OWASP Cloud Security Project - Revision history

Fraserscott: Adding in posts referring to project

2018-01-11T23:58:10Z

Adding in posts referring to project

Fraserscott: referencing threat stories

2017-12-03T08:03:42Z

referencing threat stories

Fraserscott: Clean up based on threat stories

2017-12-03T08:02:50Z

Clean up based on threat stories

Fraserscott: Adding Paul Cutting as a contributor

2017-11-13T23:19:48Z

Adding Paul Cutting as a contributor

Fraserscott: Updating related projects

2017-11-13T23:18:07Z

Updating related projects

Fraserscott: fixing url

2017-11-01T20:32:23Z

fixing url

Fraserscott: /* How can I participate in your project? */

2017-11-01T20:30:58Z

‎How can I participate in your project?

Fraserscott: Adding Getting involved link

2017-10-22T06:25:11Z

Adding Getting involved link

Fraserscott: Fixing repo link

2017-10-22T06:24:07Z

Fixing repo link

Fraserscott: Adding getting involved link

2017-10-22T06:23:09Z

Adding getting involved link

@@ Line 89: / Line 89: @@
 == News and Events ==
-Coming soon!
+The project has appeared in the follow posts:
 == In Print ==

@@ Line 57: / Line 57: @@
 == What is OWASP Cloud Security Project? ==
-The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat model templates and security control BDD stories that pool together the expertise and experience of the development, operations, and security communities.
+The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat and control BDD stories that pool together the expertise and experience of the development, operations, and security communities.
 [https://github.com/owasp-cloud-security/owasp-cloud-security#contributing Please contribute!]

@@ Line 8: / Line 8: @@
 ==The OWASP Cloud Security Project==
 The rise of DevOps and cloud computing has given organisations unprecedented access to feature-rich and high-scalable elastic platforms that allow them to deliver products and services with a velocity and agility that has never been seen before.
-But with new capabilities come new attack vectors. The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat model templates and security control BDD stories that pool together the expertise and experience of the development, operations and security communities.
+But with new capabilities come new attack vectors. The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat and control BDD stories that pool together the expertise and experience of the development, operations and security communities.
-===Why threat modelling?===
+===Why BDD stories?===
-Threat modelling addresses security issues at a fundamental, architectural level. Rather than trying to bolt on controls haphazardly, threat modelling results in more robust and secure systems by baking security into the design as well as identifying the gaps and weaknesses. Using templates allows the sharing of common threats in a way that can be tweaked and tuned by individual organisations. Improvements to the threat models can then be fed back to the community for the benefit of everyone.
+Behaviour Driven Development (BDD) adds a natural language layer on top of test-driven development by defining requirements in a machine parsable language that is also human readable. While adoption of BDD within development communities has been mixed (often because the developers end up having to duplicate effort as both producers and consumers of the BDD stories), BDD is actually an excellent fit for representing threats and control. For threats it provides a consistent and structured format for express threats and scenarios in a way that can be shared between all stakeholders, from engineers to management. For mitigating controls BDD is ideal because it expresses control requirements in a way that is also continuously testable. Rather than burying a control requirement in a policy document that nobody reads, it can be represented in a way that an auditor  would be happy with at the same time as being implemented as automated detective or preventative tests.
-===Why BDD?===
+By bringing together threat and control stories, provided by the community, the OWASP Cloud Security project helps organisations understand the risks they face on their journey into the cloud.
-Behaviour Driven Development (BDD) adds a natural language layer on top of test-driven development by defining requirements in a machine parsable language that is also human readable. While adoption of BDD within development communities has been mixed (often because the developers end up having to duplicate effort as both producers and consumers of the BDD stories), BDD is actually an excellent fit for representing security control requirements in a way that is also continuously testable. Rather than burying a control requirement in a policy document that nobody reads, it can be represented in a way that an auditor  would be happy with at the same time as being implemented as automated detective or preventative tests.
+===Threat modelling===
-By bringing together threat model templates and BDD stories for mitigating controls, provided by the community, the OWASP Cloud Security project helps organisations understand the risks they face on their journey into the cloud.
+Threat modelling addresses security issues at a fundamental, architectural level. Rather than trying to bolt on controls haphazardly, threat modelling results in more robust and secure systems by baking security into the design as well as identifying the gaps and weaknesses. Using threat stories allows the sharing of common threats in a way that can be tweaked and tuned by individual organisations. Improvements to the threats can then be fed back to the community for the benefit of everyone.
 ==Description==
@@ Line 29: / Line 40: @@
 This project provides the following for an ever-expanding list of cloud providers and services:
-* Threats stored as machine-parsable YAML files
+* Threats expressed as BDD (Gherkin) stories
-* Threats stored as human-friendly README files (generated from YAML)
+* Mitigating controls expressed as BDD (Gherkin) stories
 * Proof-of-concept attack scripts and tools

@@ Line 127: / Line 127: @@
 * Paulo Gomes
 * Francois Raynaud
 * '''YOUR NAME BELONGS HERE'''

@@ Line 61: / Line 61: @@
 == Related Projects ==
-* OWASP Staypuft - Launching November 10th 2017
+* [https://www.owasp.org/index.php/OWASP_Threat_Model_Project OWASP Threat Model Project]
 == Openhub ==

@@ Line 138: / Line 138: @@
 * Threats models and BDD stories based on published standards (e.g. PCI/DSS) and best-practices (e.g. whitepapers)
-To get involved, see the [https://github.com/owasp-cloud-security/owasp-cloud-security#getting-involved Github repository].
+To get involved, see the [https://github.com/owasp-cloud-security/owasp-cloud-security Github repository].
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->

@@ Line 5: / Line 5: @@
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 ==The OWASP Cloud Security Project==
@@ Line 36: / Line 36: @@
 ==Licensing==
-'''The OWASP Cloud Security project resources are all completely free to use!
+'''The OWASP Cloud Security project resources are all completely free to use!'''
 Documentation and related resources are licensed under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
@@ Line 43: / Line 43: @@
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
-| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 == What is OWASP Cloud Security Project? ==
@@ Line 68: / Line 68: @@
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
-| valign="top"  style="padding-left:25px;width:200px;" |
+| valign="top" style="padding-left:25px;width:200px;" |
 == Source code and documentation ==
@@ Line 88: / Line 88: @@
     {| width="200" cellpadding="2"
     |-
-    | align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | rowspan="2" align="center" valign="top" width="50%" | [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
+    | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
+    | align="center" valign="top" width="50%" | [[File:Owasp-defenders-small.png|link=]]
     |-
-    | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
+    | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_DOC.jpg|link=]]
+    | colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
     |}
@@ Line 121: / Line 121: @@
 * [https://www.owasp.org/index.php/User:Fraserscott Fraser Scott]
 * '''YOUR NAME BELONGS HERE'''
@@ Line 136: / Line 141: @@
 <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
-__NOTOC__ <headertabs />
+__NOTOC__ <headertabs></headertabs>
-[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]
+[[Category:OWASP Project]]

@@ Line 110: / Line 110: @@
 Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.
-For more information, visit the [https://github.com/owasp-cloud-security/owasp-cloud-security#contributing GitHub] repository.
+For more information, visit the [https://github.com/owasp-cloud-security/owasp-cloud-security#getting-involved GitHub] repository.
 = Acknowledgements =

@@ Line 103: / Line 103: @@
 ==How can I participate in your project?==
 All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.
 ==If I am not a programmer can I participate in your project?==