Category talk:OWASP RFP-Criteria - Revision history

Brennan: Blanked the page

2010-06-16T04:59:54Z

Blanked the page

Brennan at 02:20, 26 May 2010

2010-05-26T02:20:49Z

Brennan at 12:28, 8 May 2010

2010-05-08T12:28:01Z

Joe Aguirre at 20:44, 21 April 2010

2010-04-21T20:44:57Z

Joe Aguirre at 15:36, 20 April 2010

2010-04-20T15:36:48Z

Joe Aguirre at 20:10, 19 April 2010

2010-04-19T20:10:34Z

Dre at 15:56, 17 April 2010

2010-04-17T15:56:46Z

Brennan at 13:47, 17 April 2010

2010-04-17T13:47:28Z

Walter Houser at 22:15, 16 April 2010

2010-04-16T22:15:18Z

Walter Houser at 20:24, 16 April 2010

2010-04-16T20:24:13Z

← Older revision		Revision as of 04:59, 16 June 2010
Line 1:		Line 1:
−	~~PURPOSE <br> List of questions/discussion points for the project.<br>~~
−	~~(if your wondering how to add your comments to this and get involved.. create a account its FREE and its a wiki)~~

−	* Proposed discussion and feedback from the Software Assurance (SwA) Community on June 22 at 3 pm with the SwA Acquisition and Outsourcing Working Group. We are meeting at the Booz Allen Hamilton Virginia Square Facility at 3811 N. Fairfax Drive, Suite 600, Arlington, Virginia 22203. --[[User:Walter Houser\|Walter Houser]] 17:59, 22 May 2010 (UTC) <br>
−	~~Answer: Unable to attend this event will be at [http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden OWASP Sweden] ----~~
−
−	~~Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser\|Walter Houser]] 20:00, 16 April 2010 (UTC)~~
−	~~Answer: YES --[[User:Brennan\|jinxpuppy]] 02:20, 26 May 2010 (UTC)~~
−
−	1. Describe the implementation process for your product/service - is software or hardware required? Vendor training? Consulting? Any additional personnel costs on customer side? How many personnel are needed? What are their skill sets and experience levels. --[[User:Walter Houser\|Walter Houser]] 20:16, 16 April 2010 (UTC) The time to implement is meaningful only in the context of the amount and quality of resources and their costs.
−
−	2. Do you have a training and support program for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education? --[[User:Walter Houser\|Walter Houser]] 20:23, 16 April 2010 (UTC) The salesman will always answer yes to "Can you...?" questions.
−	~~Answer: This question was focused on the service offered that what training is required to operate it and what support programs are available~~
−	~~----~~
−
−
−	~~4. What is the most challenging element ...? Too softball a question. --[[User:Walter Houser\|Walter Houser]] 20:08, 16 April 2010 (UTC) Ask instead~~
−
−	~~4. What are the critical success factors for ...~~
−
−	~~Answer: Good need to dive deeper here for more questions and add to the list~~
−	~~----~~
−
−
−	~~ADDITIONAL LINKS <br>~~
−
−	~~#http://zeltser.com/security-assessments/security-assessment-rfp-cheat-sheet.html~~
−
−	~~5. Does the product/service integrate with any IPS solutions(custom filters)? [[User:Joe Aguirre\|Joe Aguirre]] 20:10, 19 April 2010 (UTC)~~
−	~~+ Web Application Firewalls~~
−	~~<br>~~
−
−	6. Related to question #11, asking how "all existing vulnerabilities" are discovered may need to be revisited. It may make more sense to ask how the product/solution increases its vulnerability identification rate relative to the competition. [[User:Joe Aguirre\|Joe Aguirre]] 20:10, 19 April 2010 (UTC)
−	~~Blackbox testing of custom code on a website is finding zero-day issues in a website that was designed for a single customer hence complete coverage of the attack surface needs to be clarified.~~
−	~~<br>~~
−
−	7. Some additional ideas that may be useful could be: options for user administration, supported federated identity management solutions, access control granularity, and scan scheduling. [[User:Joe Aguirre\|Joe Aguirre]] 15:36, 20 April 2010 (UTC)
−	~~<br>~~
−
−	~~8. Question #25 - Instead of listing the WASC categories, it would be cleaner to provide links to both the WASC and OWASP Top Ten lists. [[User:Joe Aguirre\|Joe Aguirre]] 20:44, 21 April 2010 (UTC)~~
−	~~Answer: [http://projects.webappsec.org/Threat-Classification WASC] is classes of attack OWASP is Top 10 Risks very different from a testing perspective.~~
−	~~<br>~~

@@ Line 1: / Line 1: @@
 PURPOSE <br> List of questions/discussion points for the project.<br>
 (if your wondering how to add your comments to this and get involved.. create a account its FREE and its a wiki)
 Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser|Walter Houser]] 20:00, 16 April 2010 (UTC)
-. Describe the implementation process for your product/service - is software or hardware required? Vendor training? Consulting? Any additional personnel costs on customer side? How many personnel are needed? What are their skill sets and expereince levels. --[[User:Walter Houser|Walter Houser]] 20:16, 16 April 2010 (UTC) The time to implement is meaningful only in the context of the amount and quality of resources and their costs.
+. Do you have a training and support program for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education? --[[User:Walter Houser|Walter Houser]] 20:23, 16 April 2010 (UTC) The salesman will always answer yes to "Can you...?" questions.
 . What is the most challenging element ...? Too softball a question. --[[User:Walter Houser|Walter Houser]] 20:08, 16 April 2010 (UTC) Ask instead
 . What are the critical success factors for ...
 ADDITIONAL LINKS <br>
@@ Line 17: / Line 28: @@
 . Does the product/service integrate with any IPS solutions(custom filters)? [[User:Joe Aguirre|Joe Aguirre]] 20:10, 19 April 2010 (UTC)
 <br>
 . Related to question #11, asking how "all existing vulnerabilities" are discovered may need to be revisited. It may make more sense to ask how the product/solution increases its vulnerability identification rate relative to the competition. [[User:Joe Aguirre|Joe Aguirre]] 20:10, 19 April 2010 (UTC)
 <br>
@@ Line 26: / Line 39: @@
 . Question #25 - Instead of listing the WASC categories, it would be cleaner to provide links to both the WASC and OWASP Top Ten lists. [[User:Joe Aguirre|Joe Aguirre]] 20:44, 21 April 2010 (UTC)
 <br>

← Older revision		Revision as of 12:28, 8 May 2010
Line 1:		Line 1:
	PURPOSE <br> List of questions/discussion points for the project.<br>		PURPOSE <br> List of questions/discussion points for the project.<br>
		+	(if your wondering how to add your comments to this and get involved.. create a account its FREE and its a wiki)

	Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser\|Walter Houser]] 20:00, 16 April 2010 (UTC)		Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser\|Walter Houser]] 20:00, 16 April 2010 (UTC)

← Older revision		Revision as of 20:44, 21 April 2010
Line 22:		Line 22:

	7. Some additional ideas that may be useful could be: options for user administration, supported federated identity management solutions, access control granularity, and scan scheduling. [[User:Joe Aguirre\|Joe Aguirre]] 15:36, 20 April 2010 (UTC)		7. Some additional ideas that may be useful could be: options for user administration, supported federated identity management solutions, access control granularity, and scan scheduling. [[User:Joe Aguirre\|Joe Aguirre]] 15:36, 20 April 2010 (UTC)
		+	<br>
		+
		+	8. Question #25 - Instead of listing the WASC categories, it would be cleaner to provide links to both the WASC and OWASP Top Ten lists. [[User:Joe Aguirre\|Joe Aguirre]] 20:44, 21 April 2010 (UTC)
	<br>		<br>

@@ Line 1: / Line 1: @@
-PURPOSE <br />
+PURPOSE <br> List of questions/discussion points for the project.<br>
-Are these questions for use during the market survey or product evaluation steps of an acquisition?  --[[User:Walter Houser|Walter Houser]] 20:00, 16 April 2010 (UTC)
+Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser|Walter Houser]] 20:00, 16 April 2010 (UTC)
-. Describe the implementation process for your product/service - is software or hardware required?  Vendor training?  Consulting?  Any additional personnel costs on customer side?  How many personnel are needed?  What are their skill sets and expereince levels.  --[[User:Walter Houser|Walter Houser]] 20:16, 16 April 2010 (UTC) The time to implement is meaningful only in the context of the amount and quality of resources and their costs.
+. Describe the implementation process for your product/service - is software or hardware required? Vendor training? Consulting? Any additional personnel costs on customer side? How many personnel are needed? What are their skill sets and expereince levels. --[[User:Walter Houser|Walter Houser]] 20:16, 16 April 2010 (UTC) The time to implement is meaningful only in the context of the amount and quality of resources and their costs.
 . Do you have a training and support program for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education? --[[User:Walter Houser|Walter Houser]] 20:23, 16 April 2010 (UTC) The saleman will always answer yes to "Can you...?" questions.
-. What is the most challenging element ...?  Too softball a question.  --[[User:Walter Houser|Walter Houser]] 20:08, 16 April 2010 (UTC) Ask instead
+. What is the most challenging element ...? Too softball a question. --[[User:Walter Houser|Walter Houser]] 20:08, 16 April 2010 (UTC) Ask instead
 . What are the critical success factors for ...
-ADDITIONAL LINKS <br />
+ADDITIONAL LINKS <br>
 <br>
 <br>

← Older revision		Revision as of 20:10, 19 April 2010
Line 14:		Line 14:
	ADDITIONAL LINKS <br />		ADDITIONAL LINKS <br />
	<li />http://zeltser.com/security-assessments/security-assessment-rfp-cheat-sheet.html		<li />http://zeltser.com/security-assessments/security-assessment-rfp-cheat-sheet.html
		+
		+	<br>
		+	<br>
		+	5. Does the product/service integrate with any IPS solutions(custom filters)? [[User:Joe Aguirre\|Joe Aguirre]] 20:10, 19 April 2010 (UTC)
		+	<br>
		+	<br>
		+	6. Related to question #11, asking how "all existing vulnerabilities" are discovered may need to be revisited. It may make more sense to ask how the product/solution increases its vulnerability identification rate relative to the competition. [[User:Joe Aguirre\|Joe Aguirre]] 20:10, 19 April 2010 (UTC)

← Older revision		Revision as of 13:47, 17 April 2010
Line 1:		Line 1:
		+	PURPOSE<br>
		+	List of questions/discussion points for the project.<br>
		+
	Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser\|Walter Houser]] 20:00, 16 April 2010 (UTC)		Are these questions for use during the market survey or product evaluation steps of an acquisition? --[[User:Walter Houser\|Walter Houser]] 20:00, 16 April 2010 (UTC)

← Older revision		Revision as of 22:15, 16 April 2010
Line 5:		Line 5:
	2. Do you have a training and support program for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education? --[[User:Walter Houser\|Walter Houser]] 20:23, 16 April 2010 (UTC) The saleman will always answer yes to "Can you...?" questions.		2. Do you have a training and support program for your product or service? Is it required? If so, what is the typical amount of time and cost associated with training/education? --[[User:Walter Houser\|Walter Houser]] 20:23, 16 April 2010 (UTC) The saleman will always answer yes to "Can you...?" questions.

−	4. What is the most challenging element ...? Too softball a question. --[[User:Walter Houser\|Walter Houser]] 20:08, 16 April 2010 (UTC)	+	4. What is the most challenging element ...? Too softball a question. --[[User:Walter Houser\|Walter Houser]] 20:08, 16 April 2010 (UTC) Ask instead
		+
		+	4. What are the critical success factors for ...