ESAPI Documentation - Revision history

Wichers: /* Web Pages */

2010-12-08T00:44:57Z

‎Web Pages

Wichers: /* Web Pages */

2010-12-08T00:35:07Z

‎Web Pages

Wichers: /* Documentation Plan */

2010-12-08T00:31:30Z

‎Documentation Plan

Wichers: /* Smaller Documents */

2008-12-11T19:54:01Z

‎Smaller Documents

Wichers: /* Larger Documents */

2008-12-11T19:50:25Z

‎Larger Documents

Wichers: /* Larger Documents */

2008-12-11T19:38:14Z

‎Larger Documents

Wichers: /* Larger Documents */

2008-12-11T19:27:35Z

‎Larger Documents

Wichers: /* Smaller Documents */

2008-12-11T19:18:13Z

‎Smaller Documents

Wichers: /* Documentation Plan */

2008-12-11T19:17:09Z

‎Documentation Plan

SteveChristey: /* Documentation Plan */

2008-12-11T19:11:43Z

‎Documentation Plan

@@ Line 87: / Line 87: @@
 * How will ESAPI be updated and released.
 * Features Roadmap
-* Where to get ESAPI source and libraries
+* Where to get ESAPI source and libraries - a list of language specific libraries is here: http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=Downloads
-* How to build ESAPI from source
+* How to build ESAPI from source - See: http://www.owasp.org/index.php/ESAPI-Building and: http://www.owasp.org/index.php/ESAPI-BuildingWithEclipse
 * How to integrate ESAPI into your project
 * How to contribute to ESAPI

@@ Line 84: / Line 84: @@
 === Web Pages ===
-* Revamp the ESAPI Website
+* Revamp the ESAPI Website (lots of details needed on this)
 * How will ESAPI be updated and released.
-* Features List
+* Features Roadmap
 <br>
 === Other Documents ===
 * ESAPI Architecture/Design Guideline
 * Assurance Argument [[ESAPI_Assurance]]

@@ Line 6: / Line 6: @@
 Proposed Documents
 === Smaller Documents ===
-''ESAPI Executive Overview''
+==== ESAPI Executive Overview====
   Audience: Executives<br>
   Purpose: To provide executives with an understanding of:
@@ Line 19: / Line 21: @@
 Outline: (See Purpose)<br>
 <br>
-''FAQ (For non-users)''
+==== FAQ (For non-users) ====
   Audience: Potential users of ESAPI<br>
   Purpose: To provide 'quick' hit, information about ESAPI
   Topics: Summary of main points in the Executive Overview
-''FAQ (For people using ESAPI)''
+==== FAQ (For people using ESAPI) ====
   Audience (Technical people using ESAPI)<br>
   Purpose: To provide 'quick' hit information about how to use ESAPI, and add to or integrate ESAPI with existing security controls.
@@ Line 34: / Line 36: @@
 === Larger Documents ===
-''Getting Started Guide''
+==== Getting Started Guide ====
   Audience: Developers new to ESAPI<br>
   Purpose: Explain to these developers how to start immediately using ESAPI
@@ Line 45: / Line 47: @@
 * Concrete examples of how to accomplish each of these 5 things, with problem descriptions, example problem code, and example code that addresses the problem
 <br>
-''How to Secure an Existing Application with ESAPI''
+==== How to Secure an Existing Application with ESAPI ====
   Audience: Developers<br>
   Purpose: Explain to developers how to address most of the common security problems in an existing application using ESAPI
@@ Line 51: / Line 53: @@
 * Similar to previous, except it goes through all major areas where ESAPI provides controls, not just the top 5.
 <br>
-''How to Use ESAPI in a New Application''
+==== How to Use ESAPI in a New Application ====
   Audience: Developers
   Purpose: Provide application architecture guidance on how to build your applications in a manner that facilitates the use of ESAPI.
@@ Line 60: / Line 62: @@
 * e.g., use of DAOs, application organizational considerations wrt Access Control, etc.
 <br>
-''How to Create a Custom ESAPI for Your Organization''
+==== How to Create a Custom ESAPI for Your Organization ====
   Audience: Organizations and developers that want to use ESAPI<br>
   Purpose: How to extend or customize ESAPI for your organization or project
@@ Line 71: / Line 73: @@
 Goals: All of this content would be on the wiki, and PDFs of each of these 'may' be produced as well.
 === Web Pages ===
 * Revamp the ESAPI Website
-* How will the ESAPI be updated and released.
+* How will ESAPI be updated and released.
 * Features List
 <br>

@@ Line 8: / Line 8: @@
 === Smaller Documents ===
-* ESAPI Executive Overview
+''ESAPI Executive Overview''
-Audience: Executives<br>
+ Audience: Executives<br>
-Purpose: To provide executives with an understanding of:
+ Purpose: To provide executives with an understanding of:
 * What ESAPI is? Goals.
 * Why an ESAPI is necessary. (App Sec is important/why/standardization)
@@ Line 17: / Line 17: @@
 * Who created it, where it came from, credibility, who is using it?
 * How to adopt an ESAPI?
-Outline: (See Purpose)
+Outline: (See Purpose)<br>
-* FAQ (For non-users)
+<br>
-Audience: Potential users of ESAPI<br>
+''FAQ (For non-users)''
-Purpose: To provide 'quick' hit, information about ESAPI<br>
+ Audience: Potential users of ESAPI<br>
-Topics: Summary of main points in the Executive Overview<br>
+ Purpose: To provide 'quick' hit, information about ESAPI
-* FAQ (For people using ESAPI)
+ Topics: Summary of main points in the Executive Overview
-Audience (Technical people using ESAPI)<br>
+''FAQ (For people using ESAPI)''
-Purpose: To provide 'quick' hit, information about how to use ESAPI, and how to add ESAPI to or integrate ESAPI with your existing security controls.
+ Audience (Technical people using ESAPI)<br>
 Outline:
 * How to use it the first time

@@ Line 35: / Line 35: @@
 ''Getting Started Guide''
   Audience: Developers new to ESAPI<br>
-  Purpose: Explain to these developers how to start immediately using ESAPI<br>
+  Purpose: Explain to these developers how to start immediately using ESAPI
-Outline:<br>
+Outline: (20 pages or less)<br>
 * Overview of ESAPI
 * How to download, install, get dependencies
@@ Line 46: / Line 46: @@
 ''How to Secure an Existing Application with ESAPI''
   Audience: Developers<br>
-  Purpose: Explain to developers how to address most of the common security problems in an existing application using ESAPI<br>
+  Purpose: Explain to developers how to address most of the common security problems in an existing application using ESAPI
 Outline:<br>
 * Similar to previous, except it goes through all major areas where ESAPI provides controls, not just the top 5.
@@ Line 52: / Line 52: @@
 ''How to Use ESAPI in a New Application''
   Audience: Developers
-  Purpose: Provide application architecture guidance on how to build your applications in a manner that facilitates the use of ESAPI. This should help make it easier to use ESAPI, make your application more secure, easier to analyze, and easier to maintain.
+  Purpose: Provide application architecture guidance on how to build your applications in a manner that facilitates the use of ESAPI.
-  Assumption: This assumes that an ESAPI that works in the developers' environment is already available (either the reference implementation or a customized version).
+ Benefit: This should help make it easier to use ESAPI, make your application more secure, easier to analyze, and easier to maintain.
 Outline/Topics:
 * Architectural guidance for each control, if any, on how to take most facilitate the use of ESAPI in your application
 * e.g., use of DAOs, application organizational considerations wrt Access Control, etc.
 ''How to Create a Custom ESAPI for Your Organization''
-  Audience: Organizations and developers that want to use ESAPI
+  Audience: Organizations and developers that want to use ESAPI<br>
   Purpose: How to extend or customize ESAPI for your organization or project
 Outline:
@@ Line 66: / Line 68: @@
 ** How to extend this control
 ** How to replace this control
 === Web Pages ===

@@ Line 5: / Line 5: @@
 == Documentation Plan ==
-* Smaller Documents
+Proposed Documents
-** ESAPI Executive Overview
 Audience: Executives<br>
 Purpose: To provide executives with an understanding of:
@@ Line 16: / Line 18: @@
 * How to adopt an ESAPI?
 Outline: (See Purpose)
-** FAQ (For non-users)
+* FAQ (For non-users)
 Audience: Potential users of ESAPI<br>
 Purpose: To provide 'quick' hit, information about ESAPI<br>
 Topics: Summary of main points in the Executive Overview<br>
-** FAQ (For people using ESAPI)
+* FAQ (For people using ESAPI)
 Audience (Technical people using ESAPI)<br>
 Purpose: To provide 'quick' hit, information about how to use ESAPI, and how to add ESAPI to or integrate ESAPI with your existing security controls.
@@ Line 27: / Line 29: @@
 * Performance
 <br>
-* Larger Documents
+=== Larger Documents ===
-** Getting Started Guide
+* Getting Started Guide
-** How to Secure an Existing Application with ESAPI
+* How to Secure an Existing Application with ESAPI
-** How to Use ESAPI in a New Application
+* How to Use ESAPI in a New Application
-** How to Create a Custom ESAPI for Your Organization
+* How to Create a Custom ESAPI for Your Organization
 <br>
-* Web pages
+=== Web Pages ===
-** Revamp the ESAPI Website
+* Revamp the ESAPI Website
-** How will the ESAPI be updated and released.
+* How will the ESAPI be updated and released.
-** [[CWE_ESAPI]] CWEs addressed by ESAPI - Assigned to Steve Christey
+* [[CWE_ESAPI]] CWEs addressed by ESAPI - Assigned to Steve Christey
-** Features List
+* Features List
 <br>
-* Other
+=== Other Documents ===
-** ESAPI Architecture/Design Guideline
+* ESAPI Architecture/Design Guideline
-** Assurance Argument [[ESAPI_Assurance]]
+* Assurance Argument [[ESAPI_Assurance]]