OWASP - User contributions [en]

Application Security Program Quick Start Guide

2014-12-15T17:50:47Z

Rsnake: /* The Application Security Program Quick Start Guide */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

=== Preface ===

This guide is intended to be a short, straightforward introductory guide to standing-up or improving an Application Security Program1. The intended goal of the AppSec program is to implement measures throughout the code’s life-cycle to prevent gaps in the application security policy or the underlying system through flaws in the design, development, deployment, upgrade, or maintenance of the application.

The application security program should effectively manage the security of its application systems, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality and availability.

A fundamental component of this improved application security management is the ability to demonstrate acceptable levels of risk based on defined KPIs, including but limited to:
#The number of vulnerabilities present in an application
#The time to fix vulnerabilities
#The remediation rate of vulnerabilities
#The time vulnerabilities remain open

The application security program deliverables include a holistic view of the state of security for each application, identifying the risks associated with the application and the countermeasures implemented to mitigate those risks, explaining how security is implemented, planning for system downtimes and emergencies, and providing a formal plan to improve the security in one or more of these areas.

=== Audience ===
The intended audience of this document is anyone from security engineers, developers, program managers, senior managers or a senior executive. This guide should be considered the start of a comprehensive approach, it is intended to give the basic questions and answers that should be asked by those who are in charge of the application security program in your organization, this includes those responsible for managing the risk of the entire organization.

== [[Day 1]] ==
''''' **Key Activities: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development

== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Conclusion ==
Setting up an effective application security program does require commitment from all elements of the business, and a clear understanding of what resources need to be protected and what level of risk is acceptable. However, given that information, setting up an application security program need not be confusing, difficult, or complex. The keys to success involve planning, making key financial decisions, ensuring all roles and responsibilities are clearly assigned and that all stakeholders within the organization know what to expect.

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-15T17:50:08Z

Rsnake: /* The Application Security Program Quick Start Guide */

Application Security Program Quick Start Guide

2014-12-15T17:49:19Z

Rsnake: /* The Application Security Program Quick Start Guide */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

=== Preface ===

This guide is intended to be a short, straightforward introductory guide to standing-up or improving an Application Security Program1. The intended goal of the AppSec program is to implement measures throughout the code’s life-cycle to prevent gaps in the application security policy or the underlying system through flaws in the design, development, deployment, upgrade, or maintenance of the application.

The application security program should effectively manage the security of its application systems, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality and availability.

A fundamental component of this improved application security management is the ability to demonstrate acceptable levels of risk based on defined KPIs, including but limited to:
#The number of vulnerabilities present in an application
#The time to fix vulnerabilities
#The remediation rate of vulnerabilities
#The time vulnerabilities remain open

The application security program deliverables include a holistic view of the state of security for each application, identifying the risks associated with the application and the countermeasures implemented to mitigate those risks, explaining how security is implemented, planning for system downtimes and emergencies, and providing a formal plan to improve the security in one or more of these areas.

=== Audience ===
The intended audience of this document is anyone from security engineers, developers, program managers, senior managers or a senior executive. This guide should be considered the start of a comprehensive approach, it is intended to give the basic questions and answers that should be asked by those who are in charge of the application security program in your organization, this includes those responsible for managing the risk of the entire organization.

== [[Day 1]] ==
''''' **Key Activities: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development

== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-15T17:48:55Z

Rsnake: /* Contents */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

=== Preface ===

This guide is intended to be a short, straightforward introductory guide to standing-up or improving an Application Security Program1. The intended goal of the AppSec program is to implement measures throughout the code’s life-cycle to prevent gaps in the application security policy or the underlying system through flaws in the design, development, deployment, upgrade, or maintenance of the application.

The application security program should effectively manage the security of its application systems, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality and availability.

A fundamental component of this improved application security management is the ability to demonstrate acceptable levels of risk based on defined KPIs, including but limited to:
#The number of vulnerabilities present in an application
#The time to fix vulnerabilities
#The remediation rate of vulnerabilities
#The time vulnerabilities remain open

The application security program deliverables include a holistic view of the state of security for each application, identifying the risks associated with the application and the countermeasures implemented to mitigate those risks, explaining how security is implemented, planning for system downtimes and emergencies, and providing a formal plan to improve the security in one or more of these areas.

=== Audience ===
The intended audience of this document is anyone from security engineers, developers, program managers, senior managers or a senior executive. This guide should be considered the start of a comprehensive approach, it is intended to give the basic questions and answers that should be asked by those who are in charge of the application security program in your organization, this includes those responsible for managing the risk of the entire organization.

== [[Day 1]] ==
''''' **Key Activities: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development

== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-15T17:46:02Z

Rsnake: /* Day 1 */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

== [[Day 1]] ==
''''' **Key Activities: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development

== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-15T17:45:07Z

Rsnake: /* Day 1 */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

== [[Day 1]] ==
*Evaluation
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development

== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Day 1

2014-12-15T17:44:24Z

Rsnake: Created page with "== Key Activities == === Evaluation === *Dedicate time to understanding the “lay of the land” and the key players, along with their objectives and motivations. *Spend time..."

== Key Activities ==
=== Evaluation ===
*Dedicate time to understanding the “lay of the land” and the key players, along with their objectives and motivations.
*Spend time with the parts of the organization that you are least familiar with.
*Identify the security mandate as defined by the business/management.
*Identify how IT Operations align with the security mandate.
*Be alert to your existing biases.

== Key Questions ==

=== Management ===
'''''Has the business defined an internal security mandate?'''''
Business drivers may originate from legal or industry compliance obligations, internal policy, or customer or partner
requirements. All actions and activities in the Application Security program should tie back to specific business
obligations. If there is no business mandate, a case must be made to the business that an application security program is necessary. There are a number of industry statistical reports and benchmarks available that address what other, similar organizations have implemented and why.

'''''What are the current and planned human and financial resources dedicated to Application Security?'''''
If resources are currently dedicated to ensuring the integrity of applications, examine the current allocation of those resources against their outcomes. The goal is to ensure that in a world of limited resources, each activity is measured for actual efficacy.

If there are few or no resources allocated to ensuring the integrity of applications, the case must be made by
leveraging data relevant to the organization that can be quantified in financial terms. Building a formal business case is the most effective way to approach the problem. The case must address the needs as they apply to existing business objectives. This is not the time for expounding on the virtues of security. You must translate the business benefit of reallocating financial resources. Simply asking for X number of dollars to reduce Y number of vulnerabilities is typically ineffective.

'''''What are the IT & Business priorities?'''''
IT is both an enabler and supporter of the business. Security is no different in this respect; however, it has the added challenge of needing to be transparent where it can be, and be a part of the ordinary workflow, or be perceived as a roadblock. Once the business priorities have been identified, the application security goals must be aligned with
those priorities. If the business priorities are to release new functionality at a rapid pace, then application testing must keep pace; if the priorities are to maintain the user experience over a long period of time, a pplication testing must be rigorous before the user is ever exposed to the application.

=== Security ===
'''''What is the overall security budget and the priorities of that budget?'''''
'''''What percentage of that budget is allocated to Application Security?'''''
Most departments will feel under budget to some degree. Examine the overall security budget (including cyberinsurance
budget if possible, as it likely falls outside of the security budget) to understand what receives financial priority and how the Application Security program could benefit from those activities. If there is significant spend on security infrastructure, ensure that they are leveraging controls to protect applications -- for example, alerting on the lack or improper use of security headers.

'''''Which of your assets are most frequently attacked?'''''
Not all attacks are equal, and not all attacks are opportunistic. Careful examination of attack frequency and velocity
can identify the assets requiring additional testing to ensure resiliency. Often, low(er) priority assets will be targeted for exploitation as they tend not be as resilient to attacks.

'''''What security tools and/or services do you as a company currently own/use?'''''
Query other parts of the security organization to understand what tools and services they already have access to. Software and services are often bundled in contracts but not used as they were not the primary purpose for purchase.
If the QA team already has access to security tools that were bundled as part of their QA software acquisition there are opportunities to leverage that existing financial commitment and even allow for native integration.

=== IT Operations ===
'''''What are your assets?'''''
Include assets you own and assets hosted or owned by third parties. Unknown or unmanaged assets cannot be protected. It is also difficult to fix issues if the person or team responsible for those assets is unknown. Developing an accurate and update-to-date asset inventory can be challenging, however, for the purpose of this exercise we will be focusing on web-based assets. The narrowed scope can be aggressively targeted and maintained.

'''''How are web assets isolated and distributed throughout the infrastructure?'''''
If an attacker were able to compromise a machine (say a webserver, or a database server) what would prevent them from pivoting and hacking into other nearby machines? Are they physically isolated, logically isolated, or do they share similar credentials, etc?

'''''How frequently do you perform network and server vulnerability scans?'''''
Addressing web application vulnerabilities on a server that never patches its operating system is a waste of resources. Understand how often infrastructure is assessed and patched – this should match or exceed the pac e of attack frequency.

'''''What is your tolerance around production safety?'''''
Some environments are more sensitive to production testing, as there is always some likelihood of impact; the goal is to get the likelihood of impact as close to zero as possible. As the likelihood of impact approaches zero, the frequency of testing should be increased. Ultimately, production systems are the primary targets of our adversaries – they should be tested as often as possible; at a minimum, at least as frequently as the application itself is changed or updated.

=== Engineering Groups (including QA and Software Development) ===
'''''According to the software development group’s understanding of the current processes, whose responsibility is application security?'''''
Security lives in our corporate cultures and psyche. Developers are ultimately responsible for their code; understand
whether they also believe they are responsible for the integrity of that code. Security is not the sole responsibility of either the developer community or the security department. Foster a healthy environment of mutual responsibility and accountability from all stakeholders. Begin by sharing information in a non-aggressive manner.

'''''Where does Security fit into the software development lifecycle?'''''
If a development lifecycle does not exist, the first priority is to demonstrate the business value of having a defined process. Most organizations will have some process in place, even if it is an immature one. The absence of a development process could also prove to be an opportunity to ensure security is built into a process from the start.

Roughly, the steps to building or updating software can be generalized as:
#Planning / Analysis
#Design
#Implementation
#Testing
#Maintain
#Decommission

Let’s break down each step and discuss basic security activities that are often considered to reduce risk.

'''Planning / Analysis:''' Ensure business analysts and stakeholders have considered and can detail the security needs and risk tolerance of an application. This may reference internal data classification policies to describe the data sensitivity. Threat modeling may also help clarify the potential threat agents who may be motivated to attack the proposed application.

'''Design:''' A security architecture review may reveal security design flaws in key areas such as authentication, access control, or separation of concerns, and of course may identify missing categorical security controls.

'''Implementation:''' The implementation process normally consists of the coding and development of the overall architecture design formulated in the previous phase. Developers should be receiving continuous security feedback to ensure all security issues are being identified and mitigated in conformance with the organization’s risk tolerance.

'''Testing:''' Testing should include security tests as well as functional tests. Areas of concentration should be on vulnerabilities that would not have been uncovered during the implementation phase, such as business logic vulnerabilities.

'''Maintenance:''' Once the application is promoted to production, continuous testing of security issues should be ongoing throughout the life of the application. As vulnerability vectors and attacks evolve, the application should be tested to ensure defensibility against these new attacks.

'''''How are software defects documented, trended, and prioritized?'''''
The key to adoption of an Application Security program is alignment with and transparency to current workflows. Identify how application defects are documented, trended and prioritized, and plan to insert the application security defects into these existing documents and processes.

'''''Are developers encouraged to develop secure code?'''''
Positive incentive programs foster ownership and accountability for output. Corporate culture varies from each organization; tapping into that culture to offer incentives for producing rugged code will create a natural momentum for finding and fixing security issues. Some cultures will value access to otherwise less accessible personnel, such as lunch with the CTO; others will be motivated by gifts that they might not have purchased for themselves, such as a robotics kit. Take the time to understand the culture of your organization and tap into the inherent desire most people have to be rewarded. Remember that money does not motivate everyone, and can even be demotivating in some cases.

'''''Are abuse and misuse cases part of test scripts?'''''
Test scripts are often developed for the sole purpose of ensuring the application performs the intended functionality.
Introduce test scripts that could identify the misuse of intended functionality, such as the ability to execute similar functionality a user should not be able to access.

'''''Is everyone in the organization expected to have general software security knowledge or is there a team/individual
tasked with being the "Security Deputy"?''''
Security deputy programs are a good approach to disseminating application security information to non-security
focused departments; they also have the added bonus of fostering a two-way relationship.

Implement a deputy program that:
*is focused on the goals of the application developers and application security testers
*is aimed at achieving results beyond simple security awareness
*can address the points throughout the development cycle where vulnerabilities are introduced – at the time the code is written

Day 2

2014-12-15T17:28:40Z

Rsnake:

== Key Activities ==
*Become intimately familiar with what you are meant to protect and at what level.
*Define processes, procedures, and checklists to align assessment strategies to business needs.
*Effectively communicate the introduction and goals of the Application Security assessment program.
*Provide a single point of contact for the program.

== Asset Discovery ==
*Gather Internal, External and Hosted IP ranges.
*Catalogue known domains and subdomains.
*Identify asset meta-data locations. (CMDBs, GRCs, etc.).
*Identify site owners, where those are not already known.
*Gather assessment credentials, including multiple roles for horizontal and vertical testing.
*Identify the rate of application change (e.g. monthly, weekly, etc.…)

== Asset Risk Prioritization ==
*Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
impact to confidentiality, integrity and availability (C.I.A.). (See: [http://csrc.nist.gov/publications/fips/fips199/FIPSPUB-199-final.pdf])

POTENTIAL IMPACT

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!SECURITY OBJECTIVE
!LOW
!MODERATE
!HIGH
|-
|Confidentiality
Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
|The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Integrity
Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation
and authenticity. [44 U.S.C., SEC. 3542]
|The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Availability
Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
|The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|}

*Map asset criticality against attacker profiles with use of a GRC (Governance Risk Management and Compliance) tool if available, or using an information asset register such as the University of Oxford Information Asset Register Tool

For example:
#Tier 1 = Targeted Govt./State sponsor.
#Tier 2 = Hactivism
#Tier 3 = Random Opportunistic

*Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

== Communication Plan ==
*Set expectations of assessment program for all interested parties.
*Alert Operations team of upcoming activities.
*Gather written buy-in from application stakeholders for the assessment activities.
*Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and guidelines and enforce these in compliance with relevant global regulations and standards.
*Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

Day 2

2014-12-15T17:28:08Z

Rsnake:

== Key Activities ==
*Become intimately familiar with what you are meant to protect and at what level.
*Define processes, procedures, and checklists to align assessment strategies to business needs.
*Effectively communicate the introduction and goals of the Application Security assessment program.
*Provide a single point of contact for the program.

== Asset Discovery ==
*Gather Internal, External and Hosted IP ranges.
*Catalogue known domains and subdomains.
*Identify asset meta-data locations. (CMDBs, GRCs, etc.).
*Identify site owners, where those are not already known.
*Gather assessment credentials, including multiple roles for horizontal and vertical testing.
*Identify the rate of application change (e.g. monthly, weekly, etc.…)

== Asset Risk Prioritization ==
*Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
impact to confidentiality, integrity and availability (C.I.A.). (See: [http://csrc.nist.gov/publications/fips/fips199/FIPSPUB-199-final.pdf])

POTENTIAL IMPACT

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!SECURITY OBJECTIVE
!LOW
!MODERATE
!HIGH
|-
|Confidentiality
Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
|The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Integrity
Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation
and authenticity. [44 U.S.C., SEC. 3542]
|The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Availability
Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
|The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|}

*Map asset criticality against attacker profiles with use of a GRC (Governance Risk Management and Compliance) tool if available, or using an information asset register such as the University of Oxford Information Asset Register Tool

For example:
**Tier 1 = Targeted Govt./State sponsor.
**Tier 2 = Hactivism
**Tier 3 = Random Opportunistic

*Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

== Communication Plan ==
*Set expectations of assessment program for all interested parties.
*Alert Operations team of upcoming activities.
*Gather written buy-in from application stakeholders for the assessment activities.
*Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and guidelines and enforce these in compliance with relevant global regulations and standards.
*Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

Day 2

2014-12-15T17:27:51Z

Rsnake:

== Key Activities ==
*Become intimately familiar with what you are meant to protect and at what level.
*Define processes, procedures, and checklists to align assessment strategies to business needs.
*Effectively communicate the introduction and goals of the Application Security assessment program.
*Provide a single point of contact for the program.

== Asset Discovery ==
*Gather Internal, External and Hosted IP ranges.
*Catalogue known domains and subdomains.
*Identify asset meta-data locations. (CMDBs, GRCs, etc.).
*Identify site owners, where those are not already known.
*Gather assessment credentials, including multiple roles for horizontal and vertical testing.
*Identify the rate of application change (e.g. monthly, weekly, etc.…)

== Asset Risk Prioritization ==
*Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
impact to confidentiality, integrity and availability (C.I.A.). (See: [http://csrc.nist.gov/publications/fips/fips199/FIPSPUB-199-final.pdf])

POTENTIAL IMPACT

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!SECURITY OBJECTIVE
!LOW
!MODERATE
!HIGH
|-
|Confidentiality
Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
|The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Integrity
Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation
and authenticity. [44 U.S.C., SEC. 3542]
|The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Availability
Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
|The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|}

*Map asset criticality against attacker profiles with use of a GRC* (Governance Risk Management and Compliance) tool if available, or using an information asset register such as the University of Oxford Information Asset Register Tool

For example:
**Tier 1 = Targeted Govt./State sponsor.
**Tier 2 = Hactivism
**Tier 3 = Random Opportunistic

*Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

== Communication Plan ==
*Set expectations of assessment program for all interested parties.
*Alert Operations team of upcoming activities.
*Gather written buy-in from application stakeholders for the assessment activities.
*Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and guidelines and enforce these in compliance with relevant global regulations and standards.
*Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

Day 2

2014-12-15T17:26:18Z

Rsnake: Created page with "== Key Activities == *Become intimately familiar with what you are meant to protect and at what level. *Define processes, procedures, and checklists to align assessment strate..."

== Key Activities ==
*Become intimately familiar with what you are meant to protect and at what level.
*Define processes, procedures, and checklists to align assessment strategies to business needs.
*Effectively communicate the introduction and goals of the Application Security assessment program.
*Provide a single point of contact for the program.

== Asset Discovery ==
*Gather Internal, External and Hosted IP ranges.
*Catalogue known domains and subdomains.
*Identify asset meta-data locations. (CMDBs, GRCs, etc.).
*Identify site owners, where those are not already known.
*Gather assessment credentials, including multiple roles for horizontal and vertical testing.
*Identify the rate of application change (e.g. monthly, weekly, etc.…)

== Asset Risk Prioritization ==
*Develop or leverage existing methodology for stack ranking the value of your assets to the business based on
impact to confidentiality, integrity and availability (C.I.A.). (See: [http://csrc.nist.gov/publications/fips/fips199/FIPSPUB-199-final.pdf])

POTENTIAL IMPACT

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!SECURITY OBJECTIVE
!LOW
!MODERATE
!HIGH
|-
|Confidentiality
Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
|The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Integrity
Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation
and authenticity. [44 U.S.C., SEC. 3542]
|The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
|The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|-
|Availability
Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
|The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
|The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
|}

*Map asset criticality against attacker profiles with use of a GRC* (Governance Risk Management and Compliance)
tool if available, or using an information asset register such as the University of Oxford Information Asset Register
Tool

For example:
*Tier 1 = Targeted Govt./State sponsor.
*Tier 2 = Hactivism
*Tier 3 = Random Opportunistic

*Implement ISO 17799: Asset Management or similar standard to improve governance of application assets.

== Communication Plan ==
*Set expectations of assessment program for all interested parties.
*Alert Operations team of upcoming activities.
*Gather written buy-in from application stakeholders for the assessment activities.
*Develop, publish, and maintain comprehensive application security and privacy standards, policies, procedures and
guidelines and enforce these in compliance with relevant global regulations and standards.
*Define, document and share application business continuity and incident response plan. (Business Continuity Plan Resources: ITIL, COBIT, NIST)

Day 3

2014-12-15T17:18:16Z

Rsnake: Created page with "== Key Activities == *Measure current vulnerability posture. *Initiate vulnerability testing. *Triage vulnerabilities. == Vulnerability Assessments == To determine what sor..."

== Key Activities ==
*Measure current vulnerability posture.
*Initiate vulnerability testing.
*Triage vulnerabilities.

== Vulnerability Assessments ==
To determine what sort of vulnerability assessment is most appropriate, consider your current status and resources:

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!Scenario
!Appropriate Assessments
|-
|Resources and support for immediate unlimited continuous assessments
|Perform assessments across all discovered assets
|-
|Limited resources or appetite for unlimited continuous assessments
|At a minimum frequency of testing should keep or exceed rate of change in asset
|-
|Application currently exist in production environment:
|Begin dynamic* assessments for these existing applications
|-
|Source Code of your application(s) is available on the internet (Freely available, stolen, etc.)
|Begin Static Analysis assessments
|-
|Business is subject to compliance mandate requiring Static Analysis
|Begin Static Analysis assessments
|-
|New development project of an application Begin Static Analysis assessments
|Dynamic assessments completed and application security program in continuous improvement cycle
|-
|Begin Static Analysis assessments
|Begin Dynamic Analysis in QA/Staging
|}

Other scenarios to consider Static Analysis as the first assessment type or in parallel with Dynamic Analysis:
*High developer attrition rate
*Known internal bad actors
*Disgruntled current or former employee with access to source code
*Outsourced code

== Static Analysis ==
Static Code Analysis (also known as Source Code Analysis or Static Application Security Testing (SAST)) is usually performed as part of a Code Review (also known as white-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code by using techniques such as Taint Analysis and Data Flow Analysis.

== Dynamic Analysis ==
Dynamic Application Security Testing (DAST), also referred to as “black-box” testing, identifies vulnerabilities in running web applications – testing of the application from the outside in.

== Vulnerability delivery ==
To deliver valuable vulnerability information to your business, you must:
*Document vulnerability delegation and vulnerability lifecycle process
*Feed issues into existing tracking systems where possible to preserve the existing workflow
*Triage vulnerabilities prior to feeding them into your defect management systems
*Ensure only true positives are fed to development teams
*Track re-testing of vulnerabilities via new incident/ticket or update existing incident/ticket.
*Define which issues are important to the business
*Create a baseline of the issues that are important to the business
*Align vulnerability remediation strategy with loss exposure versus resources available to fix
*Create a knowledge base of common issues and their solutions
*Dedicate resource(s) to developer interactions, including educating developers on security topics
*Publish aggregate metrics internally
*Match or outpace release cycles in detecting and responding to vulnerabilities.

Day 4

2014-12-12T16:29:15Z

Rsnake:

= Key Activities ==
*Measure and improve assessment service delivery.

== Measured Metrics ==
* Compare against industry metrics and interdepartmental metrics.
* Compare behaviors to measured metrics to identify which initiatives drive improvement of metrics and security program.
== Metric Definition ==

{| class="wikitable" style="color:black; background-color:#C1D9DD;" cellpadding="10"
!Metric
!Definition
|-
|Number of Vulnerabilities
|The total count of vulnerabilities during the analysis period; valuable as a metric over time. Time Open This value represents the number of partial days since the vulnerability was opened as of the specific evaluation date. It only includes open vulnerabilities and not vulnerabilities that were closed. It is computed as the evaluation date less the open date for the vulnerability.
|-
|Time-to-Fix
|The Time-to-Fix is the number of partial days required to close a vulnerability. It is based on the vulnerabilities that were closed during the analysis period.
|-
|Remediation Rate
|The Remediation Rate is the ratio of the number of vulnerabilities closed over the number of vulnerabilities opened over a given period of time. A vulnerability is considered closed if it closed during the analysis period. A vulnerability is considered open if it was open at some time during the analysis period. Therefore, vulnerability could be counted as open and closed.
|-
|Vulnerability Class
|Likelihood Vulnerability Class Likelihood is the percentage of active applications that have at least one open vulnerability in a given vulnerability class over a given period of time. It is determined by counting the number of applications that have at least one open vulnerability in a given vulnerability class over the number of active applications.
|}

Day 4

2014-12-12T16:25:10Z

Rsnake: Created page with "= Key Activities == *Measure and improve assessment service delivery. == Measured Metrics == * Compare against industry metrics and interdepartmental metrics. * Compare behav..."

= Key Activities ==
*Measure and improve assessment service delivery.

== Measured Metrics ==
* Compare against industry metrics and interdepartmental metrics.
* Compare behaviors to measured metrics to identify which initiatives drive improvement of metrics and security program.
== Metric Definition ==

{| class="wikitable" style="color:black; background-color:#000011;" cellpadding="10"
|Number of Vulnerabilities
|The total count of vulnerabilities during the analysis period; valuable as a metric over time. Time Open This value represents the number of partial days since the vulnerability was opened as of the specific evaluation date. It only includes open vulnerabilities and not vulnerabilities that were closed. It is computed as the evaluation date less the open date for the vulnerability.
|-
|Time-to-Fix
|The Time-to-Fix is the number of partial days required to close a vulnerability. It is based on the vulnerabilities that were closed during the analysis period.
|-
|Remediation Rate
|The Remediation Rate is the ratio of the number of vulnerabilities closed over the number of vulnerabilities opened over a given period of time. A vulnerability is considered closed if it closed during the analysis period. A vulnerability is considered open if it was open at some time during the analysis period. Therefore, vulnerability could be counted as open and closed.
|-
|Vulnerability Class
|Likelihood Vulnerability Class Likelihood is the percentage of active applications that have at least one open vulnerability in a given vulnerability class over a given period of time. It is determined by counting the number of applications that have at least one open vulnerability in a given vulnerability class over the number of active applications.
|}

Day 5

2014-12-12T16:20:26Z

Rsnake:

== Key activities ==
*Implement compensating controls & mitigation controls
*Remediation Prioritization

== Compensating Controls ==
*Implement compensating controls to limit the likelihood of successful attacks; for example, deploy web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks.

== Mitigating Controls ==
*Implement mitigating controls to discover and prevent mistakes that may lead to the introduction of vulnerabilities; for example, Control 6 of the CSIS 20 Critical Security Controls – Application Software Security. Build security into the development life cycle.

== Remediation Prioritization ==
*Implement remediation prioritization driven by financial calculations. Compare the cost of fixing specific

Day 5

2014-12-12T16:20:15Z

Rsnake: Created page with "== Key activities == *Implement compensating controls & mitigation controls *Remediation Prioritization == Compensating Controls == *Implement compensating controls to limit..."

== Key activities ==
*Implement compensating controls & mitigation controls
*Remediation Prioritization

== Compensating Controls ==
*Implement compensating controls to limit the likelihood of successful attacks; for example, deploy web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks.

== Mitigating Controls ==
*Implement mitigating controls to discover and prevent mistakes that may lead to the introduction of vulnerabilities; for example, Control 6 of the CSIS 20 Critical Security Controls – Application Software Security. Build security into the development lifecycle.

== Remediation Prioritization ==
*Implement remediation prioritization driven by financial calculations. Compare the cost of fixing specific

Application Security Program Quick Start Guide

2014-12-12T16:20:03Z

Rsnake: /* The Application Security Program Quick Start Guide */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

== [[Day 1]] ==
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
== [[Day 2]] ==
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
== [[Day 3]] ==
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
== [[Day 4]] ==
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T16:19:34Z

Rsnake: /* The Application Security Program Quick Start Guide */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

[[Day 1]]
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
[[Day 2]]
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
[[Day 3]]
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
[[Day 4]]
''''' **Key Activities: '''''
*Measured Metrics
== [[Day 5]] ==
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T16:18:24Z

Rsnake: /* The Application Security Program Quick Start Guide */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

[[Day 1]]
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
[[Day 2]]
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
[[Day 3]]
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
[[Day 4]]
''''' **Key Activities: '''''
*Measured Metrics
[[*Day 5]]
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T16:11:25Z

Rsnake: /* Contents */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
''' [[*Day 5]]'''
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T16:05:18Z

Rsnake: /* Contents */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
[[''' *Day 5''']]
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T15:58:59Z

Rsnake: /* Other contributors */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
''' *Day 5'''
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| '''Matt Johansen''']]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T15:58:46Z

Rsnake: /* Project lead and authors */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
''' *Day 5'''
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs| '''Gabriel Gumbs''']]
* [[User:JeremiahGrossman| '''Jeremiah Grossman''']]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| MattJohansen]]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Application Security Program Quick Start Guide

2014-12-12T15:58:20Z

Rsnake: /* Project lead and authors */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
''' *Day 5'''
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs|GabrielGumbs]]
* [[User:JeremiahGrossman| JeremiahGrossman]]
* [[User:Rsnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| MattJohansen]]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

User:Rsnake

2014-12-12T15:57:50Z

Rsnake: Created page with "Hello there! This is RSnake. Yup, it's me."

Hello there! This is RSnake. Yup, it's me.

Application Security Program Quick Start Guide

2014-12-12T15:57:13Z

Rsnake: /* Project lead and authors */

__NOTOC__

{| width="100%" cellspacing="0" cellpadding="10"
|- valign="top"
| width="70%" style="background:#d9e9f9" |

= The Application Security Program Quick Start Guide =

Placeholder

== Contents ==

* Preface
** [[AppSec Quick Start Guide: About this guide|About this guide]]
** [[AppSec Quick Start Guide: Audience|Audience]]

*Day 1
[[''''' **Key Activities: ''''']]
***Evaluation
''''' *Key Questions: '''''
*Management
*Security
*IT Ops
*Engineering Groups (inc. QA)/Development
''' *Day 2'''
''''' **Key Activities: '''''
*Asset Discovery
*Asset Risk Prioritization
*Communication Plan
''' *Day 3'''
''''' **Key Activities: '''''
*Vulnerability Assessments
*Vulnerability delivery
''' *Day 4'''
''''' **Key Activities: '''''
*Measured Metrics
''' *Day 5'''
''''' **Key activities: '''''
*Compensating Controls
*Mitigating Controls
*Remediation Prioritization

== Licensing ==

The OWASP Application Security Program Quick Start Guide is free to use. It is licensed under the [http://creativecommons.org/licenses/by-nc-sa/4.0/ Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International license].
You are free to:
*Share — copy and redistribute the material in any medium or format
*Adapt — remix, transform, and build upon the material for non-commercial use

The licensor cannot revoke these freedoms as long as you follow the license terms.

| width="100" style="max-height:200px;overflow:hidden;background:#fff;margin:0;padding:0;" cellpadding="0" |

| width="30%" style="background:#eeeeee" |

=Credits =

== Project lead and authors ==

* [[User:Gabrielgumbs|GabrielGumbs]]
* [[User:JeremiahGrossman| JeremiahGrossman]]
* [[User:RSnake| '''Robert Hansen''']]
* [[User:Jerryhoff|'''Jerry Hoff''']]

== Other contributors ==

Co-authors, contributors and reviewers:

* [[User: MattJohansen| MattJohansen]]

= Further Information =

== Application Security Program Quick Start Guide ==

The OWASP Application Security Program Quick Start Guide is also available as
* [https://www.owasp.org/index.php/File:PlaceHolder.pdf Free downloadable PDF]

For full information about the Application Security Program Quick Start Guide, including mailing list details, the forward plan, how to contribute, the project status, and alternative media, see the project page:
* [https://www.owasp.org/index.php/OWASP_Application_Security_Program_Quick_Start_Guide_Project The Application Security Program Quick Start Guide Project Page]

|}

Robert "RSnake" Hansen (SecTheory)

2012-08-27T17:48:20Z

Rsnake: Updates

'''Robert Hansen (OWASP 2.0 guide contributor, OWASP AppSec US ’08 speaker)'''

Robert "RSnake" Hansen (CISSP) is the Chief Executive Officer of Falling Rock Networks. Falling Rock Networks creates next generation super-secure OS/Webserver stacks. Robert has been working with web application security since the mid 90’s, beginning his career in banner click fraud detection at ValueClick. Robert has worked for Cable & Wireless heading up managed security services, and at eBay as Sr. Global Product Manager of Trust and Safety, focusing on anti-phishing, anti-cross-site scripting, and anti-virus strategies. Robert also sits on the technical advisory board of Lockify. Before Falling Rock Networks and SecTheory, Robert’s career fluctuated from Sr. Security Architect to Director of Product Management for a publicly traded Real Estate company, giving him a great breath of knowledge of the entire security landscape. Robert now focuses on upcoming threats, detection circumvention and next generation security theory. Robert is probably best known for founding the web application security lab at ha.ckers.org and is more popularly known as “RSnake.” Robert is a member of WASC, IACSP, and ISSA, and contributed to the OWASP 2.0 guide.

Robert is formally an OWASP Connections Committee member and a current member of the Blackhat security conference speaker committee, the "Hack in the Box" speaker committee and the World OWASP/LASCON speaker committee. Robert is a co-author of the authoritative book “XSS Exploits: Cross Site Scripting Attacks and Defense” (Syngress) and of "Detecting Malice" (eBook).

Global Conferences Committee - Application 10

2011-05-04T17:25:39Z

Rsnake:

[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]]

----

{| border="0" align="center" style="width:100%"
|-
! align="center" style="background:#4058A0; color:white" colspan="2" | '''COMMITTEE APPLICATION FORM'''
|-
| align="center" style="width:25%; background:#7B8ABD" | '''Applicant's Name'''
| align="left" style="width:85%; background:#cccccc" colspan="1" | Josh Sokol
|-
| align="center" style="width:25%; background:#7B8ABD" | '''Current and past OWASP Roles'''
| align="left" style="width:85%; background:#cccccc" colspan="1" | Austin OWASP President, LASCON Co-Chair, Austin OWASP Vice President
|-
| align="center" style="width:25%; background:#7B8ABD" | '''Committee Applying for'''
| align="left" style="width:85%; background:#cccccc" colspan="1" | Global Conferences Committee
|}

----

 

----

Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''. An incomplete application will not be considered for vote.

----

 

----

{| border="0" align="center" style="width:100%"
|-
! align="center" style="background:#4058A0; color:white" colspan="8" | '''COMMITTEE RECOMMENDATIONS'''
|-
! align="center" style="background:white; color:white" | 
! align="center" style="background:#7B8ABD; color:white" | '''Who Recommends/Name'''
! align="center" style="background:#7B8ABD; color:white" | '''Role in OWASP'''
! align="center" style="background:#7B8ABD; color:white" | '''Recommendation Content'''
|-
| align="center" style="width:3%; background:#cccccc" | '''1'''
| align="center" style="width:20%; background:#cccccc" | James Wickett
| align="center" style="width:20%; background:#cccccc" | VP of Austin OWASP Chapter
| align="center" style="width:57%; background:#cccccc" | Josh is a hard worker and has led the OWASP Austin chapter for 2010 and 2011.  Josh has been an instrumental part of the chapter even before that time and has served in many capacities to make OWASP successful in Austin--from communication to members to arranging food for events to speaking at meetings.  I highly recommend Josh and I know that he would make a good addition to the committee.  
|-
| align="center" style="width:3%; background:#cccccc" | '''2'''
| align="center" style="width:20%; background:#cccccc" | Brad Causey
| align="center" style="width:20%; background:#cccccc" | GPC Member
| align="center" style="width:57%; background:#cccccc" | I've enjoyed working with Josh on each of my multiple occasions visiting the Austin, TX Chapter. It seems like everything Josh touches, is done exquisitely. OWASP would be well served by adding Josh to it's list of global leaders.
|-
| align="center" style="width:3%; background:#cccccc" | '''3'''
| align="center" style="width:20%; background:#cccccc" | Robert Hansen
| align="center" style="width:20%; background:#cccccc" | Ex-Connections Committee Member
| align="center" style="width:57%; background:#cccccc" | Josh has been working with the Austin OWASP Chapter for the past couple of years and has provided immeasurable assistance to the chapter in drumming up membership, getting top-notch presenters, and generally supporting our activities. He is a stand up person and is amongst the smartest security people I know. I think he would be an excellent fit for the OWASP Global Conferences Committee role and he has my highest recommendation for this position.
|-
| align="center" style="width:3%; background:#cccccc" | '''4'''
| align="center" style="width:20%; background:#cccccc" |
| align="center" style="width:20%; background:#cccccc" |
| align="center" style="width:57%; background:#cccccc" |
|-
| align="center" style="width:3%; background:#cccccc" | '''5'''
| align="center" style="width:20%; background:#cccccc" |
| align="center" style="width:20%; background:#cccccc" |
| align="center" style="width:57%; background:#cccccc" |
|}

----

Global Chapter Committee - Application 6

2011-01-10T17:16:41Z

Rsnake:

{| style="width:100%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white"|'''COMMITTEE APPLICATION FORM'''
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Applicant's Name'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|Ofer Maor
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Current and past OWASP Roles'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|OWASP Israel Chapter Leader
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Committee Applying for'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|Global Chapters Committee
|}
----

----
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''.
An incomplete application will not be considered for vote.
----

----
{| style="width:100%" border="0" align="center"
! colspan="8" align="center" style="background:#4058A0; color:white"|'''COMMITTEE RECOMMENDATIONS'''
|-
! align="center" style="background:white; color:white"|
! align="center" style="background:#7B8ABD; color:white"|'''Who Recommends/Name'''
! align="center" style="background:#7B8ABD; color:white"|'''Role in OWASP'''
! align="center" style="background:#7B8ABD; color:white"|'''Recommendation Content'''
|-
| style="width:3%; background:#cccccc" align="center"|'''1'''
| style="width:20%; background:#cccccc" align="center"| Mark Bristow
| style="width:20%; background:#cccccc" align="center"| Global Conferences Committee Chair, AppSec DC Organizer, OWASP DC Lead
| style="width:57%; background:#cccccc" align="center"| Ofer has been doing an excellent job in promoting OWASP in the vibrant Israeli government, security, and development community. His energy and insights would make a great addition to the committee.
|-
| style="width:3%; background:#cccccc" align="center"|'''2'''
| style="width:20%; background:#cccccc" align="center"| Robert "RSnake" Hansen
| style="width:20%; background:#cccccc" align="center"| Global Connections Committee, Board of Austin OWASP
| style="width:57%; background:#cccccc" align="center"| Ofer is one of the most knowledgeable people in OWASP around detection and penetration testing. I see no reason he couldn't help organize the chapters. I, for one, welcome his expertise.
|-
| style="width:3%; background:#cccccc" align="center"|'''3'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|-
| style="width:3%; background:#cccccc" align="center"|'''4'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|-
| style="width:3%; background:#cccccc" align="center"|'''5'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|}

Global Membership Committee - Application 3

2011-01-10T17:15:14Z

Rsnake:

[[How to Join a Committee|Click here to return to 'How to Join a Committee' page]]

----
{| style="width:100%" border="0" align="center"
! colspan="2" align="center" style="background:#4058A0; color:white"|'''COMMITTEE APPLICATION FORM'''
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Applicant's Name'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|Ofer Maor
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Current and past OWASP Roles'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|OWASP Israel Chapter Leader
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Committee Applying for'''
| colspan="1" style="width:85%; background:#cccccc" align="left"|OWASP Global Membership Committee.
|}
----

----
Please be aware that for an application to be considered by the board, '''you MUST have 5 recommendations'''.
An incomplete application will not be considered for vote.
----

----
{| style="width:100%" border="0" align="center"
! colspan="8" align="center" style="background:#4058A0; color:white"|'''COMMITTEE RECOMMENDATIONS'''
|-
! align="center" style="background:white; color:white"|
! align="center" style="background:#7B8ABD; color:white"|'''Who Recommends/Name'''
! align="center" style="background:#7B8ABD; color:white"|'''Role in OWASP'''
! align="center" style="background:#7B8ABD; color:white"|'''Recommendation Content'''
|-
| style="width:3%; background:#cccccc" align="center"|'''1'''
| style="width:20%; background:#cccccc" align="center"| Mark Bristow
| style="width:20%; background:#cccccc" align="center"| Global Conferences Committee Chair, AppSec DC Organizer, OWASP DC Lead
| style="width:57%; background:#cccccc" align="center"| Ofer has been doing an excellent job in promoting OWASP in the vibrant Israeli government, security, and development community. His energy and insights would make a great addition to the committee.
|-
| style="width:3%; background:#cccccc" align="center"|'''2'''
| style="width:20%; background:#cccccc" align="center"| Robert "RSnake" Hansen
| style="width:20%; background:#cccccc" align="center"| Global Connections Committee, Board of Austin OWASP
| style="width:57%; background:#cccccc" align="center"| Ofer is one of the most knowledgeable people in OWASP around detection and penetration testing. I see no reason he couldn't help recruit more people into OWASP, leading by example.
|-
| style="width:3%; background:#cccccc" align="center"|'''3'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|-
| style="width:3%; background:#cccccc" align="center"|'''4'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|-
| style="width:3%; background:#cccccc" align="center"|'''5'''
| style="width:20%; background:#cccccc" align="center"|
| style="width:20%; background:#cccccc" align="center"|
| style="width:57%; background:#cccccc" align="center"|
|}
----

OWASP Connections Committee

2009-12-26T16:33:30Z

Rsnake: /* Committee Members */

===About the OWASP Connections Committee (OCC)===
The OWASP Connections Committee was created during the OWASP AppSec DC 2009 conference

===Responsibilities===
* Make connections between the OWASP Community and the materials it creates
* Handle PR and promotion of OWASP foundation, projects and events
* Manage OWASP Newsletters
* Manage OWASP 'collaboration tools': LinkedIn, Twitter feeds, etc...
** Manage the WIKI account creation authorization process
* Handle issues related to the OWASP Community and its leaders
* Expand OWASP range to include other non-'Web Application Security' groups, namely Developers
* Help OWASP to have further participation at non-OWASP conferences
* Manager participation at OWASP conferences and chapters of 'special' speakers and groups
* Work with the OWASP Website project, and help to restructure the current website around its target audience (or maybe help to create a new 'user-focused' OWASP website )

===Committee Members===
* Lorna Alamri
* Robert Hansen, (RSnake)
* Dinis Cruz
* Tom Brennan
* Justin Clarke

7th OWASP AppSec Conference - San Jose 2007 / OWASP Leaders Meeting - Nov 14 6pm

2007-11-13T19:32:39Z

Rsnake: /* Attendees */

This page contains the agenda for the OWASP Leaders meeting that will occur during the next OWASP conference in San Jose (see its [[7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda|Agenda]] for more details

== Items to discuss ==

* OWASP Internal Structure
* OWASP 2008 (blueprint)
* OotM - OWASP on the Move
* Next SpoC
* OWASP Books
* 2008 NYC OWASP CON Update

== Attendees ==

* Dinis Cruz
* Ofer Shezaf
* Jeff Williams
* Dave Wichers
* Tom Brennan
* Robert "RSnake" Hansen
** If your attending, update the wiki so we have a head count for the RSVP

Cross Site Scripting Flaw

2006-07-04T00:04:25Z

Rsnake:

==Description==
Cross-site scripting (sometimes referred to as XSS) vulnerabilities occur when an attacker uses a web application to send malicious code, generally in the form of a script, to a different end user. These flaws are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating it.

An attacker can use cross site scripting to send malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page.

XSS attacks can generally be categorized into two categories: stored and reflected. Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a ‘trusted’ server.

The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. Do not be fooled into thinking that a “read only” or “brochureware” site is not vulnerable to serious reflected XSS attacks. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, and modifying presentation of content. An XSS vulnerability allowing an attacker to modify a press release or news item could affect a company’s stock price or lessen consumer confidence. An XSS vulnerability on a pharmaceutical site could allow an attacker to modify dosage information resulting in an overdose.

Attackers frequently use a variety of methods to encode the malicious portion of the tag, such as using Unicode, so the request is less suspicious looking to the user. There are hundreds of variants of these attacks, including versions that do not even require any < > symbols. For this reason, attempting to “filter out” these scripts is not likely to succeed. Instead we recommend validating input against a rigorous positive specification of what is expected. XSS attacks usually come in the form of embedded JavaScript. However, any embedded active content is a potential source of danger, including: ActiveX (OLE), VBscript, Shockwave, Flash and more.

XSS issues can also be present in the underlying web and application servers as well. Most web and application servers generate simple web pages to display in the case of various errors, such as a 404 ‘page not found’ or a 500 ‘internal server error.’ If these pages reflect back any information from the user’s request, such as the URL they were trying to access, they may be vulnerable to a reflected XSS attack.

The likelihood that a site contains XSS vulnerabilities is extremely high. There are a wide variety of ways to trick web applications into relaying malicious scripts. Developers that attempt to filter out the malicious parts of these requests are very likely to overlook possible attacks or encodings. Finding these flaws is not tremendously difficult for attackers, as all they need is a browser and some time. There are numerous free tools available that help hackers find these flaws as well as carefully craft and inject XSS attacks into a target site.

==Environments Affected==

All web servers, application servers, and web application environments are susceptible to cross site scripting.

==Examples and References==
* The Cross Site Scripting FAQ: http://www.cgisecurity.com/articles/xss-faq.shtml
* XSS Cheat Sheet: http://ha.ckers.org/xss.html
* CERT Advisory on Malicious HTML Tags: http://www.cert.org/advisories/CA-2000-02.html
* CERT “Understanding Malicious Content Mitigation” http://www.cert.org/tech_tips/malicious_code_mitigation.html
* Cross-Site Scripting Security Exposure Executive Summary: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/ExSumCS.asp
* Understanding the cause and effect of CSS Vulnerabilities: http://www.technicalinfo.net/papers/CSS.html
* OWASP Guide to Building Secure Web Applications and Web Services, Chapter 8: Data Validation http://www.owasp.org/documentation/guide.html
* How to Build an HTTP Request Validation Engine (J2EE validation with Stinger) http://www.owasp.org/columns/jeffwilliams/jeffwilliams2
* Have Your Cake and Eat it Too (.NET validation) http://www.owasp.org/columns/jpoteet/jpoteet2

==How to Determine If You Are Vulnerable==
XSS flaws can be difficult to identify and remove from a web application. The best way to find flaws is to perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output. Note that a variety of different HTML tags can be used to transmit a malicious JavaScript. Nessus, Nikto, and some other available tools can help scan a website for these flaws, but can only scratch the surface. If one part of a website is vulnerable, there is a high likelihood that there are other problems as well.

==How to Protect Yourself==

The best way to protect a web application from XSS attacks is ensure that your application performs validation of all headers, cookies, query strings, form fields, and hidden fields (i.e., all parameters) against a rigorous specification of what should be allowed. The validation should not attempt to identify active content and remove, filter, or sanitize it. There are too many types of active content and too many ways of encoding it to get around filters for such content. We strongly recommend a ‘positive’ security policy that specifies what is allowed. ‘Negative’ or attack signature based policies are difficult to maintain and are likely to be incomplete.

Encoding user supplied output can also defeat XSS vulnerabilities by preventing inserted scripts from being transmitted to users in an executable form. Applications can gain significant protection from javascript based attacks by converting the following characters in all generated output to the appropriate HTML entity encoding:

[[Image:Toptena45.jpg|none|300px]]

The [[:Category:OWASP Filters Project|OWASP Filters project]] is producing reusable components in several languages to help prevent many forms of parameter tampering, including the injection of XSS attacks. OWASP has also released [[OWASP CodeSeeker Project|CodeSeeker]], an application level firewall. In addition, the [[:Category:OWASP WebGoat Project|OWASP WebGoat Project]] training program has lessons on Cross Site Scripting and data encoding.

==Categories==

[[Category:OWASP Top Ten Project]]

__NOEDITSECTION__