https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Subu+RamanathanOWASP - User contributions [en]2026-05-06T10:11:12ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=User:Subu_Ramanathan&diff=81258User:Subu Ramanathan2010-04-12T22:07:45Z<p>Subu Ramanathan: </p>
<hr />
<div>Subu Ramanathan is a security consultant with Security Compass. With his wide array of experience in application vulnerability assessments, penetration testing and source code review, Subu plays a valuable part in Security Compass’s Software and Enterprise Assessment Service practice. With reinforced fundamentals in software development, Subu brings to the table a sound understanding of the Software Development Life Cycles (SDLC). Subu is also involved in developing content for various JAVA and .NET based, developer focused security training courses including one offered by SANS institute.<br />
<br />
Subu holds a Bachelors in Applied Science and Engineering (Computer Engineering) from the University of Toronto.<br />
<br />
<br />
<br />
* To see my wiki contributions, [[:Special:Contributions/Subu Ramanathan|click here]].<br />
* [mailto:subu(at)securitycompass.com Email address].</div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=Category:OWASP_Web_Services_Security_Project&diff=68382Category:OWASP Web Services Security Project2009-09-01T15:50:36Z<p>Subu Ramanathan: /* Project Contributors */</p>
<hr />
<div>==== Main ====<br />
<br />
== Introduction ==<br />
Welcome to OWASP Web Services Security Project. This project is designed to serve as a starting point for any web services related inquiries on OWASP. Please note that this is NOT a standalone project and will draw upon relevant resources from other OWASP and external pages.<br />
<br />
== Goals ==<br />
The OWASP Web Services Security Project aims to include and maintain a comprehensive list of links to OWASP and external resources.<br />
<br />
== Web Services Security ==<br />
OWASP related Web Services links:<br />
<br />
[1] [http://www.owasp.org/index.php/Web_Services OWASP Web Services] - A comprehensive introduction to Web Services.<br />
<br />
[2] [http://www.owasp.org/index.php/Theres_More_to_Securing_Web_Services_Systems_Than_WS-Security There is More to Securing Web Services Systems Than WS Security] - Insightful page on Web Services Security.<br />
<br />
[3] [http://www.owasp.org/index.php/.NET_Web_Service_Validation .NET Web Service Validation] - .NET approach to validating Web Services.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
<br />
<br />
==== Web Services Standards ====<br />
<br />
== OWASP Web Services Standards Links ==<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP Guide Project] - A comprehensive development guide on building secure Web Service Applications.<br />
<br />
== External Web Services Standards Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Web Services Tools ====<br />
<br />
== OWASP Web Services Tools ==<br />
[http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project WSFuzzer]<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Interceptor_Project Interceptor]<br />
<br />
== External Web Services Tools ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Testing Web Services ====<br />
<br />
== OWASP Links ==<br />
<br />
[http://www.owasp.org/index.php/Testing_for_Web_Services Testing Web Services] - Comprehensive OWASP Guide on Testing Web Services.<br />
<br />
== External Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Documents & Presentations ====<br />
<br />
== OWASP Documents and Presentations ==<br />
<br />
'''Documents Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:Web_services_security.doc Web Services Security]<br />
<br />
'''Presentations Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:InfoSec_World_2007_-_Web_services_gateways.ppt InfoSec World 2007] - Web Services Gateways presentation from InfoSec World 2007.<br />
<br />
[http://www.owasp.org/index.php/Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt Attacking Web Services] - OWASP AppSec 2005 DC presentation on Attacking Web Services by Alex Stamos.<br />
<br />
[http://www.owasp.org/index.php/Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt WS Security] - OWASP AppSec 2006 Seattle presentation on Web Services Security.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt Secure SOAP Requests] - OWASP AppSec 2006 EU presentation on Inline Approach for Secure SOAP Requests.<br />
<br />
[http://www.owasp.org/index.php/image:Don’t_drop_the_SOAP_OWASP.ppt Don't Drop the SOAP]<br />
<br />
[http://www.owasp.org/index.php/image:AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt OWASP Web Services Project] - OWASP AppSec 2005 DC presentation on the OWASP Web Services Project by Alex Smolen.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt Protecting Web Services] - OWASP AppSec 2006 EU presentation on Protesting Web Services and Applications.<br />
<br />
<br />
== External Documents & Presentations ==<br />
<br />
''This section of the page needs to be updated''<br />
<br />
<br />
==== OLD_PAGE ====<br />
== Welcome to the OWASP Web Services Security Project==<br />
<br />
[a brief about web services security in general and the current state of OWASP in web services security]<br />
<br />
The following document outlines a proposed layout for a new Web Services Security Project for the Open Web Application Security Project (OWASP). <br />
<br />
== Current State ==<br />
<br />
'''Current Relevant OWASP Pages'''<br />
<br />
1. Web Services<br />
a. Securing web services<br />
b. Communication security<br />
c. Passing credentials<br />
d. Ensuring message freshness<br />
e. Protecting message integrity<br />
f. Protecting message confidentiality<br />
g. Access control<br />
h. Audit<br />
i. Web services security hierarchy<br />
i. standard committees<br />
j. SOAP<br />
i. XML signatures and encryption<br />
ii. Security specifications<br />
k. WS-Security standard<br />
i. Organization of the standard<br />
ii. Purpose<br />
l. WS-Security Building blocks<br />
i. How data is passed<br />
ii. Security header’s structure<br />
iii. Types of tokens<br />
iv. Referencing message parts<br />
m. Communication protection mechanisms<br />
i. Integrity<br />
ii. Confidentiality<br />
iii. Freshness<br />
n. Access control mechanisms<br />
i. Identification<br />
ii. Authentication<br />
iii. Authorization<br />
iv. Policy agreement<br />
o. Forming web services chains<br />
i. Incompatible user access control models<br />
ii. Service trust<br />
iii. Secure connections<br />
iv. Synchronization of user directories<br />
v. Domain federation<br />
p. Available implementations<br />
i. .NET – Web services extensions<br />
ii. Java toolkits<br />
iii. Hardware software systems<br />
q. Problems<br />
i. Immaturity of the standards<br />
ii. Performance<br />
iii. Complexity and interoperability<br />
iv. Key management<br />
r. Further reading<br />
<br />
2. A Tale of Two Systems<br />
- case studies of two hypothetical systems, one of which involves openning a mainframe app to the web using a web service, and the risks that are posed.<br />
<br />
3. Theres More to Securing Web Services Systems Than WS-Security<br />
a. What is a web service<br />
b. Web services from the information security perspective<br />
c. Some security implications of this perspective<br />
i. Emergent risks<br />
ii. End-to-end controls<br />
d. Interconnection of systems from different trust domains<br />
i. Some implications of the organization’s risk management process and system development life cycle<br />
ii. Emerging standards for securing web services<br />
iii. WS-Security specifications in process<br />
iv. Trust management revisited<br />
e. References<br />
<br />
4. Web Services Architecture and Security<br />
a. The web services architecture<br />
b. Service oriented architectures and distributed systems<br />
c. Complexity is the enemy of security…<br />
d. The architectural models<br />
e. The policy model<br />
f. The service oriented model<br />
g. The resource oriented model<br />
h. The message oriented model<br />
i. The management model<br />
j. The rest<br />
k. References<br />
<br />
5. Testing for Web Services (from OWASP Testing Guide)<br />
a. XML Structural Testing<br />
b. XML Content-level Testing<br />
c. HTTP GET parameters/REST Testing<br />
d. Naughty SOAP attachments<br />
e. Replay Testing<br />
<br />
6. Image:Web services security.doc<br />
<br />
7. Image:InfoSec_World_2007_-_Web_services_gateways.ppt<br />
<br />
8. Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt<br />
<br />
9. Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt<br />
<br />
10. .NET Web Service Validation<br />
a. Perfomance penalties<br />
b. Downloading<br />
c. Installation<br />
d. Reporting Bugs<br />
e. Use<br />
i. Methods of use<br />
ii. Attributes<br />
iii. Web.config changes<br />
iv. Using validation<br />
v. Using assertions<br />
<br />
11. OWASP WSFuzzer Project<br />
<br />
12. OWASP interceptor Project<br />
<br />
13. OWASP Guide<br />
<br />
14. OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt<br />
<br />
15. Category_talk:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project<br />
<br />
16. Don’t drop the SOAP OWASP.ppt<br />
<br />
17. AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt<br />
<br />
18. AppSec2005DC-Jeff_Williams-OWASP_AppSec_Guide_2.0.ppt<br />
<br />
19. OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt<br />
<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Desired State ==<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Proposed Layout ==<br />
<br />
The proposed OWASP Web Services Security Project will serve as a starting point for any web services-related inquiries on OWASP. It will consist of a launchpad or home page with an introduction to the project, regular updates to pages in the project, and links to project pages and external resources. <br />
<br />
[[Image:WS_Launchpad.jpg|thumb|600px|LEFT|Launchpad Layout (click to see a bigger image)]]<br />
<br />
<b>Introduction</b><br />
<br />
[brief description here]<br />
<br />
<b>Updates</b><br />
<br />
[brief description here]<br />
<br />
<b>External Links</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Pages</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Security Docs/Presentations</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Standards</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Communications</b><br />
<br />
[brief description here]<br />
<br />
<b>XML Security</b><br />
<br />
[brief description here]<br />
<br />
<b>Testing Web Services</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Tools</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Gateways</b><br />
<br />
[brief description here]<br />
<br />
<b>SOA Architecture and Design</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Implementation Platforms</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Top 10 Web Services Chapter</b><br />
<br />
[brief description here]<br />
<br />
<br />
== Goals & Roadmap ==<br />
<br />
Currently the project goals are to:<br />
<br />
* Creation of launch pad layout<br />
<br />
* Create template start page for each subtopic <br />
<br />
* Find solid external resources<br />
<br />
* Recruit volunteer team (2-4 person)<br />
<br />
* For each topic: <br />
<br />
- Create start page for the subtopic topic<br />
<br />
- Gather all existing relevant articles within OWASP<br />
<br />
- Create plan of consolidating all the relevant information<br />
<br />
- Contact authors of relevant articles if change is required<br />
<br />
- Consolidate all information on the topic<br />
<br />
- Find solid external resources<br />
<br />
- Create link back to the main Web Services Security Project launchpad<br />
<br />
* Research way of communicating any updates to web services pages on launchpad<br />
<br />
* Search optimization (both OWASP and Google)<br />
<br />
<br />
A detailed project plan and schedule will be developed shortly and posted here.<br />
<br />
<br />
== Project Guiding Principles ==<br />
<br />
tbd<br />
<br />
== Resources and links ==<br />
<br />
This project is not standalone. This project will draw pieces of information from:<br />
* OWASP Guide<br />
* Other OWASP pages<br />
* OWASP documents<br />
* Relevant external links<br />
...<br />
<br />
== Feedback and Participation: ==<br />
<br />
We hope you find the OWASP Web Services Security Project to be useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to sahba@securitycompass.com.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
<br />
Contributors:<br />
* you? ...<br />
<br />
==== Project Identification ====<br />
<br />
[[Category:OWASP Project|Web Services Security Project]]<br />
[[Category:OWASP Project]]<br />
[[Category:OWASP Document]]<br />
[[Category:OWASP Alpha Quality Document]]<br />
<br />
{{Template:OWASP Project Identification Tab<br />
| project_name = OWASP Web Services Security Project<br />
| project_description = This project is designed to serve as a comprehensive starting point for any web services related inquiries on the web<br />
| project_license = [http://www.gnu.org/licenses/gpl-3.0.html '''GPL''']<br />
| leader_name = Subu Ramanathan<br />
| leader_email = <br />
| leader_username = Subu Ramanathan<br />
| maintainer_name = Subu Ramanathan<br />
| maintainer_email = <br />
| maintainer_username = Subu Ramanathan <br />
| contributor_name1 = Sahba Kazerooni<br />
| contributor_email1 = <br />
| contributor_username1 = Skazerooni <br />
| contributor_name2 = Subu Ramanathan<br />
| contributor_email2 = <br />
| contributor_username2 = Subu Ramanathan<br />
| contributor_name3 = <br />
| contributor_email3 = <br />
| contributor_username3 = <br />
| contributor_name4 = <br />
| contributor_email4 = <br />
| contributor_username4 = <br />
| contributor_name5 = <br />
| contributor_email5 = <br />
| contributor_username5 = <br />
| contributor_name6 = <br />
| contributor_email6 = <br />
| contributor_username6 = <br />
| contributor_name7 = <br />
| contributor_email7 = <br />
| contributor_username7 = <br />
| contributor_name8 = <br />
| contributor_email8 = <br />
| contributor_username8 = <br />
| contributor_name9 = <br />
| contributor_email9 = <br />
| contributor_username9 = <br />
| contributor_name10 = <br />
| contributor_email10 = <br />
| contributor_username10 = <br />
| pamphlet_link = http://www.owasp.org/images/a/a9/Project_flyer.pdf<br />
| presentation_link = http://www.owasp.org/index.php/File:Owasp_education_-_WS_Security_Project.pptx<br />
| mailing_list_name = owasp-web-services<br />
| links_url1 = <br />
| links_name1 = <br />
| links_url2 = <br />
| links_name2 = <br />
| links_url3 = <br />
| links_name3 = <br />
| links_url4 = <br />
| links_name4 = <br />
| links_url5 = <br />
| links_name5 = <br />
| links_url6 = <br />
| links_name6 = <br />
| links_url7 = <br />
| links_name7 = <br />
| links_url8 = <br />
| links_name8 = <br />
| links_url9 = <br />
| links_name9 = <br />
| links_url10 = <br />
| links_name10 = <br />
| project_road_map = <br />
| project_health_status = <br />
| current_release_name = First Release<br />
| current_release_date = <br />
| current_release_download_link = <br />
| current_release_rating = <br />
| current_release_leader_name = Subu Ramanathan<br />
| current_release_leader_email = <br />
| current_release_leader_username = Subu Ramanathan<br />
| last_reviewed_release_name = <br />
| last_reviewed_release_date = <br />
| last_reviewed_release_download_link = <br />
| last_reviewed_release_rating = <br />
| last_reviewed_release_leader_name = <br />
| last_reviewed_release_leader_email = <br />
| last_reviewed_release_leader_username = <br />
| current_release_details = :Category:OWASP Web Services Security Project - First Release <br />
| old_release_name1 = <br />
| old_release_date1 = <br />
| old_release_download_link1 = <br />
| old_release_name2 = <br />
| old_release_date2 = <br />
| old_release_download_link2 = <br />
| old_release_name3 = <br />
| old_release_date3 = <br />
| old_release_download_link3 = <br />
| old_release_name4 = <br />
| old_release_date4 = <br />
| old_release_download_link4 = <br />
| old_release_name5 = <br />
| old_release_date5 = <br />
| old_release_download_link5 = <br />
}} <br />
<br />
__NOTOC__<br />
<headertabs/></div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=User:Subu_Ramanathan&diff=68381User:Subu Ramanathan2009-09-01T15:45:26Z<p>Subu Ramanathan: Added bio for Subu Ramanathan</p>
<hr />
<div>Subu Ramanathan is a security consultant with Security Compass. With his wide array of experience in application vulnerability assessments, penetration testing and source code review, Subu plays a valuable part in Security Compass’s Software Assessment Service practice. With reinforced fundamentals in software development, Subu brings to the table inept understanding of the Software Development Life Cycles (SDLC). Subu is also involved in developing content for various JAVA based, developer focused security training courses including one offered by SANS institute.<br />
<br />
Subu holds a Bachelors in Applied Science and Engineering (Computer Engineering) from the University of Toronto.<br />
<br />
<br />
<br />
* To see my wiki contributions, [[:Special:Contributions/Subu Ramanathan|click here]].<br />
* [mailto:subu(at)securitycompass.com Email address].</div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=Category:OWASP_Web_Services_Security_Project&diff=66677Category:OWASP Web Services Security Project2009-07-27T17:22:50Z<p>Subu Ramanathan: </p>
<hr />
<div>{{:Template:Orphaned Projects}}<br />
<br />
==== Main ====<br />
<br />
== Introduction ==<br />
Welcome to OWASP Web Services Security Project. This project is designed to serve as a starting point for any web services related inquiries on OWASP. Please note that this is NOT a standalone project and will draw upon relevant resources from other OWASP and external pages.<br />
<br />
== Goals ==<br />
The OWASP Web Services Security Project aims to include and maintain a comprehensive list of links to OWASP and external resources.<br />
<br />
== Web Services Security ==<br />
OWASP related Web Services links:<br />
<br />
[1] [http://www.owasp.org/index.php/Web_Services OWASP Web Services] - A comprehensive introduction to Web Services.<br />
<br />
[2] [http://www.owasp.org/index.php/Theres_More_to_Securing_Web_Services_Systems_Than_WS-Security There is More to Securing Web Services Systems Than WS Security] - Insightful page on Web Services Security.<br />
<br />
[3] [http://www.owasp.org/index.php/.NET_Web_Service_Validation .NET Web Service Validation] - .NET approach to validating Web Services.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
<br />
<br />
==== Web Services Standards ====<br />
<br />
== OWASP Web Services Standards Links ==<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP Guide Project] - A comprehensive development guide on building secure Web Service Applications.<br />
<br />
== External Web Services Standards Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Web Services Tools ====<br />
<br />
== OWASP Web Services Tools ==<br />
[http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project WSFuzzer]<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Interceptor_Project Interceptor]<br />
<br />
== External Web Services Tools ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Testing Web Services ====<br />
<br />
== OWASP Links ==<br />
<br />
[http://www.owasp.org/index.php/Testing_for_Web_Services Testing Web Services] - Comprehensive OWASP Guide on Testing Web Services.<br />
<br />
== External Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Documents & Presentations ====<br />
<br />
== OWASP Documents and Presentations ==<br />
<br />
'''Documents Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:Web_services_security.doc Web Services Security]<br />
<br />
'''Presentations Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:InfoSec_World_2007_-_Web_services_gateways.ppt InfoSec World 2007] - Web Services Gateways presentation from InfoSec World 2007.<br />
<br />
[http://www.owasp.org/index.php/Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt Attacking Web Services] - OWASP AppSec 2005 DC presentation on Attacking Web Services by Alex Stamos.<br />
<br />
[http://www.owasp.org/index.php/Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt WS Security] - OWASP AppSec 2006 Seattle presentation on Web Services Security.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt Secure SOAP Requests] - OWASP AppSec 2006 EU presentation on Inline Approach for Secure SOAP Requests.<br />
<br />
[http://www.owasp.org/index.php/image:Don’t_drop_the_SOAP_OWASP.ppt Don't Drop the SOAP]<br />
<br />
[http://www.owasp.org/index.php/image:AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt OWASP Web Services Project] - OWASP AppSec 2005 DC presentation on the OWASP Web Services Project by Alex Smolen.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt Protecting Web Services] - OWASP AppSec 2006 EU presentation on Protesting Web Services and Applications.<br />
<br />
<br />
== External Documents & Presentations ==<br />
<br />
''This section of the page needs to be updated''<br />
<br />
<br />
==== OLD_PAGE ====<br />
== Welcome to the OWASP Web Services Security Project==<br />
<br />
[a brief about web services security in general and the current state of OWASP in web services security]<br />
<br />
The following document outlines a proposed layout for a new Web Services Security Project for the Open Web Application Security Project (OWASP). <br />
<br />
== Current State ==<br />
<br />
'''Current Relevant OWASP Pages'''<br />
<br />
1. Web Services<br />
a. Securing web services<br />
b. Communication security<br />
c. Passing credentials<br />
d. Ensuring message freshness<br />
e. Protecting message integrity<br />
f. Protecting message confidentiality<br />
g. Access control<br />
h. Audit<br />
i. Web services security hierarchy<br />
i. standard committees<br />
j. SOAP<br />
i. XML signatures and encryption<br />
ii. Security specifications<br />
k. WS-Security standard<br />
i. Organization of the standard<br />
ii. Purpose<br />
l. WS-Security Building blocks<br />
i. How data is passed<br />
ii. Security header’s structure<br />
iii. Types of tokens<br />
iv. Referencing message parts<br />
m. Communication protection mechanisms<br />
i. Integrity<br />
ii. Confidentiality<br />
iii. Freshness<br />
n. Access control mechanisms<br />
i. Identification<br />
ii. Authentication<br />
iii. Authorization<br />
iv. Policy agreement<br />
o. Forming web services chains<br />
i. Incompatible user access control models<br />
ii. Service trust<br />
iii. Secure connections<br />
iv. Synchronization of user directories<br />
v. Domain federation<br />
p. Available implementations<br />
i. .NET – Web services extensions<br />
ii. Java toolkits<br />
iii. Hardware software systems<br />
q. Problems<br />
i. Immaturity of the standards<br />
ii. Performance<br />
iii. Complexity and interoperability<br />
iv. Key management<br />
r. Further reading<br />
<br />
2. A Tale of Two Systems<br />
- case studies of two hypothetical systems, one of which involves openning a mainframe app to the web using a web service, and the risks that are posed.<br />
<br />
3. Theres More to Securing Web Services Systems Than WS-Security<br />
a. What is a web service<br />
b. Web services from the information security perspective<br />
c. Some security implications of this perspective<br />
i. Emergent risks<br />
ii. End-to-end controls<br />
d. Interconnection of systems from different trust domains<br />
i. Some implications of the organization’s risk management process and system development life cycle<br />
ii. Emerging standards for securing web services<br />
iii. WS-Security specifications in process<br />
iv. Trust management revisited<br />
e. References<br />
<br />
4. Web Services Architecture and Security<br />
a. The web services architecture<br />
b. Service oriented architectures and distributed systems<br />
c. Complexity is the enemy of security…<br />
d. The architectural models<br />
e. The policy model<br />
f. The service oriented model<br />
g. The resource oriented model<br />
h. The message oriented model<br />
i. The management model<br />
j. The rest<br />
k. References<br />
<br />
5. Testing for Web Services (from OWASP Testing Guide)<br />
a. XML Structural Testing<br />
b. XML Content-level Testing<br />
c. HTTP GET parameters/REST Testing<br />
d. Naughty SOAP attachments<br />
e. Replay Testing<br />
<br />
6. Image:Web services security.doc<br />
<br />
7. Image:InfoSec_World_2007_-_Web_services_gateways.ppt<br />
<br />
8. Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt<br />
<br />
9. Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt<br />
<br />
10. .NET Web Service Validation<br />
a. Perfomance penalties<br />
b. Downloading<br />
c. Installation<br />
d. Reporting Bugs<br />
e. Use<br />
i. Methods of use<br />
ii. Attributes<br />
iii. Web.config changes<br />
iv. Using validation<br />
v. Using assertions<br />
<br />
11. OWASP WSFuzzer Project<br />
<br />
12. OWASP interceptor Project<br />
<br />
13. OWASP Guide<br />
<br />
14. OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt<br />
<br />
15. Category_talk:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project<br />
<br />
16. Don’t drop the SOAP OWASP.ppt<br />
<br />
17. AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt<br />
<br />
18. AppSec2005DC-Jeff_Williams-OWASP_AppSec_Guide_2.0.ppt<br />
<br />
19. OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt<br />
<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Desired State ==<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Proposed Layout ==<br />
<br />
The proposed OWASP Web Services Security Project will serve as a starting point for any web services-related inquiries on OWASP. It will consist of a launchpad or home page with an introduction to the project, regular updates to pages in the project, and links to project pages and external resources. <br />
<br />
[[Image:WS_Launchpad.jpg|thumb|600px|LEFT|Launchpad Layout (click to see a bigger image)]]<br />
<br />
<b>Introduction</b><br />
<br />
[brief description here]<br />
<br />
<b>Updates</b><br />
<br />
[brief description here]<br />
<br />
<b>External Links</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Pages</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Security Docs/Presentations</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Standards</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Communications</b><br />
<br />
[brief description here]<br />
<br />
<b>XML Security</b><br />
<br />
[brief description here]<br />
<br />
<b>Testing Web Services</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Tools</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Gateways</b><br />
<br />
[brief description here]<br />
<br />
<b>SOA Architecture and Design</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Implementation Platforms</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Top 10 Web Services Chapter</b><br />
<br />
[brief description here]<br />
<br />
<br />
== Goals & Roadmap ==<br />
<br />
Currently the project goals are to:<br />
<br />
* Creation of launch pad layout<br />
<br />
* Create template start page for each subtopic <br />
<br />
* Find solid external resources<br />
<br />
* Recruit volunteer team (2-4 person)<br />
<br />
* For each topic: <br />
<br />
- Create start page for the subtopic topic<br />
<br />
- Gather all existing relevant articles within OWASP<br />
<br />
- Create plan of consolidating all the relevant information<br />
<br />
- Contact authors of relevant articles if change is required<br />
<br />
- Consolidate all information on the topic<br />
<br />
- Find solid external resources<br />
<br />
- Create link back to the main Web Services Security Project launchpad<br />
<br />
* Research way of communicating any updates to web services pages on launchpad<br />
<br />
* Search optimization (both OWASP and Google)<br />
<br />
<br />
A detailed project plan and schedule will be developed shortly and posted here.<br />
<br />
<br />
== Project Guiding Principles ==<br />
<br />
tbd<br />
<br />
== Resources and links ==<br />
<br />
This project is not standalone. This project will draw pieces of information from:<br />
* OWASP Guide<br />
* Other OWASP pages<br />
* OWASP documents<br />
* Relevant external links<br />
...<br />
<br />
== Feedback and Participation: ==<br />
<br />
We hope you find the OWASP Web Services Security Project to be useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to sahba@securitycompass.com.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
<br />
Contributors:<br />
* you? ...<br />
<br />
[[Category:OWASP Project|Web Services Security Project]]<br />
<br />
__NOTOC__<br />
<headertabs/></div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=Category:OWASP_Web_Services_Security_Project&diff=66674Category:OWASP Web Services Security Project2009-07-27T17:12:34Z<p>Subu Ramanathan: Added more tabs pertaining to aspects of web services</p>
<hr />
<div>{{:Template:Orphaned Projects}}<br />
<br />
==== Main ====<br />
<br />
== Introduction ==<br />
Welcome to OWASP Web Services Security Project. This project is designed to serve as a starting point for any web services related inquiries on OWASP. Please note that this is NOT a standalone project and will draw upon relevant resources from other OWASP and external pages.<br />
<br />
== Goals ==<br />
The OWASP Web Services Security Project aims to include and maintain a comprehensive list of links to OWASP and external resources.<br />
<br />
== Web Services Security ==<br />
OWASP related Web Services links:<br />
<br />
[1] [http://www.owasp.org/index.php/Web_Services OWASP Web Services] - A comprehensive introduction to Web Services.<br />
<br />
[2] [http://www.owasp.org/index.php/Theres_More_to_Securing_Web_Services_Systems_Than_WS-Security There is More to Securing Web Services Systems Than WS Security] - Insightful page on Web Services Security.<br />
<br />
[3] [http://www.owasp.org/index.php/.NET_Web_Service_Validation .NET Web Service Validation] - .NET approach to validating Web Services.<br />
<br />
<br />
==== Web Services Standards ====<br />
<br />
== OWASP Web Services Standards Links ==<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Guide_Project OWASP Guide Project] - A comprehensive development guide on building secure Web Service Applications.<br />
<br />
== External Web Services Standards Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Web Services Tools ====<br />
<br />
== OWASP Web Services Tools ==<br />
[http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project WSFuzzer]<br />
<br />
[http://www.owasp.org/index.php/Category:OWASP_Interceptor_Project Interceptor]<br />
<br />
== External Web Services Tools ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Testing Web Services ====<br />
<br />
== OWASP Links ==<br />
<br />
[http://www.owasp.org/index.php/Testing_for_Web_Services Testing Web Services] - Comprehensive OWASP Guide on Testing Web Services.<br />
<br />
== External Links ==<br />
<br />
''This section of the page needs to be updated'' <br />
<br />
<br />
==== Documents & Presentations ====<br />
<br />
== OWASP Documents and Presentations ==<br />
<br />
'''Documents Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:Web_services_security.doc Web Services Security]<br />
<br />
'''Presentations Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:InfoSec_World_2007_-_Web_services_gateways.ppt InfoSec World 2007] - Web Services Gateways presentation from InfoSec World 2007.<br />
<br />
[http://www.owasp.org/index.php/Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt Attacking Web Services] - OWASP AppSec 2005 DC presentation on Attacking Web Services by Alex Stamos.<br />
<br />
[http://www.owasp.org/index.php/Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt WS Security] - OWASP AppSec 2006 Seattle presentation on Web Services Security.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt Secure SOAP Requests] - OWASP AppSec 2006 EU presentation on Inline Approach for Secure SOAP Requests.<br />
<br />
[http://www.owasp.org/index.php/image:Don’t_drop_the_SOAP_OWASP.ppt Don't Drop the SOAP]<br />
<br />
[http://www.owasp.org/index.php/image:AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt OWASP Web Services Project] - OWASP AppSec 2005 DC presentation on the OWASP Web Services Project by Alex Smolen.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt Protecting Web Services] - OWASP AppSec 2006 EU presentation on Protesting Web Services and Applications.<br />
<br />
<br />
== External Documents & Presentations ==<br />
<br />
''This section of the page needs to be updated''<br />
<br />
<br />
==== OLD_PAGE ====<br />
== Welcome to the OWASP Web Services Security Project==<br />
<br />
[a brief about web services security in general and the current state of OWASP in web services security]<br />
<br />
The following document outlines a proposed layout for a new Web Services Security Project for the Open Web Application Security Project (OWASP). <br />
<br />
== Current State ==<br />
<br />
'''Current Relevant OWASP Pages'''<br />
<br />
1. Web Services<br />
a. Securing web services<br />
b. Communication security<br />
c. Passing credentials<br />
d. Ensuring message freshness<br />
e. Protecting message integrity<br />
f. Protecting message confidentiality<br />
g. Access control<br />
h. Audit<br />
i. Web services security hierarchy<br />
i. standard committees<br />
j. SOAP<br />
i. XML signatures and encryption<br />
ii. Security specifications<br />
k. WS-Security standard<br />
i. Organization of the standard<br />
ii. Purpose<br />
l. WS-Security Building blocks<br />
i. How data is passed<br />
ii. Security header’s structure<br />
iii. Types of tokens<br />
iv. Referencing message parts<br />
m. Communication protection mechanisms<br />
i. Integrity<br />
ii. Confidentiality<br />
iii. Freshness<br />
n. Access control mechanisms<br />
i. Identification<br />
ii. Authentication<br />
iii. Authorization<br />
iv. Policy agreement<br />
o. Forming web services chains<br />
i. Incompatible user access control models<br />
ii. Service trust<br />
iii. Secure connections<br />
iv. Synchronization of user directories<br />
v. Domain federation<br />
p. Available implementations<br />
i. .NET – Web services extensions<br />
ii. Java toolkits<br />
iii. Hardware software systems<br />
q. Problems<br />
i. Immaturity of the standards<br />
ii. Performance<br />
iii. Complexity and interoperability<br />
iv. Key management<br />
r. Further reading<br />
<br />
2. A Tale of Two Systems<br />
- case studies of two hypothetical systems, one of which involves openning a mainframe app to the web using a web service, and the risks that are posed.<br />
<br />
3. Theres More to Securing Web Services Systems Than WS-Security<br />
a. What is a web service<br />
b. Web services from the information security perspective<br />
c. Some security implications of this perspective<br />
i. Emergent risks<br />
ii. End-to-end controls<br />
d. Interconnection of systems from different trust domains<br />
i. Some implications of the organization’s risk management process and system development life cycle<br />
ii. Emerging standards for securing web services<br />
iii. WS-Security specifications in process<br />
iv. Trust management revisited<br />
e. References<br />
<br />
4. Web Services Architecture and Security<br />
a. The web services architecture<br />
b. Service oriented architectures and distributed systems<br />
c. Complexity is the enemy of security…<br />
d. The architectural models<br />
e. The policy model<br />
f. The service oriented model<br />
g. The resource oriented model<br />
h. The message oriented model<br />
i. The management model<br />
j. The rest<br />
k. References<br />
<br />
5. Testing for Web Services (from OWASP Testing Guide)<br />
a. XML Structural Testing<br />
b. XML Content-level Testing<br />
c. HTTP GET parameters/REST Testing<br />
d. Naughty SOAP attachments<br />
e. Replay Testing<br />
<br />
6. Image:Web services security.doc<br />
<br />
7. Image:InfoSec_World_2007_-_Web_services_gateways.ppt<br />
<br />
8. Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt<br />
<br />
9. Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt<br />
<br />
10. .NET Web Service Validation<br />
a. Perfomance penalties<br />
b. Downloading<br />
c. Installation<br />
d. Reporting Bugs<br />
e. Use<br />
i. Methods of use<br />
ii. Attributes<br />
iii. Web.config changes<br />
iv. Using validation<br />
v. Using assertions<br />
<br />
11. OWASP WSFuzzer Project<br />
<br />
12. OWASP interceptor Project<br />
<br />
13. OWASP Guide<br />
<br />
14. OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt<br />
<br />
15. Category_talk:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project<br />
<br />
16. Don’t drop the SOAP OWASP.ppt<br />
<br />
17. AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt<br />
<br />
18. AppSec2005DC-Jeff_Williams-OWASP_AppSec_Guide_2.0.ppt<br />
<br />
19. OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt<br />
<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Desired State ==<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Proposed Layout ==<br />
<br />
The proposed OWASP Web Services Security Project will serve as a starting point for any web services-related inquiries on OWASP. It will consist of a launchpad or home page with an introduction to the project, regular updates to pages in the project, and links to project pages and external resources. <br />
<br />
[[Image:WS_Launchpad.jpg|thumb|600px|LEFT|Launchpad Layout (click to see a bigger image)]]<br />
<br />
<b>Introduction</b><br />
<br />
[brief description here]<br />
<br />
<b>Updates</b><br />
<br />
[brief description here]<br />
<br />
<b>External Links</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Pages</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Security Docs/Presentations</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Standards</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Communications</b><br />
<br />
[brief description here]<br />
<br />
<b>XML Security</b><br />
<br />
[brief description here]<br />
<br />
<b>Testing Web Services</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Tools</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Gateways</b><br />
<br />
[brief description here]<br />
<br />
<b>SOA Architecture and Design</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Implementation Platforms</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Top 10 Web Services Chapter</b><br />
<br />
[brief description here]<br />
<br />
<br />
== Goals & Roadmap ==<br />
<br />
Currently the project goals are to:<br />
<br />
* Creation of launch pad layout<br />
<br />
* Create template start page for each subtopic <br />
<br />
* Find solid external resources<br />
<br />
* Recruit volunteer team (2-4 person)<br />
<br />
* For each topic: <br />
<br />
- Create start page for the subtopic topic<br />
<br />
- Gather all existing relevant articles within OWASP<br />
<br />
- Create plan of consolidating all the relevant information<br />
<br />
- Contact authors of relevant articles if change is required<br />
<br />
- Consolidate all information on the topic<br />
<br />
- Find solid external resources<br />
<br />
- Create link back to the main Web Services Security Project launchpad<br />
<br />
* Research way of communicating any updates to web services pages on launchpad<br />
<br />
* Search optimization (both OWASP and Google)<br />
<br />
<br />
A detailed project plan and schedule will be developed shortly and posted here.<br />
<br />
<br />
== Project Guiding Principles ==<br />
<br />
tbd<br />
<br />
== Resources and links ==<br />
<br />
This project is not standalone. This project will draw pieces of information from:<br />
* OWASP Guide<br />
* Other OWASP pages<br />
* OWASP documents<br />
* Relevant external links<br />
...<br />
<br />
== Feedback and Participation: ==<br />
<br />
We hope you find the OWASP Web Services Security Project to be useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to sahba@securitycompass.com.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
<br />
Contributors:<br />
* you? ...<br />
<br />
[[Category:OWASP Project|Web Services Security Project]]<br />
<br />
__NOTOC__<br />
<headertabs/></div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=Category:OWASP_Web_Services_Security_Project&diff=66670Category:OWASP Web Services Security Project2009-07-27T16:42:46Z<p>Subu Ramanathan: Initial update - Added tabs, new introduction, list of OWASP docs and presentations</p>
<hr />
<div>{{:Template:Orphaned Projects}}<br />
<br />
==== Main ====<br />
<br />
== Introduction ==<br />
Welcome to OWASP Web Services Security Project. This project is designed to serve as a starting point for any web services related inquiries on OWASP. Please note that this is NOT a standalone project and will draw upon relevant resources from other OWASP and external pages.<br />
<br />
== Goals ==<br />
The OWASP Web Services Security Project aims to include and maintain a comprehensive list of links to OWASP and external resources.<br />
<br />
== Web Services Security ==<br />
OWASP related Web Services links:<br />
<br />
[1] [http://www.owasp.org/index.php/Web_Services OWASP Web Services] - A comprehensive introduction to Web Services.<br />
<br />
[2] [http://www.owasp.org/index.php/Theres_More_to_Securing_Web_Services_Systems_Than_WS-Security There is More to Securing Web Services Systems Than WS Security] - Insightful page on Web Services Security.<br />
<br />
[3] [http://www.owasp.org/index.php/.NET_Web_Service_Validation .NET Web Service Validation] - .NET approach to validating Web Services.<br />
<br />
==== Documents & Presentations ====<br />
<br />
== OWASP Documents and Presentations ==<br />
<br />
'''Documents Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:Web_services_security.doc Web Services Security]<br />
<br />
'''Presentations Related to Web Services'''<br />
<br />
[http://www.owasp.org/index.php/Image:InfoSec_World_2007_-_Web_services_gateways.ppt InfoSec World 2007] - Web Services Gateways presentation from InfoSec World 2007.<br />
<br />
[http://www.owasp.org/index.php/Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt Attacking Web Services] - OWASP AppSec 2005 DC presentation on Attacking Web Services by Alex Stamos.<br />
<br />
[http://www.owasp.org/index.php/Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt WS Security] - OWASP AppSec 2006 Seattle presentation on Web Services Security.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt Secure SOAP Requests] - OWASP AppSec 2006 EU presentation on Inline Approach for Secure SOAP Requests.<br />
<br />
[http://www.owasp.org/index.php/image:Don’t_drop_the_SOAP_OWASP.ppt Don't Drop the SOAP]<br />
<br />
[http://www.owasp.org/index.php/image:AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt OWASP Web Services Project] - OWASP AppSec 2005 DC presentation on the OWASP Web Services Project by Alex Smolen.<br />
<br />
[http://www.owasp.org/index.php/image:OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt Protecting Web Services] - OWASP AppSec 2006 EU presentation on Protesting Web Services and Applications.<br />
<br />
<br />
==== OLD_PAGE ====<br />
== Welcome to the OWASP Web Services Security Project==<br />
<br />
[a brief about web services security in general and the current state of OWASP in web services security]<br />
<br />
The following document outlines a proposed layout for a new Web Services Security Project for the Open Web Application Security Project (OWASP). <br />
<br />
== Current State ==<br />
<br />
'''Current Relevant OWASP Pages'''<br />
<br />
1. Web Services<br />
a. Securing web services<br />
b. Communication security<br />
c. Passing credentials<br />
d. Ensuring message freshness<br />
e. Protecting message integrity<br />
f. Protecting message confidentiality<br />
g. Access control<br />
h. Audit<br />
i. Web services security hierarchy<br />
i. standard committees<br />
j. SOAP<br />
i. XML signatures and encryption<br />
ii. Security specifications<br />
k. WS-Security standard<br />
i. Organization of the standard<br />
ii. Purpose<br />
l. WS-Security Building blocks<br />
i. How data is passed<br />
ii. Security header’s structure<br />
iii. Types of tokens<br />
iv. Referencing message parts<br />
m. Communication protection mechanisms<br />
i. Integrity<br />
ii. Confidentiality<br />
iii. Freshness<br />
n. Access control mechanisms<br />
i. Identification<br />
ii. Authentication<br />
iii. Authorization<br />
iv. Policy agreement<br />
o. Forming web services chains<br />
i. Incompatible user access control models<br />
ii. Service trust<br />
iii. Secure connections<br />
iv. Synchronization of user directories<br />
v. Domain federation<br />
p. Available implementations<br />
i. .NET – Web services extensions<br />
ii. Java toolkits<br />
iii. Hardware software systems<br />
q. Problems<br />
i. Immaturity of the standards<br />
ii. Performance<br />
iii. Complexity and interoperability<br />
iv. Key management<br />
r. Further reading<br />
<br />
2. A Tale of Two Systems<br />
- case studies of two hypothetical systems, one of which involves openning a mainframe app to the web using a web service, and the risks that are posed.<br />
<br />
3. Theres More to Securing Web Services Systems Than WS-Security<br />
a. What is a web service<br />
b. Web services from the information security perspective<br />
c. Some security implications of this perspective<br />
i. Emergent risks<br />
ii. End-to-end controls<br />
d. Interconnection of systems from different trust domains<br />
i. Some implications of the organization’s risk management process and system development life cycle<br />
ii. Emerging standards for securing web services<br />
iii. WS-Security specifications in process<br />
iv. Trust management revisited<br />
e. References<br />
<br />
4. Web Services Architecture and Security<br />
a. The web services architecture<br />
b. Service oriented architectures and distributed systems<br />
c. Complexity is the enemy of security…<br />
d. The architectural models<br />
e. The policy model<br />
f. The service oriented model<br />
g. The resource oriented model<br />
h. The message oriented model<br />
i. The management model<br />
j. The rest<br />
k. References<br />
<br />
5. Testing for Web Services (from OWASP Testing Guide)<br />
a. XML Structural Testing<br />
b. XML Content-level Testing<br />
c. HTTP GET parameters/REST Testing<br />
d. Naughty SOAP attachments<br />
e. Replay Testing<br />
<br />
6. Image:Web services security.doc<br />
<br />
7. Image:InfoSec_World_2007_-_Web_services_gateways.ppt<br />
<br />
8. Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt<br />
<br />
9. Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt<br />
<br />
10. .NET Web Service Validation<br />
a. Perfomance penalties<br />
b. Downloading<br />
c. Installation<br />
d. Reporting Bugs<br />
e. Use<br />
i. Methods of use<br />
ii. Attributes<br />
iii. Web.config changes<br />
iv. Using validation<br />
v. Using assertions<br />
<br />
11. OWASP WSFuzzer Project<br />
<br />
12. OWASP interceptor Project<br />
<br />
13. OWASP Guide<br />
<br />
14. OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt<br />
<br />
15. Category_talk:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project<br />
<br />
16. Don’t drop the SOAP OWASP.ppt<br />
<br />
17. AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt<br />
<br />
18. AppSec2005DC-Jeff_Williams-OWASP_AppSec_Guide_2.0.ppt<br />
<br />
19. OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt<br />
<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Desired State ==<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Proposed Layout ==<br />
<br />
The proposed OWASP Web Services Security Project will serve as a starting point for any web services-related inquiries on OWASP. It will consist of a launchpad or home page with an introduction to the project, regular updates to pages in the project, and links to project pages and external resources. <br />
<br />
[[Image:WS_Launchpad.jpg|thumb|600px|LEFT|Launchpad Layout (click to see a bigger image)]]<br />
<br />
<b>Introduction</b><br />
<br />
[brief description here]<br />
<br />
<b>Updates</b><br />
<br />
[brief description here]<br />
<br />
<b>External Links</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Pages</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Security Docs/Presentations</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Standards</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Communications</b><br />
<br />
[brief description here]<br />
<br />
<b>XML Security</b><br />
<br />
[brief description here]<br />
<br />
<b>Testing Web Services</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Tools</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Gateways</b><br />
<br />
[brief description here]<br />
<br />
<b>SOA Architecture and Design</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Implementation Platforms</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Top 10 Web Services Chapter</b><br />
<br />
[brief description here]<br />
<br />
<br />
== Goals & Roadmap ==<br />
<br />
Currently the project goals are to:<br />
<br />
* Creation of launch pad layout<br />
<br />
* Create template start page for each subtopic <br />
<br />
* Find solid external resources<br />
<br />
* Recruit volunteer team (2-4 person)<br />
<br />
* For each topic: <br />
<br />
- Create start page for the subtopic topic<br />
<br />
- Gather all existing relevant articles within OWASP<br />
<br />
- Create plan of consolidating all the relevant information<br />
<br />
- Contact authors of relevant articles if change is required<br />
<br />
- Consolidate all information on the topic<br />
<br />
- Find solid external resources<br />
<br />
- Create link back to the main Web Services Security Project launchpad<br />
<br />
* Research way of communicating any updates to web services pages on launchpad<br />
<br />
* Search optimization (both OWASP and Google)<br />
<br />
<br />
A detailed project plan and schedule will be developed shortly and posted here.<br />
<br />
<br />
== Project Guiding Principles ==<br />
<br />
tbd<br />
<br />
== Resources and links ==<br />
<br />
This project is not standalone. This project will draw pieces of information from:<br />
* OWASP Guide<br />
* Other OWASP pages<br />
* OWASP documents<br />
* Relevant external links<br />
...<br />
<br />
== Feedback and Participation: ==<br />
<br />
We hope you find the OWASP Web Services Security Project to be useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to sahba@securitycompass.com.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
<br />
Contributors:<br />
* you? ...<br />
<br />
[[Category:OWASP Project|Web Services Security Project]]<br />
<br />
__NOTOC__<br />
<headertabs/></div>Subu Ramanathanhttps://wiki.owasp.org/index.php?title=Category:OWASP_Web_Services_Security_Project&diff=66663Category:OWASP Web Services Security Project2009-07-27T15:50:21Z<p>Subu Ramanathan: Added Subu Ramanathan to the list of project leads</p>
<hr />
<div>{{:Template:Orphaned Projects}}<br />
<br />
== Welcome to the OWASP Web Services Security Project==<br />
<br />
[a brief about web services security in general and the current state of OWASP in web services security]<br />
<br />
The following document outlines a proposed layout for a new Web Services Security Project for the Open Web Application Security Project (OWASP). <br />
<br />
== Current State ==<br />
<br />
'''Current Relevant OWASP Pages'''<br />
<br />
1. Web Services<br />
a. Securing web services<br />
b. Communication security<br />
c. Passing credentials<br />
d. Ensuring message freshness<br />
e. Protecting message integrity<br />
f. Protecting message confidentiality<br />
g. Access control<br />
h. Audit<br />
i. Web services security hierarchy<br />
i. standard committees<br />
j. SOAP<br />
i. XML signatures and encryption<br />
ii. Security specifications<br />
k. WS-Security standard<br />
i. Organization of the standard<br />
ii. Purpose<br />
l. WS-Security Building blocks<br />
i. How data is passed<br />
ii. Security header’s structure<br />
iii. Types of tokens<br />
iv. Referencing message parts<br />
m. Communication protection mechanisms<br />
i. Integrity<br />
ii. Confidentiality<br />
iii. Freshness<br />
n. Access control mechanisms<br />
i. Identification<br />
ii. Authentication<br />
iii. Authorization<br />
iv. Policy agreement<br />
o. Forming web services chains<br />
i. Incompatible user access control models<br />
ii. Service trust<br />
iii. Secure connections<br />
iv. Synchronization of user directories<br />
v. Domain federation<br />
p. Available implementations<br />
i. .NET – Web services extensions<br />
ii. Java toolkits<br />
iii. Hardware software systems<br />
q. Problems<br />
i. Immaturity of the standards<br />
ii. Performance<br />
iii. Complexity and interoperability<br />
iv. Key management<br />
r. Further reading<br />
<br />
2. A Tale of Two Systems<br />
- case studies of two hypothetical systems, one of which involves openning a mainframe app to the web using a web service, and the risks that are posed.<br />
<br />
3. Theres More to Securing Web Services Systems Than WS-Security<br />
a. What is a web service<br />
b. Web services from the information security perspective<br />
c. Some security implications of this perspective<br />
i. Emergent risks<br />
ii. End-to-end controls<br />
d. Interconnection of systems from different trust domains<br />
i. Some implications of the organization’s risk management process and system development life cycle<br />
ii. Emerging standards for securing web services<br />
iii. WS-Security specifications in process<br />
iv. Trust management revisited<br />
e. References<br />
<br />
4. Web Services Architecture and Security<br />
a. The web services architecture<br />
b. Service oriented architectures and distributed systems<br />
c. Complexity is the enemy of security…<br />
d. The architectural models<br />
e. The policy model<br />
f. The service oriented model<br />
g. The resource oriented model<br />
h. The message oriented model<br />
i. The management model<br />
j. The rest<br />
k. References<br />
<br />
5. Testing for Web Services (from OWASP Testing Guide)<br />
a. XML Structural Testing<br />
b. XML Content-level Testing<br />
c. HTTP GET parameters/REST Testing<br />
d. Naughty SOAP attachments<br />
e. Replay Testing<br />
<br />
6. Image:Web services security.doc<br />
<br />
7. Image:InfoSec_World_2007_-_Web_services_gateways.ppt<br />
<br />
8. Image:AppSec2005DC-Alex_Stamos-Attacking_Web_Services.ppt<br />
<br />
9. Image:OWASPAppSec2006Seattle_Web_Services_Security.ppt<br />
<br />
10. .NET Web Service Validation<br />
a. Perfomance penalties<br />
b. Downloading<br />
c. Installation<br />
d. Reporting Bugs<br />
e. Use<br />
i. Methods of use<br />
ii. Attributes<br />
iii. Web.config changes<br />
iv. Using validation<br />
v. Using assertions<br />
<br />
11. OWASP WSFuzzer Project<br />
<br />
12. OWASP interceptor Project<br />
<br />
13. OWASP Guide<br />
<br />
14. OWASPAppSecEU2006_InlineApproachforSecureSOAPRequests.ppt<br />
<br />
15. Category_talk:OWASP_XML_Security_Gateway_Evaluation_Criteria_Project<br />
<br />
16. Don’t drop the SOAP OWASP.ppt<br />
<br />
17. AppSec2005DC-Alex_Smolen-OWASP_WebServices_Project.ppt<br />
<br />
18. AppSec2005DC-Jeff_Williams-OWASP_AppSec_Guide_2.0.ppt<br />
<br />
19. OWASPAppSecEU2006_ProtectingWebServicesAndAapplications.ppt<br />
<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Desired State ==<br />
<br />
'''Content'''<br />
<br />
- Completeness<br />
<br />
- Relevance<br />
<br />
- Target audience<br />
<br />
'''Organization'''<br />
<br />
- Ease of navigation<br />
<br />
- Ease of locating a specific topic<br />
<br />
- Communication of updates<br />
<br />
'''Search'''<br />
<br />
-<br />
<br />
== Proposed Layout ==<br />
<br />
The proposed OWASP Web Services Security Project will serve as a starting point for any web services-related inquiries on OWASP. It will consist of a launchpad or home page with an introduction to the project, regular updates to pages in the project, and links to project pages and external resources. <br />
<br />
[[Image:WS_Launchpad.jpg|thumb|600px|LEFT|Launchpad Layout (click to see a bigger image)]]<br />
<br />
<b>Introduction</b><br />
<br />
[brief description here]<br />
<br />
<b>Updates</b><br />
<br />
[brief description here]<br />
<br />
<b>External Links</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Pages</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Security Docs/Presentations</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Standards</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Communications</b><br />
<br />
[brief description here]<br />
<br />
<b>XML Security</b><br />
<br />
[brief description here]<br />
<br />
<b>Testing Web Services</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Tools</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Gateways</b><br />
<br />
[brief description here]<br />
<br />
<b>SOA Architecture and Design</b><br />
<br />
[brief description here]<br />
<br />
<b>WS Implementation Platforms</b><br />
<br />
[brief description here]<br />
<br />
<b>OWASP Top 10 Web Services Chapter</b><br />
<br />
[brief description here]<br />
<br />
<br />
== Goals & Roadmap ==<br />
<br />
Currently the project goals are to:<br />
<br />
* Creation of launch pad layout<br />
<br />
* Create template start page for each subtopic <br />
<br />
* Find solid external resources<br />
<br />
* Recruit volunteer team (2-4 person)<br />
<br />
* For each topic: <br />
<br />
- Create start page for the subtopic topic<br />
<br />
- Gather all existing relevant articles within OWASP<br />
<br />
- Create plan of consolidating all the relevant information<br />
<br />
- Contact authors of relevant articles if change is required<br />
<br />
- Consolidate all information on the topic<br />
<br />
- Find solid external resources<br />
<br />
- Create link back to the main Web Services Security Project launchpad<br />
<br />
* Research way of communicating any updates to web services pages on launchpad<br />
<br />
* Search optimization (both OWASP and Google)<br />
<br />
<br />
A detailed project plan and schedule will be developed shortly and posted here.<br />
<br />
<br />
== Project Guiding Principles ==<br />
<br />
tbd<br />
<br />
== Resources and links ==<br />
<br />
This project is not standalone. This project will draw pieces of information from:<br />
* OWASP Guide<br />
* Other OWASP pages<br />
* OWASP documents<br />
* Relevant external links<br />
...<br />
<br />
== Feedback and Participation: ==<br />
<br />
We hope you find the OWASP Web Services Security Project to be useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to sahba@securitycompass.com.<br />
<br />
== Project Contributors ==<br />
<br />
If you contribute to this Project, please add your name here.<br><br />
Project Leads:<br />
* [[User:nbhalla| Nish Bhalla]]<br />
* [[User:skazerooni| Sahba Kazerooni]]<br />
* [[User:Subu Ramanathan| Subu Ramanathan]]<br />
<br />
Contributors:<br />
* you? ...<br />
<br />
[[Category:OWASP Project|Web Services Security Project]]</div>Subu Ramanathan