OWASP Application Security Assessment Standards Project Roadmap - Revision history

Johanna Curiel at 21:35, 30 July 2016

2016-07-30T21:35:51Z

Cbarlow at 10:20, 24 July 2006

2006-07-24T10:20:04Z

Cbarlow: /* Per Phase Project Objectives */

2006-07-24T10:11:08Z

‎Per Phase Project Objectives

Cbarlow: Initial population of project roadmap

2006-07-24T10:09:44Z

Initial population of project roadmap

OWASP at 00:16, 22 July 2006

2006-07-22T00:16:30Z

New page

The project's overall goal is to...

Define practical and useful application security metrics

In the near term, we are focused on the following tactical goals...

# Find a project leader
#
#

Here are the current tasks defined to help us achieve these goals

*
*

[[Category:OWASP Application Security Assessment Standards Project]]

← Older revision		Revision as of 21:35, 30 July 2016
Line 1:		Line 1:
		+	{{taggedDocument
		+	\| type=old
		+	\| lastRevision=2016-06-31
		+	\| comment=The page should be updated.
		+	}}
	The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements.		The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements.

@@ Line 6: / Line 6: @@
 '''Phase I – Project Approach''':  Comment Period for Proposed Project Approach, Solicit Contributor Support
 '''
-Phase II – Application Assessment Definitions:'''  Establish core assessment definitions to ensure common base terminology.
+'''Phase II – Application Assessment Definitions:'''  Establish core assessment definitions to ensure common base terminology.
 '''
-Phase III – Assessment Context:'''  Establish standard assessment context, selection, qualification and process frameworks.
+'''Phase III – Assessment Context:'''  Establish standard assessment context, selection, qualification and process frameworks.
 '''
-Phase IV – Assessment Levels:'''  Establish a common set of application assessment levels to be used as business guidance to ensure conducting appropriate level based on business-application-security requirements.
+'''Phase IV – Assessment Levels:'''  Establish a common set of application assessment levels to be used as business guidance to ensure conducting appropriate level based on business-application-security requirements.
 '''Phase V – OWASP Integration:'''  Document integration components and linkages with existing and underway OWASP projects.
-== Per Phase Project Objectives ==
+'''Phase I – Project Approach and Objectives'''
-'''
+Project Objective:  Solicit Contributor feedback to ensure the most effective and widely supported approach.
-Phase I – Project Approach and Objectives'''
+Target Time Frame:  August, 2006
-Project Objective:	Solicit Contributor feedback to ensure the most effective and widely supported approach.
+Current Status:	Call for Volunteers
-Target Time Frame:	August, 2006
+Contributors:
 Reviewers:
 '''Phase II – Application Assessment Definitions'''
-Project Objective:	Establish common business application and security assessment type’s definitions.
+Project Objective:  Establish common business application and security assessment type’s definitions.
-Target Time Frame:	September, 2006
+Target Time Frame:  September, 2006
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
-'''
+'''Phase III – Assessment Context'''
 Project Objective:	Define standard application assessment process in SWIM flow chart.
 Target Time Frame:	October, 2006
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
-'''
+'''Phase III – Assessment Context'''
 Project Objective:	Define standard assessment scope of work per application type.  Includes standard testing boundaries and requirements/needs placed upon end user requesting assessment.
 Target Time Frame:	October, 2006
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
-'''
+'''Phase III – Assessment Context'''
 Project Objective:	Plot where within standard System Development Lifecycle (SDLC) application security assessment steps should be defined and conducted.
 Target Time Frame:	October, 2006
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
-'''
+'''Phase III – Assessment Context'''
 Project Objective:	Establish common set of assessor qualifications and evaluation criteria to facilitate end service user ability to determine competence per assessment type.
 Target Time Frame:	October, 2006
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
 '''Phase IV – Assessment Levels'''
@@ Line 70: / Line 64: @@
 Current Status:	In hold based on outcome of Phase I and II.  Calling for future volunteers.
 Contributors:
 Reviewers:
-'''
+'''Phase IV – Assessment Levels'''
 Project Objective:	Create assessment levels based on previous Phase III objective.  Define assessment depth, testing components required, and level of tool usage/type (not product names) of tools used per level.
 Target Time Frame:	March, 2007
 Current Status:	In hold based on outcome of Phase I and II.  Calling for future volunteers.
 Contributors:
 Reviewers:
-'''
+'''Phase IV – Assessment Levels'''
 Project Objective:	Document corresponding linkages between assessment levels and common security metrics, security assurance/maturity models, related legislation, other documented national standards defined as component of first Phase III objective.
 Target Time Frame:	May, 2007
 Current Status:	In hold based on outcome of Phase I and II.
 Contributors:
 Reviewers:
 '''Phase IV – Assessment Levels'''
@@ Line 93: / Line 85: @@
 Current Status:	In hold based on outcome of Phase I and II. Calling for future volunteers.
 Contributors:
 Reviewers:
-'''Phase V – OWASP Integration: '''
+'''Phase V – OWASP Integration:'''
 Project Objective:	Document integration components and linkages with existing and underway OWASP projects.
 Target Time Frame:	July, 2007

@@ Line 23: / Line 23: @@
 Current Status:	Call for Volunteers
 Contributors:
 Reviewers:
 '''Phase II – Application Assessment Definitions'''
@@ Line 31: / Line 32: @@
 Contributors:
 Reviewers:
 '''
 Phase III – Assessment Context'''
@@ Line 38: / Line 40: @@
 Contributors:
 Reviewers:
 '''
 Phase III – Assessment Context'''
@@ Line 45: / Line 48: @@
 Contributors:
 Reviewers:
 '''
 Phase III – Assessment Context'''
@@ Line 52: / Line 56: @@
 Contributors:
 Reviewers:
 '''
 Phase III – Assessment Context'''
@@ Line 66: / Line 71: @@
 Contributors:
 Reviewers:
 '''
 Phase IV – Assessment Levels'''
@@ Line 73: / Line 79: @@
 Contributors:
 Reviewers:
 '''
 Phase IV – Assessment Levels'''
@@ Line 94: / Line 101: @@
 Contributors:
 Reviewers:
 [[Category:OWASP Application Security Assessment Standards Project]]

@@ Line 1: / Line 1: @@
-The project's overall goal is to...
+The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements.
-  Define practical and useful application security metrics
+This project will not define how to technically to conduct an assessment (refer to OWASP Testing Project); it is instead meant to tie business operations and information management practices to application security in order to establish a common, consistent set of standards which provide guidance in conducting such assessments.
-In the near term, we are focused on the following tactical goals...
+== Overall Roadmap Phases ==
-# Find a project leader
+'''Phase I – Project Approach''':  Comment Period for Proposed Project Approach, Solicit Contributor Support
+'''
+Phase II – Application Assessment Definitions:'''  Establish core assessment definitions to ensure common base terminology.
-Here are the current tasks defined to help us achieve these goals
+'''Phase V – OWASP Integration:'''  Document integration components and linkages with existing and underway OWASP projects.
-−
+== Per Phase Project Objectives ==
 [[Category:OWASP Application Security Assessment Standards Project]]