How to create verification project schedules - Revision history

KirstenS at 12:03, 29 March 2009

2009-03-29T12:03:59Z

Deleted user at 16:30, 20 January 2009

2009-01-20T16:30:26Z

Deleted user at 13:42, 16 January 2009

2009-01-16T13:42:46Z

Deleted user at 01:56, 30 December 2008

2008-12-30T01:56:10Z

Deleted user at 01:46, 30 December 2008

2008-12-30T01:46:49Z

Deleted user: How to use OWASP ASVS to create verification project schedules moved to How to create verification project schedules

2008-12-22T14:09:01Z

How to use OWASP ASVS to create verification project schedules moved to How to create verification project schedules

Deleted user at 13:56, 22 December 2008

2008-12-22T13:56:49Z

Deleted user at 13:17, 22 December 2008

2008-12-22T13:17:56Z

Deleted user at 15:06, 15 December 2008

2008-12-15T15:06:30Z

Deleted user: New page: … The author of this article can be reached at boberski_michael(at)bah.com Good luck! Category:OWASP Application Security Verification Standard Project {{Stub}}

2008-12-12T19:57:59Z

New page: … The author of this article can be reached at boberski_michael(at)bah.com Good luck! Category:OWASP Application Security Verification Standard Project {{Stub}}

New page

…

The author of this article can be reached at boberski_michael(at)bah.com

Good luck!

[[Category:OWASP Application Security Verification Standard Project]]

{{Stub}}

← Older revision		Revision as of 12:03, 29 March 2009
Line 1:		Line 1:
−	If you are performing an application security verification, you can use [~~http~~:~~//www.owasp.org/index.php/~~Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.	+	If you are performing an application security verification, you can use [[::Category:OWASP_Application_Security_Verification_Standard_Project \|OWASP Application Security Verification Standard (ASVS)]] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.

@@ Line 1: / Line 1: @@
 If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.
-−
-    '''DO NOT PERFORM A DYNAMIC SCAN OR PENTEST WITHOUT'''
-    '''THE APPLICATION OWNER'S PRIOR WRITTEN AGREEMENT!'''
+[[Image:Asvs_project.GIF]]
-−
 The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.
 *Example level 1 tasks: ''Collect information, perform initial design review, create report, perform scan, review scan results, finalize report.''
@@ Line 51: / Line 52: @@
 Helpful hints:
 *The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs.
 [[Category:OWASP Application Security Verification Standard Project]]
 [[Category:How To]]

← Older revision		Revision as of 13:42, 16 January 2009
Line 1:		Line 1:
	If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.		If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.

		+	'''DO NOT PERFORM A DYNAMIC SCAN OR PENTEST WITHOUT'''
		+	'''THE APPLICATION OWNER'S PRIOR WRITTEN AGREEMENT!'''

	The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.		The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.

@@ Line 1: / Line 1: @@
 If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.
 The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.
-*Example level 1 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, finalize report.
+*Example level 1 tasks: ''Collect information, perform initial design review, create report, perform scan, review scan results, finalize report.''
-*Example level 2 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, finalize report.
+*Example level 2 tasks: ''Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, finalize report.''
-*Example level 3 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, finalize report.
+*Example level 3 tasks: ''Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, finalize report.''
-*Example level 4 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, perform search for malicious code, finalize report.
+*Example level 4 tasks: ''Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, perform search for malicious code, finalize report.''
@@ Line 18: / Line 13: @@
 The increase in level of effort to perform OWASP ASVS verifications at different levels for a given application is intended to be relatively linear.
-*Example level 1 overall duration: 1 - 2 weeks
+*Example level 1 overall duration: ''1 - 2 weeks''
-*Example level 2 overall duration: 2 - 3 weeks
+*Example level 2 overall duration: ''2 - 3 weeks''
-*Example level 3 overall duration: 3 - 4 weeks
+*Example level 3 overall duration: ''3 - 4 weeks''
-*Example level 4 overall duration: 4+ weeks
+*Example level 4 overall duration: ''4+ weeks''
 The above estimates do not include time to perform remediation. The size and the complexity of the application(s) should always be taken into account.
 The next step to perform a verification is to identify resources that will be necessary, including both people and materials.
-*Example people resources: project manager, team lead, verifier.
+*Example people resources: ''project manager, team lead, verifier.''
-*Example material resources: dynamic scan tools, source code scan tools.
+*Example material resources: ''dynamic scan tools, source code scan tools.''
 The availability and cost for both people (e.g. rate) and resources (e.g. license fees) should then be taken into account.
 The next step to perform a verification is to assign people and materials to individual tasks.
-*Example level 1 assignment: assign collect information to team lead
+*Example level 1 assignment: ''assign collect information to team lead''
-*Example level 1 assignment: assign perform initial design review to team lead and verifier.
+*Example level 1 assignment: ''assign perform initial design review to team lead and verifier.''
-*Example level 1 assignment: assign create report to team lead.
+*Example level 1 assignment: ''assign create report to team lead.''
-*Example level 1 assignment: assign perform scan to verifier.
+*Example level 1 assignment: ''assign perform scan to verifier.''
-*Example level 1 assignment: assign review scan results to verifier.
+*Example level 1 assignment: ''assign review scan results to verifier.''
-*Example level 1 assignment: assign finalize report to team lead and verifier.
+*Example level 1 assignment: ''assign finalize report to team lead and verifier.''
 The project manager may not in practice be assigned to a specific task, unless the project schedule is detailed enough to include tasks such as project status reviews.
 The last step to perform a verification is to track verification progress. OWASP ASVS verification requirements and reporting requirements can be used towards this end.
-*Example computation to determine a verification task’s percent complete: for each set of applicable verification requirements for each application, divide the number completed by the total number.
+*Example computation to determine a verification task’s percent complete: ''for each set of applicable verification requirements for each application, divide the number completed by the total number.''
-*Example computation to determine a reporting task’s percent complete: for each set of reporting requirements for each application, divide the number completed by the total number.
+*Example computation to determine a reporting task’s percent complete: ''for each set of reporting requirements for each application, divide the number completed by the total number.''
 *The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs.

@@ Line 1: / Line 1: @@
-== How to create verification project schedules ==
+== Overview ==
-== Step 1: Define Verification Tasks ==
+If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.
-''Example level 1 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, finalize report.''
+The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.
-''Example level 3 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, finalize report.''
+Milestones would then correspond to the completion of a given verification task, and a final milestone would correspond to the completion of all verification tasks.
 The increase in level of effort to perform OWASP ASVS verifications at different levels for a given application is intended to be relatively linear.
-''Example level 1 overall duration: 1 - 2 weeks''
+The above estimates do not include time to perform remediation. The size and the complexity of the application(s) should always be taken into account.
-''Example level 3 overall duration: 3 - 4 weeks''
+== Identify Verification Team Resources ==
 The next step to perform a verification is to identify resources that will be necessary, including both people and materials.
-''Example people resources: project manager, team lead, verifier.''
+The availability and cost for both people (e.g. rate) and resources (e.g. license fees) should then be taken into account.
 The next step to perform a verification is to assign people and materials to individual tasks.
-''Example level 1 assignment: assign collect information to team lead''
+The project manager may not in practice be assigned to a specific task, unless the project schedule is detailed enough to include tasks such as project status reviews.
-''Example level 1 assignment: assign create report to team lead.''
+== Track Verification Progress ==
 The last step to perform a verification is to track verification progress. OWASP ASVS verification requirements and reporting requirements can be used towards this end.
-''Example computation to determine a verification task’s percent complete: for each set of applicable verification requirements for each application, divide the number completed by the total number.''
+== Helpful hints ==
-The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs.
+*The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs.
 [[Category:OWASP Application Security Verification Standard Project]]
 [[Category:How To]]

← Older revision	Revision as of 14:09, 22 December 2008
(No difference)

← Older revision		Revision as of 13:56, 22 December 2008
Line 85:		Line 85:

	[[Category:OWASP Application Security Verification Standard Project]]		[[Category:OWASP Application Security Verification Standard Project]]
		+	[[Category:How To]]