Category:Principle - Revision history

Riotaro OKADA: /* References */

2015-07-29T05:58:26Z

‎References

Brennan at 18:28, 9 December 2011

2011-12-09T18:28:49Z

Brennan: /* References */

2011-03-26T00:50:26Z

‎References

Keroz: /* References */

2009-05-21T11:48:40Z

‎References

Leocavallari at 22:43, 8 May 2009

2009-05-08T22:43:09Z

KirstenS: /* References */

2009-03-04T16:37:08Z

‎References

KirstenS at 13:20, 7 September 2008

2008-09-07T13:20:44Z

KirstenS: /* References */

2008-09-07T13:20:10Z

‎References

Mchalmers at 00:28, 27 July 2008

2008-07-27T00:28:30Z

Cjberg: /* References */

2008-06-26T15:19:46Z

‎References

@@ Line 29: / Line 29: @@
 * [http://web.mit.edu/Saltzer/www/publications/protection/Basic.html Saltzer and Schroeder] (see section 3)
 * [http://www.ranum.com/security/computer_security/editorials/dumb/index.html The Six Dumbest Ideas in Computer Security]
-* [http://news.com.com/2008-1082-276319.html Gary McGraw's 10 steps to secure software]
+* [http://www.zdnet.com/article/gary-mcgraw-10-steps-to-secure-software/ Gary McGraw's 10 steps to secure software]
 * [[OWASP Guide Project|OWASP Development Guide Project]]
 * [http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf Engineering Principles for Information Technology Security (EP-ITS), by Gary Stoneburner, Clark Hayden, and Alexis, NIST Special Publication (SP) 800-27 (PDF)]

← Older revision		Revision as of 18:28, 9 December 2011
Line 1:		Line 1:
		+	{{Social Media Links}}
	This category is for tagging articles related to application security principles.		This category is for tagging articles related to application security principles.

@@ Line 27: / Line 27: @@
 ==References==
 * [http://web.mit.edu/Saltzer/www/publications/protection/Basic.html Saltzer and Schroeder] (see section 3)
 * [http://www.ranum.com/security/computer_security/editorials/dumb/index.html The Six Dumbest Ideas in Computer Security]
 * [http://news.com.com/2008-1082-276319.html Gary McGraw's 10 steps to secure software]

@@ Line 27: / Line 27: @@
 ==References==
 * [http://web.mit.edu/Saltzer/www/publications/protection/Basic.html Saltzer and Schroeder] (see section 3)
-* [http://www.emergentchaos.com/starwars.html Saltzer and Schroeder Applied to ''Star Wars''] [[category:FIXME|broken link]]
+* [http://www.emergentchaos.com/archives/cat_star_wars_-_security_principles.html Saltzer and Schroeder Applied to ''Star Wars'']
 * [http://www.ranum.com/security/computer_security/editorials/dumb/index.html The Six Dumbest Ideas in Computer Security]
 * [http://news.com.com/2008-1082-276319.html Gary McGraw's 10 steps to secure software]

← Older revision		Revision as of 22:43, 8 May 2009
Line 37:		Line 37:
	{{Template:PutInCategory}}		{{Template:PutInCategory}}

−	~~[[Category:OWASP Honeycomb Project]]~~
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

← Older revision		Revision as of 13:20, 7 September 2008
Line 37:		Line 37:
	{{Template:PutInCategory}}		{{Template:PutInCategory}}

		+	[[Category:OWASP Honeycomb Project]]
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

@@ Line 30: / Line 30: @@
 * [http://www.ranum.com/security/computer_security/editorials/dumb/index.html The Six Dumbest Ideas in Computer Security]
 * [http://news.com.com/2008-1082-276319.html Gary McGraw's 10 steps to secure software]
-* [[OWASP Guide Project]]
+* [[OWASP Guide Project|OWASP Development Guide Project]]
 * [http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf Engineering Principles for Information Technology Security (EP-ITS), by Gary Stoneburner, Clark Hayden, and Alexis, NIST Special Publication (SP) 800-27 (PDF)]
 * [http://www.developer.com/java/data/article.php/10932_3667601_1 Secure Design Principles] from "Foundations of Security: What Every Programmer Needs To Know" by Neil Daswani, Christoph Kern, and Anita Kesavan ([http://www.biblio.com/isbn/1590597842.html ISBN 1590597842])
@@ Line 37: / Line 37: @@
 {{Template:PutInCategory}}
-[[Category:OWASP Honeycomb Project]]
+[[Category:OWASP ASDR Project]]

@@ Line 1: / Line 1: @@
 This category is for tagging articles related to application security principles.
-==What's an application security principle?==
+==What is an application security principle?==
+Application security principles are collections of desirable application properties, behaviors, designs and implementation practices that attempt to reduce the likelihood of threat realization and impact should that threat be realized. Security principles are language-independent, architecturally-neutral primitives that can be leveraged within most software development methodologies to design and construct applications.
 Principles are important because they help us make security decisions in new situations with the same basic ideas. By considering each of these principles, we can derive security requirements, make architecture and implementation decisions, and identify possible weaknesses in systems.
-The important thing to remember is that in order to be useful, principles must be evaluated, interpreted, and applied to address a specific problem. Although principles can serve as general guidelines, simply telling a software developer that their software must "[[fail securely]]" or that they should do "[[defense in depth]]" won't mean that much.
+The important thing to remember is that in order to be useful, principles must be evaluated, interpreted and applied to address a specific problem. Although principles can serve as general guidelines, simply telling a software developer that their software must "[[fail securely]]" or that they should do "[[defense in depth]]" won't mean that much.
 ==Some proven application security principles==
 * Apply [[defense in depth]] (complete mediation)
-*Apply [[defense in depth]] (complete mediation)
+* Use a [[positive security model]] (fail-safe defaults, minimize attack surface)
-*Use a [[positive security model]] (fail safe defaults)(minimize attack surface)
+* [[Fail securely]]
-*[[Fail securely]]
+* Run with [[least privilege]]
-*Run with [[least privilege]]
+* [[Avoid security by obscurity]] (open design)
-*[[Avoid security by obscurity]] (open design)
+* [[Keep security simple]] (verifiable, economy of mechanism)
-*[[Keep security simple]] (verifiable)(economy of mechanism)
+* [[Detect intrusions]] (compromise recording)
-*[[Detect intrusions]] (compromise recording)
+* [[Don’t trust infrastructure]]
-*[[Don’t trust infrastructure]]
+* [[Don’t trust services]]
-*[[Don’t trust services]]
+* [[Establish secure defaults]] (psychological acceptability)
 ==Applying security principles==
-Consider the exercise of designing a simple web application that allows people to send email to a friend. By evaluating and interpreting each principle, we can arrive at many of the threats to this application and ultimately derive a set of protection requirements. We want to end up with a complete list of what is required to offer this service securely.
+<!-- TBD: walk-through -->
 ==References==
+* [http://web.mit.edu/Saltzer/www/publications/protection/Basic.html Saltzer and Schroeder] (see section 3)
-* [http://web.mit.edu/Saltzer/www/publications/protection/Basic.html Saltzer and Schroeder(see Section 3)]
+* [http://www.emergentchaos.com/starwars.html Saltzer and Schroeder Applied to ''Star Wars'']
 * [http://www.ranum.com/security/computer_security/editorials/dumb/index.html The Six Dumbest Ideas in Computer Security]
+* [http://news.com.com/2008-1082-276319.html Gary McGraw's 10 steps to secure software]
 * [[OWASP Guide Project]]
-* Engineering Principles for Information Technology Security (EP-ITS), by Gary Stoneburner, Clark Hayden, and Alexis, NIST Special Publication (SP) 800-27 [http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf PDF version][http://csrc.nist.gov/publications/nistbul/itl06-2001.txt TXT overview version]
+{{Template:PutInCategory}}
 [[Category:OWASP Honeycomb Project]]

← Older revision		Revision as of 15:19, 26 June 2008
Line 45:		Line 45:

	* [http://www.developer.com/java/data/article.php/10932_3667601_1 Secure Design Principles Book Chapter] from "Foundations of Security: What Every Programmer Needs To Know" by Neil Daswani, Christoph Kern, and Anita Kesavan ([http://www.biblio.com/isbn/1590597842.html ISBN 1590597842])		* [http://www.developer.com/java/data/article.php/10932_3667601_1 Secure Design Principles Book Chapter] from "Foundations of Security: What Every Programmer Needs To Know" by Neil Daswani, Christoph Kern, and Anita Kesavan ([http://www.biblio.com/isbn/1590597842.html ISBN 1590597842])
		+
		+	* [http://assuredbydesign.com/haa/ High-Assurance Design], by Cliff Berg, 2005, Addison-Wesley. Foreword by Peter G. Neumann. Design principles and patterns for secure and reliable design.

	[[Category:OWASP Honeycomb Project]]		[[Category:OWASP Honeycomb Project]]