk/videoplay?docid=941077664562737284 Dinis Cruz @ BlackHat 2006 with FSTV], 30/Aug/06&lt;br /&gt;
&lt;br /&gt;
== Working pages ==&lt;br /&gt;
&lt;br /&gt;
This is more a reference for me (Dinis) but feel free to look around&lt;br /&gt;
&lt;br /&gt;
* [[OWASP .NET Project]]&lt;br /&gt;
* [[Members Comments On OWASP membership]]&lt;br /&gt;
* [[Dinis Cruz Research - Draft Notes]]&lt;br /&gt;
* [[OWASP_Spring_Of_Code_2007]]&lt;br /&gt;
* [[OWASP_Winter_Of_Code_2008]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=User:Dinis.cruz&amp;diff=211612</id>
		<title>User:Dinis.cruz</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=User:Dinis.cruz&amp;diff=211612"/>
				<updated>2016-03-23T08:31:34Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Updating bio&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hello, Welcome to my page where you can find more details about who I am and what I do at OWASP. You can contact me on dinis.cruz at owasp.org or dinis at ddplus.net&lt;br /&gt;
&lt;br /&gt;
To see my wiki contributions, [[:Special:Contributions/Dinis.cruz|click here]].&lt;br /&gt;
&lt;br /&gt;
My most updated [http://uk.linkedin.com/in/diniscruz CV is at LinkedIn] and here is the [http://dl.dropbox.com/u/12988346/Personal/Dinis%20Cruz%20%28CV%20-%20October%202010%29.pdf PDF version]&lt;br /&gt;
 &lt;br /&gt;
== Current OWASP Involvement ==&lt;br /&gt;
&lt;br /&gt;
I am currently involved in a number of OWASP areas:&lt;br /&gt;
&lt;br /&gt;
* leader of the [[OWASP O2 Platform]] project&lt;br /&gt;
* published the [[Summit_2011/Open_letter_to_WebAppSec_Tool_and_Services_vendors:_Release_your_schemas_and_allow_automation | Open letter to WebAppSec Tool and Services vendors: Release your schemas and allow automation]]&lt;br /&gt;
&lt;br /&gt;
== Past OWASP involvement ==&lt;br /&gt;
* participant of the OWASP [[Global Projects Committee]]&lt;br /&gt;
* chair of the [[OWASP Connections Committee]]&lt;br /&gt;
* member of the [[About_The_Open_Web_Application_Security_Project#Global_Board_Members|OWASP Board]]&lt;br /&gt;
* Organized the [[OWASP Summit 2011]] in Portugal&lt;br /&gt;
* leader of the OWASP [[London]] chapter (2006/2007) - but have passed the leadership to Ivan from ModSecurity, who passed it to Justin. &lt;br /&gt;
* leader of the OWASP .NET Project&lt;br /&gt;
* main developer of a number of OWASP .NET tools&lt;br /&gt;
* helped to organize the [[OWASP EU Summit 2008]] in Portugal&lt;br /&gt;
* helped to organize the past OWASP Sponsorship programs:&lt;br /&gt;
** [[OWASP Season of Code 2009]]&lt;br /&gt;
** [[OWASP Summer of Code 2008]]&lt;br /&gt;
** [[OWASP Spring Of Code 2007]]&lt;br /&gt;
** [[OWASP Autumn Of Code 2006]]&lt;br /&gt;
&lt;br /&gt;
== Bio ==&lt;br /&gt;
&lt;br /&gt;
===Current version (2016)===&lt;br /&gt;
&lt;br /&gt;
Dinis Cruz is focused on creating Application Security teams and providing Application Security assurance across the Software Development Lifecycle (from development, to operations, to business processes, to board-level decisions). &lt;br /&gt;
&lt;br /&gt;
His focus is in the alignment of the business’s risk appetite with the reality created by the Applications developed by internal or outsourced development teams&lt;br /&gt;
&lt;br /&gt;
Assurance and Testing are at the epicentre of his Application Security activities:&lt;br /&gt;
&lt;br /&gt;
• Threat Modeling (security architecture, design review, asset discovery, attack surface mapping, authorisation/authentication visualisation), &lt;br /&gt;
• Application Security assessments (aka code-driven pen-tests)&lt;br /&gt;
• Static/dynamic code analysis tools customisation, deployment and use&lt;br /&gt;
• Developer Education&lt;br /&gt;
• Secure coding standards and best practices&lt;br /&gt;
• RISK management workflows (aka custom JIRA issue workflows)&lt;br /&gt;
• Finding sweet spots where security activities are aligned with development/business needs (for example: DevOps, stand-alone QA environments, application visualisation, performance/resilience)&lt;br /&gt;
• Creating and nurturing a network of Security Champions (across all teams), to allow the scaling and sharing of Application Security knowledge&lt;br /&gt;
• Managing Application Security services provided to the business (staffed in-house of via 3rd party consultancies)&lt;br /&gt;
• Increasing existing logging and visualisation solutions in order to monitor, report and react to security incidents&lt;br /&gt;
&lt;br /&gt;
With professional development experience (.NET, Java, NodeJS) and management experience, Dinis is able to move from highly technical threads with developers, to design reviews with architects, all the way to business strategy sessions with senior C-Level executives. &lt;br /&gt;
&lt;br /&gt;
===Old version (Nov 2013)===&lt;br /&gt;
&lt;br /&gt;
Dinis Cruz is a Developer and Application Security Engineer focused on how to develop secure applications. A key drive is on 'Automating Application Security Knowledge and Workflows' which is the main concept behind the OWASP O2 Platform and Security Innovation's TeamMentor (Dinis is the main developer and architect of both Applications). &lt;br /&gt;
&lt;br /&gt;
Current day job is with Security Innovation where Dinis tries to promote openness, quality and sharing as part a core tenet of TeamMentor's application development environment. &lt;br /&gt;
&lt;br /&gt;
After many years (and multiple roles) Dinis is still very active at OWASP, currently leading the O2 Platform project and helping out other projects and initiatives. &lt;br /&gt;
&lt;br /&gt;
After failing to scale his own security knowledge, learned Git, created security vulnerabilities in code published to production servers, delivered training to developers, and building multiple CI (Continuous Integration) environments; Dinis had the epiphany that the key to application security is &amp;quot;Secure Continuous Delivery: Developer’s Immediate Connection to What They’re Creating&amp;quot;. This 'Immediate Connection/Feedback' concept is deep rooted in the development of the O2 Platform/TeamMentor, and is something that will keep Dinis busy for many years.&lt;br /&gt;
&lt;br /&gt;
=== Old version (circa 2010) ===&lt;br /&gt;
Dinis Cruz is a Security Consultant based in London (UK) and specialized in: ASP.NET/J2EE Application Security, Application Security audits and .NET Security Curriculum Development.&lt;br /&gt;
&lt;br /&gt;
For the past couple years Dinis has focused on the field of Static Source Code Analysis and Dynamic Website Assessments (aka penetration testing), and is the main developer of the [[OWASP O2 Platform]] which is an Open Source project that is focused on 'Automating Security Consultants Knowledge/Workflows' and 'Allowing non-security experts to access and consume Security Knowledge'. Dinis is currently focused on making the O2 Platform the industry standard for consuming, instrumenting and data-sharing between: the multiple WebAppSec tools, the Security consultants and the final users (from management to developers).  &lt;br /&gt;
&lt;br /&gt;
Past industry experience include: running a small Software/Consultancy business, acting as CTO for a Portuguese University, being part of a Security Assessment team (Pentesting and Source Code Assessment) for a global Bank (ABN AMRO), taking the role of Directory of Advanced Technologies at Ounce Labs (acquired by IBM), performing Web Application security assessments on a large number of languages/technologies/frameworks and being a very active participant and enabler at OWASP.&lt;br /&gt;
&lt;br /&gt;
Dinis is an active trainer on .Net security, having written and delivered courses for Ounce Labs, IOActive, Foundstone, Intense School and KPMG  (at multiple locations including BlackHat). Dinis has also delivered a number of presentations and keynote speeches at multiple OWASP and Security related conferences. &lt;br /&gt;
&lt;br /&gt;
As a security researcher Dinis created a number of innovative tools and research documents, and has responsible disclosed a number of Critical vulnerabilities on Commercial Applications (for example Microsoft's Advisory [http://www.microsoft.com/technet/security/Bulletin/MS07-040.mspx MS07-040] on the .NET Framework, or the [http://www.springsource.com/security/spring-mvc Spring MVC Auto-Binding] issue)&lt;br /&gt;
&lt;br /&gt;
At OWASP, Dinis is the leader of the [[OWASP O2 Platform]] project, member of the OWASP [[Global Projects Committee]], chair of the [[OWASP Connections Committee]] and member of the OWASP Board (and has been a key driven on a number of major OWASP Initiatives: OWASP Seasons of Code, OWASP Summit 2008 in Portugal, OWASP Community building and OWASP Chapter-lead Training)&lt;br /&gt;
&lt;br /&gt;
== Security vulnerability research==&lt;br /&gt;
*  [http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx Microsoft Security Bulletin MS07-040 - Critical]&lt;br /&gt;
*  [http://www.springsource.com/security/spring-mvc Spring MVC Auto-Binding] &lt;br /&gt;
== Interviews &amp;amp; Media quotes ==&lt;br /&gt;
&lt;br /&gt;
* [http://reddevnews.com/blogs/weblog.aspx?blog=1473  Asked and Answered: More Secure .NET Development], Redmond Developer News, 24/Oct/07&lt;br /&gt;
* [http://www.darkreading.com/document.asp?doc_id=135797&amp;amp;WT.svl=news1_1 OWASP Preps Framework for Website Security Certification], Dark Reading, 08/Oct/07&lt;br /&gt;
* [http://www.ddj.com/security/202300130 Security, .NET, and the OWASP Project] , Dr.Dobb's Portal , 05/Oct/07&lt;br /&gt;
* [http://www.sans.edu/resources/securitylab/dinis_cruz.php Security Laboratory: Thought Leaders in Software Security Series], SANS, 11/Jun/07&lt;br /&gt;
* [http://myappsecurity.blogspot.com/2007/07/reflection-on-dinis-cruz.html Reflection on Dinis Cruz], Anurag Agarwal Blog, 02/Jul/07&lt;br /&gt;
&lt;br /&gt;
== Videos ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.youtube.com/watch?v=nHHDXMcrYgs The Value of Code Scanning], SANS,  24/Aug/07&lt;br /&gt;
* [http://video.google.com/videoplay?docid=-4836024642453442602 'Live Demo Of An Web Application Security Review (And Source Code Analysis)'] , OWASP Turkey Chapter, 31/Jul/07&lt;br /&gt;
* [http://video.google.com/videoplay?docid=7782803854278645697| On OWASP] , OWASP Turkey Chapter, 31/Jul/07&lt;br /&gt;
* [http://video.google.co.uk/videoplay?docid=941077664562737284 Dinis Cruz @ BlackHat 2006 with FSTV], 30/Aug/06&lt;br /&gt;
&lt;br /&gt;
== Working pages ==&lt;br /&gt;
&lt;br /&gt;
This is more a reference for me (Dinis) but feel free to look around&lt;br /&gt;
&lt;br /&gt;
* [[OWASP .NET Project]]&lt;br /&gt;
* [[Members Comments On OWASP membership]]&lt;br /&gt;
* [[Dinis Cruz Research - Draft Notes]]&lt;br /&gt;
* [[OWASP_Spring_Of_Code_2007]]&lt;br /&gt;
* [[OWASP_Winter_Of_Code_2008]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Blocking_Brute_Force_Attacks&amp;diff=210449</id>
		<title>Blocking Brute Force Attacks</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Blocking_Brute_Force_Attacks&amp;diff=210449"/>
				<updated>2016-03-04T09:58:13Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Removing Mark's bio and reference at the end of the page (since OWASP content needs to be neutral and not assigned to an individual)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Blocking Brute Force Attacks ==&lt;br /&gt;
&lt;br /&gt;
A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. If your web site requires user authentication, you are a good target for a brute-force attack.&lt;br /&gt;
&lt;br /&gt;
An attacker can always discover a password through a brute-force attack, but the downside is that it could take years to find it. Depending on the password's length and complexity, there could be trillions of possible combinations. To speed things up a bit, a brute-force attack could start with dictionary words or slightly modified dictionary words because most people will use those rather than a completely random password. These attacks are called dictionary attacks or hybrid brute-force attacks. Brute-force attacks put user accounts at risk and flood your site with unnecessary traffic.&lt;br /&gt;
&lt;br /&gt;
Hackers launch brute-force attacks using widely available tools that utilize wordlists and smart rulesets to intelligently and automatically guess user passwords. Although such attacks are easy to detect, they are not so easy to prevent. For example, many HTTP brute-force tools can relay requests through a list of open proxy servers. Since each request appears to come from a different IP address, you cannot block these attacks simply by blocking the IP address. To further complicate things, some tools try a different username and password on each attempt, so you cannot lock out a single account for failed password attempts.&lt;br /&gt;
&lt;br /&gt;
==Locking Accounts==&lt;br /&gt;
&lt;br /&gt;
The most obvious way to block brute-force attacks is to simply lock out accounts after a defined number of incorrect password attempts. Account lockouts can last a specific duration, such as one hour, or the accounts could remain locked until manually unlocked by an administrator. However, account lockout is not always the best solution, because someone could easily abuse the security measure and lock out hundreds of user accounts. In fact, some Web sites experience so many attacks that they are unable to enforce a lockout policy because they would constantly be unlocking customer accounts.&lt;br /&gt;
&lt;br /&gt;
The problems with account lockouts are:&lt;br /&gt;
&lt;br /&gt;
:* An attacker can cause a denial of service (DoS) by locking out large numbers of accounts.&lt;br /&gt;
:* Because you cannot lock out an account that does not exist, only valid account names will lock. An attacker could use this fact to harvest usernames from the site, depending on the error responses.&lt;br /&gt;
:* An attacker can cause a diversion by locking out many accounts and flooding the help desk with support calls.&lt;br /&gt;
:* An attacker can continuously lock out the same account, even seconds after an administrator unlocks it, effectively disabling the account.&lt;br /&gt;
:* Account lockout is ineffective against slow attacks that try only a few passwords every hour.&lt;br /&gt;
:* Account lockout is ineffective against attacks that try one password against a large list of usernames.&lt;br /&gt;
:* Account lockout is ineffective if the attacker is using a username/password combo list and guesses correctly on the first couple of attempts.&lt;br /&gt;
:* Powerful accounts such as administrator accounts often bypass lockout policy, but these are the most desirable accounts to attack. Some systems lock out administrator accounts only on network-based logins.&lt;br /&gt;
:* Even once you lock out an account, the attack may continue, consuming valuable human and computer resources.&lt;br /&gt;
&lt;br /&gt;
Account lockout is sometimes effective, but only in controlled environments or in cases where the risk is so great that even continuous DoS attacks are preferable to account compromise. In most cases, however, account lockout is insufficient for stopping brute-force attacks. Consider, for example, an auction site on which several bidders are fighting over the same item. If the auction Web site enforced account lockouts, one bidder could simply lock the others' accounts in the last minute of the auction, preventing them from submitting any winning bids. An attacker could use the same technique to block critical financial transactions or e-mail communications.&lt;br /&gt;
&lt;br /&gt;
==Device Cookies==&lt;br /&gt;
&lt;br /&gt;
You may also consider locking out authentication attempts from known and unknown browsers or devices separately. The [[Slow Down Online Guessing Attacks with Device Cookies]] article proposes protocol for lockout mechanism based on information about if specific browser have been already used for successful login. The protocol is less susceptible to DoS attacks than plain account locking out and yet effective and easy to implement.&lt;br /&gt;
&lt;br /&gt;
==Finding Other Countermeasures==&lt;br /&gt;
&lt;br /&gt;
As described, account lockouts are usually not a practical solution, but there are other tricks to deal with brute force attacks. First, since the success of the attack is dependent on time, an easy solution is to inject random pauses when checking a password. Adding even a few seconds' pause can greatly slow a brute-force attack but will not bother most legitimate users as they log in to their accounts.&lt;br /&gt;
&lt;br /&gt;
Note that although adding a delay could slow a single-threaded attack, it is less effective if the attacker sends multiple simultaneous authentication requests.&lt;br /&gt;
&lt;br /&gt;
Another solution is to lock out an IP address with multiple failed logins. The problem with this solution is that you could inadvertently block large groups of users by blocking a proxy server used by an ISP or large company. Another problem is that many tools utilize proxy lists and send only a few requests from each IP address before moving on to the next. Using widely available open proxy lists at Web sites such as http://tools.rosinstrument.com/proxy/, an attacker could easily circumvent any IP blocking mechanism. Because most sites do not block after just one failed password, an attacker can use two or three attempts per proxy. An attacker with a list of 1,000 proxies can attempt 2,000 or 3,000 passwords without being blocked. Nevertheless, despite this method's weaknesses, Web sites that experience high numbers of attacks-adult Web sites in particular-do choose to block proxy IP addresses.&lt;br /&gt;
&lt;br /&gt;
One simple yet surprisingly effective solution is to design your Web site not to use predictable behavior for failed passwords. For example, most Web sites return an &amp;quot;HTTP 401 error&amp;quot; code with a password failure, although some web sites instead return an &amp;quot;HTTP 200 SUCCESS&amp;quot; code but direct the user to a page explaining the failed password attempt. This fools some automated systems, but it is also easy to circumvent. A better solution might be to vary the behavior enough to eventually discourage all but the most dedicated hackers. You could, for example, use different error messages each time or sometimes let a user through to a page and then prompt him again for a password.&lt;br /&gt;
&lt;br /&gt;
Some automated brute-force tools allow the attacker to set certain trigger strings to look for that indicate a failed password attempt. For example, if the resulting page contains the phrase &amp;quot;Bad username or password,&amp;quot; the tool would know the credentials failed and would try the next in the list. A simple way to fool these tools is to include also those phrases as comments in the HTML source of the page they get when they successfully authenticate.&lt;br /&gt;
&lt;br /&gt;
After one or two failed login attempts, you may want to prompt the user not only for the username and password but also to answer a secret question. This not only causes problems with automated attacks, it prevents an attacker from gaining access, even if they do get the username and password correct. You could also detect high numbers of attacks system-wide and under those conditions prompt all users for the answer to their secret questions.&lt;br /&gt;
&lt;br /&gt;
Other techniques you might want to consider are:&lt;br /&gt;
&lt;br /&gt;
:* For advanced users who want to protect their accounts from attack, give them the option to allow login only from certain IP addresses.&lt;br /&gt;
:*Assign unique login URLs to blocks of users so that not all users can access the site from the same URL.&lt;br /&gt;
:*Use a CAPTCHA to prevent automated attacks (see the sidebar &amp;quot;Using CAPTCHAs&amp;quot;).&lt;br /&gt;
:*Instead of completely locking out an account, place it in a lockdown mode with limited capabilities.&lt;br /&gt;
&lt;br /&gt;
Attackers can often circumvent many of these techniques by themselves, but by combining several techniques, you can significantly limit brute-force attacks. It might be difficult to stop an attacker who is determined to obtain a password specifically from your web site, but these techniques certainly can be effective against many attacks, including those from novice hackers. These techniques also require more work on the attacker's part, which gives you more opportunity to detect the attack and maybe even identify the attacker.&lt;br /&gt;
&lt;br /&gt;
Although brute-force attacks are difficult to stop completely, they are easy to detect because each failed login attempt records an HTTP 401 status code in your Web server logs. It is important to monitor your log files for brute-force attacks-in particular, the intermingled 200 status codes that mean the attacker found a valid password.&lt;br /&gt;
&lt;br /&gt;
Here are conditions that could indicate a brute-force attack or other account abuse:&lt;br /&gt;
&lt;br /&gt;
:*Many failed logins from the same IP address&lt;br /&gt;
:*Logins with multiple usernames from the same IP address&lt;br /&gt;
:*Logins for a single account coming from many different IP addresses&lt;br /&gt;
:*Excessive usage and bandwidth consumption from a single use&lt;br /&gt;
:*Failed login attempts from alphabetically sequential usernames or passwords&lt;br /&gt;
:*Logins with a referring URL of someone's mail or IRC client&lt;br /&gt;
:*Referring URLs that contain the username and password in the format http://user:password@www.example.com/login.htm&lt;br /&gt;
:*If protecting an adult Web site, referring URLs of known password-sharing sites&lt;br /&gt;
:*Logins with suspicious passwords hackers commonly use, such as ownsyou (ownzyou), washere (wazhere), zealots, hacksyou, and the like&lt;br /&gt;
&lt;br /&gt;
Brute force attacks are surprisingly difficult to stop completely, but with careful design and multiple countermeasures, you can limit your exposure to these attacks. Ultimately, the only best defense is to make sure that users follow basic rules for strong passwords: use long unpredictable passwords, avoid dictionary words, avoid reusing passwords, and change passwords regularly.&lt;br /&gt;
&lt;br /&gt;
==Sidebar: Using CAPTCHAS==&lt;br /&gt;
&lt;br /&gt;
A completely automated public Turing test to tell computers and humans apart, or CAPTCHA, is a program that allows you to distinguish between humans and computers. First widely used by Alta Vista to prevent automated search submissions, CAPTCHAs are particularly effective in stopping any kind of automated abuse, including brute-force attacks. They work by presenting some test that is easy for humans to pass but difficult for computers to pass; therefore, they can conclude with some certainty whether there is a human on the other end.&lt;br /&gt;
&lt;br /&gt;
For a CAPTCHA to be effective, humans must be able to answer the test correctly as close to 100 percent of the time as possible. Computers must fail as close to 100 percent of the time as possible. Ez-gimpy (www.captcha.net/cgi-bin/ez-gimpy), perhaps the most commonly used CAPTCHA, presents the user with an obscured word that the user must type to pass the test. But researchers have since written pattern recognition programs that solve ez-gimpy with 92 percent accuracy. Although these researchers have not made their programs public, all it takes is one person to do so to make ez-gimpy mostly ineffective. Researchers at Carnegie Mellon's School of Computer Science continually work to improve and introduce new CAPTCHAs (see www.captcha.net/captchas).&lt;br /&gt;
&lt;br /&gt;
If you are developing your own CAPTCHA, keep in mind that it is not how hard the question is that matters-it is how likely it is that a computer will get the correct answer. I once saw a CAPTCHA that presents the user with a picture of three zebras, with a multiple-choice question asking how many zebras were in the picture. To answer the question, you click one of three buttons. Although it would be very difficult for a computer program to both understand the question and interpret the picture, the program could just randomly guess any answer and get it correct 30 percent of the time. Although this might seem a satisfactory level of risk, it is by no means an effective CAPTCHA. If you run a free e-mail service and use a CAPTCHA such as this to prevent spammers from creating accounts in bulk, all they have to do is write a script to automatically create 1,000 accounts and expect on average that 333 of those attempts will be successful.&lt;br /&gt;
&lt;br /&gt;
Nevertheless, a simple CAPTCHA may still be effective against brute-force attacks. When you combine the chance of an attacker sending a correct username and password guess with the chance of guessing the CAPTCHA correctly, combined with other techniques described in this chapter, even a simple CAPTCHA could prove effective.&lt;br /&gt;
&lt;br /&gt;
===Figure 1: Password Authentication Delay: C#===&lt;br /&gt;
&lt;br /&gt;
 private void AuthenticateRequest(object obj, EventArgs ea)&lt;br /&gt;
  {&lt;br /&gt;
    HttpApplication objApp = (HttpApplication) obj;&lt;br /&gt;
    HttpContext objContext = (HttpContext) objApp.Context;  &lt;br /&gt;
    // If user identity is not blank, pause for a random amount of time&lt;br /&gt;
    if ( objApp.User.Identity.Name != &amp;quot;&amp;quot;)&lt;br /&gt;
      {&lt;br /&gt;
        Random rand = new Random();        &lt;br /&gt;
        Thread.Sleep(rand.Next(minSeconds, maxSeconds) * 1000);&lt;br /&gt;
      }      &lt;br /&gt;
  }&lt;br /&gt;
&lt;br /&gt;
===Figure 2: Password Authentication Delay: VB.NET===&lt;br /&gt;
&lt;br /&gt;
 Public Sub AuthenticateRequest(ByVal obj As Object, ByVal ea As System.EventArgs)&lt;br /&gt;
  Dim objApp As HttpApplication&lt;br /&gt;
  Dim objContext As HttpContext&lt;br /&gt;
  Dim ran As Random&lt;br /&gt;
  objApp = obj&lt;br /&gt;
  objContext = objApp.Context&lt;br /&gt;
 &lt;br /&gt;
  ' If user identity is not blank, pause for a random amount of time&lt;br /&gt;
  If objApp.User.Identity.Name &amp;lt;&amp;gt; &amp;quot;&amp;quot; Then&lt;br /&gt;
    ran = New Random&lt;br /&gt;
    Thread.Sleep(ran.Next(ran.Next(minSeconds, maxSeconds) * 1000))&lt;br /&gt;
  End If&lt;br /&gt;
 End Sub&lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Columns]]&lt;br /&gt;
[[Category: Control]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=180375</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=180375"/>
				<updated>2014-08-10T04:03:11Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Quick Download */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Main=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div style=&amp;quot;width:100%;height:160px;border:0,margin:0;overflow: hidden;&amp;quot;&amp;gt;[[File:OWASP_Project_Header.jpg|link=]]&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| style=&amp;quot;padding: 0;margin:0;margin-top:10px;text-align:left;&amp;quot; |-&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
==OWASP O2 Platform==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform is...&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. &lt;br /&gt;
O2 is designed to '''Automate Security Consultants Knowledge and Workflows''' and to '''Allow non-security experts to access and consume Security Knowledge'''&lt;br /&gt;
&lt;br /&gt;
==Description==&lt;br /&gt;
The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge.&lt;br /&gt;
&lt;br /&gt;
O2 can also be a very powerful prototyping and fast-development tool for .NET. For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Licensing==&lt;br /&gt;
OWASP O2 Platform is free to use. It is licensed under the Apache License, version 2.0.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;&amp;quot; |&lt;br /&gt;
&lt;br /&gt;
== What is O2 Platform? ==&lt;br /&gt;
&lt;br /&gt;
OWASP O2 Platform provides:&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 4.0&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
== Presentation ==&lt;br /&gt;
&lt;br /&gt;
== Project Leader ==&lt;br /&gt;
&lt;br /&gt;
[mailto:dinis.cruz@owasp.org Diniz Cruz]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Related Projects ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Ohloh ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
| valign=&amp;quot;top&amp;quot;  style=&amp;quot;padding-left:25px;width:200px;&amp;quot; | &lt;br /&gt;
&lt;br /&gt;
== Quick Download ==&lt;br /&gt;
'''Latest Release: April 2013 - v5.3''':  [http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=http://dl.bintray.com/o2-platform/Main-Exe/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
== Email List ==&lt;br /&gt;
&lt;br /&gt;
[https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News and Events ==&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;br /&gt;
&lt;br /&gt;
== In Print ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Classifications==&lt;br /&gt;
&lt;br /&gt;
   {| width=&amp;quot;200&amp;quot; cellpadding=&amp;quot;2&amp;quot;&lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot; rowspan=&amp;quot;2&amp;quot;| [[File:Midlevel projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-builders-small.png|link=]]  &lt;br /&gt;
   |-&lt;br /&gt;
   | align=&amp;quot;center&amp;quot; valign=&amp;quot;top&amp;quot; width=&amp;quot;50%&amp;quot;| [[File:Owasp-defenders-small.png|link=]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]&lt;br /&gt;
   |-&lt;br /&gt;
   | colspan=&amp;quot;2&amp;quot; align=&amp;quot;center&amp;quot;  | [[File:Project_Type_Files_CODE.jpg|link=]]&lt;br /&gt;
   |}&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=FAQs=&lt;br /&gt;
&lt;br /&gt;
; Q1&lt;br /&gt;
: A1&lt;br /&gt;
&lt;br /&gt;
; Q2&lt;br /&gt;
: A2&lt;br /&gt;
&lt;br /&gt;
= Acknowledgements =&lt;br /&gt;
==Volunteers==&lt;br /&gt;
O2 Platform is developed by a worldwide team of volunteers. The primary contributors to date have been:&lt;br /&gt;
&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
==Others==&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
= Road Map and Getting Involved =&lt;br /&gt;
As of July, the priorities are:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
Involvement in the development and promotion of O2 Platform is actively encouraged!&lt;br /&gt;
You do not have to be a security expert in order to contribute.&lt;br /&gt;
Some of the ways you can help:&lt;br /&gt;
* xxx&lt;br /&gt;
* xxx&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=Project About=&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}}   &lt;br /&gt;
&lt;br /&gt;
__NOTOC__ &amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172630</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172630"/>
				<updated>2014-04-14T13:46:58Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* OWASP Projects Task Force (Concept) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on OWASP Projects with a first focus on cleaning up the OWASP incubator list&lt;br /&gt;
&lt;br /&gt;
==Current To-do list==&lt;br /&gt;
&lt;br /&gt;
*  update this page so it has all the latest content&lt;br /&gt;
* &amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot;&lt;br /&gt;
* create a mailing list (in google groups) for this task force&lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWASP initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
# only existing members can send the invitations&lt;br /&gt;
# there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
# invitations are automatically approved in 24h &lt;br /&gt;
# existing members can VETO new members (and existing members can be kickout by majority)&lt;br /&gt;
# there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;br /&gt;
# all communication MUST be made (as much as practically possible) under public mediums: Wiki, public mailings, public Hangout sessions&lt;br /&gt;
# there are NO decisions made BEHIND closed doors, or without a solid digital (hyperlinkable) trail&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172629</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172629"/>
				<updated>2014-04-14T13:46:39Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* OWASP Projects Task Force (Concept) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on OWASP Projects with a first focus on cleaning up the OWASP incubator list&lt;br /&gt;
&lt;br /&gt;
==Current To-do list==&lt;br /&gt;
&lt;br /&gt;
*  update this page so it has all the latest content&lt;br /&gt;
* &amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot;&lt;br /&gt;
* create a mailing list (in google groups) for this task force&lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
# only existing members can send the invitations&lt;br /&gt;
# there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
# invitations are automatically approved in 24h &lt;br /&gt;
# existing members can VETO new members (and existing members can be kickout by majority)&lt;br /&gt;
# there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;br /&gt;
# all communication MUST be made (as much as practically possible) under public mediums: Wiki, public mailings, public Hangout sessions&lt;br /&gt;
# there are NO decisions made BEHIND closed doors, or without a solid digital (hyperlinkable) trail&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172628</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172628"/>
				<updated>2014-04-14T13:44:21Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* Current To-do list */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on OWASP Projects with a first focus on cleaning up the OWASP incubator list&lt;br /&gt;
&lt;br /&gt;
==Current To-do list==&lt;br /&gt;
&lt;br /&gt;
*  update this page so it has all the latest content&lt;br /&gt;
* &amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot;&lt;br /&gt;
* create a mailing list (in google groups) for this task force&lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;br /&gt;
# all communication MUST be made (as much as practically possible) under public mediums: Wiki, public mailings, public Hangout sessions&lt;br /&gt;
# there are NO decisions made BEHIND closed doors, or without a solid digital (hyperlinkable) trail&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172627</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172627"/>
				<updated>2014-04-14T13:40:16Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* OWASP Projects Task Force (Concept) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on OWASP Projects with a first focus on cleaning up the OWASP incubator list&lt;br /&gt;
&lt;br /&gt;
==Current To-do list==&lt;br /&gt;
&lt;br /&gt;
*  update this page so it has all the latest content&lt;br /&gt;
* &amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;br /&gt;
# all communication MUST be made (as much as practically possible) under public mediums: Wiki, public mailings, public Hangout sessions&lt;br /&gt;
# there are NO decisions made BEHIND closed doors, or without a solid digital (hyperlinkable) trail&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172626</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172626"/>
				<updated>2014-04-14T13:37:36Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on OWASP Projects with a first focus on cleaning up the OWASP incubator list&lt;br /&gt;
&lt;br /&gt;
==Current To-do list==&lt;br /&gt;
&lt;br /&gt;
*  update this page so it has all the latest content&lt;br /&gt;
* &amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172625</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172625"/>
				<updated>2014-04-14T13:35:58Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on cleaning up the OWASP Projects namely on:&lt;br /&gt;
&lt;br /&gt;
&amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel (invitation accepted)&lt;br /&gt;
* Samantha Groves (invitation pending)&lt;br /&gt;
* Chuck (invitation pending)&lt;br /&gt;
* Dinis Cruz (invitation accepted)&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172624</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172624"/>
				<updated>2014-04-14T13:35:04Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on cleaning up the OWASP Projects namely on:&lt;br /&gt;
&lt;br /&gt;
&amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
* join this Task Force&lt;br /&gt;
* create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel&lt;br /&gt;
* Samantha Groves&lt;br /&gt;
* Chuck&lt;br /&gt;
* Dinis Cruz&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172623</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172623"/>
				<updated>2014-04-14T13:34:23Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on cleaning up the OWASP Projects namely on:&lt;br /&gt;
&lt;br /&gt;
&amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
==Execution Power==&lt;br /&gt;
&lt;br /&gt;
This task force exists on the assumption that it has a mandate from the OWASP leaders to act on behalf of the OWASP community on what is best for OWASP Projects. &lt;br /&gt;
&lt;br /&gt;
If somebody (namely an OWASP Leader or Board member) disagree with any of the decisions made, he/she has two options:&lt;br /&gt;
&lt;br /&gt;
a) join this Task Force&lt;br /&gt;
b) create another equivalent 'OWASP Projects group' and do a better job there&lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel&lt;br /&gt;
* Samantha Groves&lt;br /&gt;
* Chuck&lt;br /&gt;
* Dinis Cruz&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group' (to join the task force, requests should be made directly with existing task force members)&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172622</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172622"/>
				<updated>2014-04-14T13:31:40Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* OWASP Projects Task Force (Concept) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on cleaning up the OWASP Projects namely on:&lt;br /&gt;
&lt;br /&gt;
&amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel&lt;br /&gt;
* Samantha Groves&lt;br /&gt;
* Chuck&lt;br /&gt;
* Dinis Cruz&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
#  this 'task force is an invitation-only group'&lt;br /&gt;
# all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
#  only existing members can send the invitations&lt;br /&gt;
#  there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
#  invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
#  there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172621</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172621"/>
				<updated>2014-04-14T13:31:18Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This task force is focused on cleaning up the OWASP Projects namely on:&lt;br /&gt;
&lt;br /&gt;
&amp;quot;...send last warning and clean up of incubator projects that have not been updated in more than a year, especially without a first release. we give a chance to react otherwise they get set to inactive projects and the wiki starts to clear up...&amp;quot; &lt;br /&gt;
&lt;br /&gt;
==Current Members==&lt;br /&gt;
&lt;br /&gt;
* Johanna Curiel&lt;br /&gt;
* Samantha Groves&lt;br /&gt;
* Chuck&lt;br /&gt;
* Dinis Cruz&lt;br /&gt;
&lt;br /&gt;
==OWASP Projects Task Force (Concept)==&lt;br /&gt;
&lt;br /&gt;
This is a new type of OWAPS initiative, focused on 'getting things done', the concept is still evolving but here are the current (in draft) guiding principles:&lt;br /&gt;
&lt;br /&gt;
1.  this 'task force is an invitation-only group'&lt;br /&gt;
2. all existing members have VETO power, and it is assumed that all decisions are backed up with all existing members&lt;br /&gt;
2. only existing members can send the invitations&lt;br /&gt;
3. there is a 1 month minimum activity required (or the member is temporarily out). &lt;br /&gt;
4. invitations are automatically approved (since all members of the task force are admins of the group)&lt;br /&gt;
5. there an one special member who has veto power the responsibility to enforce the 'one month contribution MIA scenario' (i.e. to kick out the 'non contributing members')&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172620</id>
		<title>Task Force/OWASP Projects</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=Task_Force/OWASP_Projects&amp;diff=172620"/>
				<updated>2014-04-14T13:25:15Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;Hello Johanna :)&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hello Johanna :)&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=O2_Platform/Community&amp;diff=162691</id>
		<title>O2 Platform/Community</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=O2_Platform/Community&amp;diff=162691"/>
				<updated>2013-11-06T15:59:58Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* News */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;noinclude&amp;gt;[[O2|back to O2 Platform Home Page]]&amp;lt;/noinclude&amp;gt;&lt;br /&gt;
==O2-Platform.com website (external to owasp)== &lt;br /&gt;
&lt;br /&gt;
For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
=== Mailing list===&lt;br /&gt;
The best place to keep updated with the lastest news and developers it to subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News ==&lt;br /&gt;
'''Latest News:'''&lt;br /&gt;
* 2013/Nov/8 : Webinar &amp;quot;Using the O2 Platform to Automate Application Security Knowledge and Workflows&amp;quot;&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=O2_Platform/Community&amp;diff=162690</id>
		<title>O2 Platform/Community</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=O2_Platform/Community&amp;diff=162690"/>
				<updated>2013-11-06T15:59:08Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: /* O2-Platform.com website (external to owasp) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;noinclude&amp;gt;[[O2|back to O2 Platform Home Page]]&amp;lt;/noinclude&amp;gt;&lt;br /&gt;
==O2-Platform.com website (external to owasp)== &lt;br /&gt;
&lt;br /&gt;
For more details on the O2 Platform see  http://o2platform.wordpress.com website which currently being used to host the help files and documentation pages. &lt;br /&gt;
&lt;br /&gt;
=== Mailing list===&lt;br /&gt;
The best place to keep updated with the lastest news and developers it to subscribe to the [https://groups.google.com/a/owasp.org/forum/#!forum/o2-platform OWASP O2 Platform Mailing list]&lt;br /&gt;
&lt;br /&gt;
== News ==&lt;br /&gt;
'''Latest News:'''&lt;br /&gt;
* 2013/Jul/20: Released version 5.3 of the [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform main GUI] &lt;br /&gt;
* 2013/Feb/8 : Released version 5.1 of the [http://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.1.exe O2 Platform main GUI]&lt;br /&gt;
* 2013/Feb/8 : Helped [[UK]] Chapters to visualize its locations: [http://blog.diniscruz.com/2013/02/o2-script-to-create-google-static-map.html O2 Script to create Google Static map with OWASP UK Chapter locations]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=162689</id>
		<title>OWASP O2 Platform</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=OWASP_O2_Platform&amp;diff=162689"/>
				<updated>2013-11-06T15:57:31Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Main =&lt;br /&gt;
{{:O2_Platform/Main}}&lt;br /&gt;
&lt;br /&gt;
= Downloads =&lt;br /&gt;
{{:O2_Platform/Download}}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;!--= Screenshots =&lt;br /&gt;
{{:O2_Platform/Screenshots}}--&amp;gt;&lt;br /&gt;
&lt;br /&gt;
= Community =&lt;br /&gt;
{{:O2_Platform/Community}}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Project About =&lt;br /&gt;
{{:Projects/OWASP O2 Platform Project | Project About}} &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;categorytree mode=pages&amp;gt;Manual&amp;lt;/categorytree&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;headertabs /&amp;gt; &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Category:OWASP_O2_Platform|O2 Platform]]&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=O2_Platform/Screenshots&amp;diff=162675</id>
		<title>O2 Platform/Screenshots</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=O2_Platform/Screenshots&amp;diff=162675"/>
				<updated>2013-11-06T14:17:30Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: Created page with &amp;quot;This page has some screenshots&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This page has some screenshots&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	<entry>
		<id>https://wiki.owasp.org/index.php?title=O2_Platform/Download&amp;diff=162674</id>
		<title>O2 Platform/Download</title>
		<link rel="alternate" type="text/html" href="https://wiki.owasp.org/index.php?title=O2_Platform/Download&amp;diff=162674"/>
				<updated>2013-11-06T14:16:51Z</updated>
		
		<summary type="html">&lt;p&gt;Dinis.cruz: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Latest Release: April 2013 - v5.3''':  [https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe O2 Platform - Main O2 Gui] - this is a '''Windows Stand-Alone exe''' which will create a number of folders on first load (dependencies and temp files)&lt;br /&gt;
&lt;br /&gt;
[[Image:O2Download_Button_6_22_2010_7_07_03_PM_tmp9E0.jpg| link=https://o2platform.googlecode.com/files/O2%20Platform%20-%20Main%20O2%20Gui%20v5.3.exe]]&lt;br /&gt;
&lt;br /&gt;
'''Requirements:'': Windows and .NET Framework 4.0&lt;br /&gt;
&lt;br /&gt;
'''Source code''': The source code for the O2 Platform is available for download at GitHub:&lt;br /&gt;
&lt;br /&gt;
'''Git Hub repositories'''&lt;br /&gt;
* FluentSharp: https://github.com/o2platform/O2.FluentSharp&lt;br /&gt;
* O2 Platform Scripts: https://github.com/o2platform/O2.Platform.Scripts&lt;br /&gt;
* O2 Platform Projects: https://github.com/o2platform/O2.Platform.Projects&lt;br /&gt;
* Misc and Legacy projects: https://github.com/o2platform/O2.Platform.Projects.Misc_and_Legacy&lt;br /&gt;
&lt;br /&gt;
...&lt;/div&gt;</summary>
		<author><name>Dinis.cruz</name></author>	</entry>

	</feed>