CISO AppSec Guide: Quick Reference to OWASP Guides & Projects

< Back to the Application Security Guide For CISOs

Appendix B: Quick Reference to OWASP Guides & Other Projects

This quick reference maps typical CISO's functions and information security domains to different sections of the OWASP' CISO Guide and relevant OWASP projects.

CISO Function	Security Domain	OWASP CISO Guide	OWASP Projects
Develop and implement policies, standards and guidelines for application security	Standards and Policies	I-3 "Information Security Standards, Policies and Compliance"	Development Guide - Policy Frameworks Project CLASP - Identify Global Security Policy Project SAMM - Policy & Compliance Code Review Guide - Code Reviews and Compliance
Develop, implement and manage application security governance	Governance	III-3 "Application Security Governance, Risk and Compliance"	Project SAMM - Governance Project ASVS - How to Write Job Requisitions
Develop and implement software security development and security testing processes	Security Engineering Processes	III-4 "Targeting Software Security Activities and S-SDLC Processes" III-5 "How to Choose the Right OWASP Projects and Tools For Your Organization"	Development Guide Code Review Guide Secure Coding Practices Testing Guide Comprehensive Lightweight Application Security Process (CLASP) Introduction CLASP Concepts Software Assurance Maturity Model (SAMM) Testing Guide - Tools Project Application Security Verification Standard Project (ASVS)
Develop, articulate and implement a risk management strategy for applications	Risk Strategy	I-4 "Risk Management Strategies" II "Criteria for Managing Application Security Risks" III-4 "Security Strategy"	SAMM - Strategy & Metrics Application Threat Modeling - Mitigation Strategies
Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited	Audit & Compliance	I-3 "Capturing Application Security Requirements" III-3 "Addressing CISO's Application Security Functions"	Application Security Verification Standards CLASP - Capture Security Requirements SAMM - Security Requirements Testing Guide - Security Requirements Test Derivation Project Cornucopia Project Secure Software Contract Annex
Measure and monitor security and risks of application assets within the organization	Risk Metrics & Monitoring	IV "Selection of Metrics for Managing Risks & Application Security Investments"	CLASP - Define and Monitor Metrics SAMM - Strategy & Metrics Types of Application Security Metrics
Define, identify and assess the inherent security of critical application assets, assess the threats, vulnerabilities, business impacts and recommend countermeasures/corrective actions	Risk Analysis & Management	I-4 "Risk Management" II "Criteria for Managing Application Security Risks"	Project Top Ten Web Application Risks Project Top Ten Mobile Application Risks Project Top Ten Cloud Risks ASVS - Implementation of NIST Risk Management Verification Activities Risk Rating Methodology Threat Risk Modelling Application Threat Modelling
Assess procurement of new application processes, services, technologies and security tools	Procurement	III-4 "Assess Risks before Procurement of Third Party Components"	Project Secure Software Contract Annex ASVS - Verification of Contract Requirements
Oversee the training on application security for development, operational and information security teams	Security Training	III-5 "People, Processes and Technology"	Project CLASP Institute Awareness Programs Education Projects Appsec Training Videos Conference Videos Application Security FAQs
Develop, articulate and implement continuity planning/disaster recovery	Business Continuity / Disaster Recovery	III-3 "Addressing CISO's Application Security Functions"	Cloud Business Continuity and Resiliency
Investigate and analyse suspected and actual application security incidents and recommend corrective actions	Vulnerability Management & Incident Response	I-4 "Addressing the Business Concerns after a Security Incident"	SAMM Vulnerability Management CLASP - Manage Security Issue Disclosure Process .NET Incident Response