OWASP Request for Proposal List - Revision history

Jason Li: Removing project ideas that were part of SoC 2008

2009-03-18T04:48:11Z

Removing project ideas that were part of SoC 2008

Show changes

Twelverobots at 02:36, 12 November 2008

2008-11-12T02:36:03Z

Dinis.cruz at 17:05, 19 March 2008

2008-03-19T17:05:37Z

Pauloc at 17:28, 12 March 2008

2008-03-12T17:28:46Z

Wichers: /* P027 - OWASP Application Security Verification Standard */

2008-03-10T15:15:43Z

‎P027 - OWASP Application Security Verification Standard

Wichers: /* P023 - OWASP Code Review Tree */

2008-03-10T15:07:37Z

‎P023 - OWASP Code Review Tree

Wichers: /* P023 - OWASP Code Review Tree */

2008-03-10T15:06:48Z

‎P023 - OWASP Code Review Tree

Wichers: /* P022 - OWASP Access Control Rules Tester */

2008-03-10T15:03:01Z

‎P022 - OWASP Access Control Rules Tester

Wichers: /* P016 - OWASP .NET Access Control Tool */

2008-03-10T14:49:18Z

‎P016 - OWASP .NET Access Control Tool

Wichers: /* P013 - OWASP SiteGenerator Refresh */

2008-03-10T14:45:30Z

‎P013 - OWASP SiteGenerator Refresh

← Older revision		Revision as of 02:36, 12 November 2008
Line 136:		Line 136:


−	====P019 - OWASP ~~Cold Fusion~~ Security Project====	+	====P019 - OWASP ColdFusion Security Project====

−	* '''Project description''': Create a guide and supporting tools to support people charged with securing ~~Cold Funsion~~ web applications. The coverage should include all of the OWASP Top Ten and other important topics from OWASP, such as those included in the [[ESAPI\|OWASP ESAPI]] project.	+	* '''Project description''': Create a guide and supporting tools to support people charged with securing ColdFusion web applications. The coverage should include all of the OWASP Top Ten and other important topics from OWASP, such as those included in the [[ESAPI\|OWASP ESAPI]] project.

@@ Line 1: / Line 1: @@
 OWASP is currently requesting proposals for all the following OWASP projects.
-Please review the [[OWASP Summer of Code 2008|details]] on how to apply. Your proposal is the key factor in deciding whether to award funds - unprofessional applications will not be accepted. The typical project delivery time is 4 months and the payment will be made in two 50% parts (one at the 50% mark and one at 100% mark as judged by an independent reviewer).
+Please review the [[OWASP Summer of Code 2008|details]] on how to apply. Your proposal is the key factor in deciding whether to award funds - unprofessional applications will not be accepted. The typical project delivery time is 5 months and the payment will be made in two 50% parts (one at the 50% mark and one at 100% mark as judged by an independent reviewer).
 You can, of course, submit an unsolicited proposal for any idea that will help OWASP achieve its mission. The requested projects should help you understand the range and depth of projects that are likely to be funded by the OWASP Foundation.

@@ Line 1: / Line 1: @@
 OWASP is currently requesting proposals for all the following OWASP projects.
-Please review the [[OWASP Summer of Code 2008|details]] on how to apply. Your proposal is the key factor in deciding whether to award funds - unprofessional applications will not be accepted. The typical project delivery time is 3 months and the payment will be made in two 50% parts (one at the 50% mark and one at 100% mark as judged by an independent reviewer).
+Please review the [[OWASP Summer of Code 2008|details]] on how to apply. Your proposal is the key factor in deciding whether to award funds - unprofessional applications will not be accepted. The typical project delivery time is 4 months and the payment will be made in two 50% parts (one at the 50% mark and one at 100% mark as judged by an independent reviewer).
 You can, of course, submit an unsolicited proposal for any idea that will help OWASP achieve its mission. The requested projects should help you understand the range and depth of projects that are likely to be funded by the OWASP Foundation.

@@ Line 206: / Line 206: @@
 ====P027 - OWASP Application Security Verification Standard====
-* '''Project description''': Create a standard that details the process for verifying the security of application and producing a report that details the risks identified. Note that this is NOT a set of security requirements, but rather a process for performing an evaluation against a set of security requirements.
+* '''Project description''': Create a standard that details the process for verifying the security of an application and producing a report that details the risks identified. Note that this is NOT a set of security requirements, but rather a process for performing an evaluation against a set of security requirements.
 Level 1: Scan – fully automated dynamic or static analysis.
@@ Line 212: / Line 212: @@
 Level 3: Verify – positive approach – verifies all security mechanisms
-** The project should specify the requirements for a review to meet each level.  The requirements would cover:
+* The project should specify the requirements for a review to meet each level.  The requirements would cover:
--	Requirements for the process to be followed
+**	the assessment process to be followed
--	// Requirements for notification of highs/criticals
+**	the process for notification of highs/criticals
--	Requirements for deliverable (structure, content)
+**	the deliverable (structure, content)
--	Requirements for the risk ranking methodology used
+**	the risk ranking methodology used
--	Requirements for protection of customer information including deliverable and work products
+**	protection requirements for customer information including deliverable and work products
--	Requirements for qualifications of the people involved
+**	qualifications of the people involved
--	Requirements for security coverage (include by reference to other standards)
+**	security coverage (include by reference to other standards)
--	Requirements for depth of analysis required – simple data, vulnerabilities, technical risk, business risk
+**	depth of analysis required – simple data, vulnerabilities, technical risk, business risk
 ====P028 - OWASP UI Component Verification Project ====

@@ Line 170: / Line 170: @@
 ***Concurrency issues (class member variable in Servlet, threadlocals)
-      Category                 Name                 Description                   Regex
+      Category            Name               Description                Regex
-      ---------------          ---------------      --------------                -----------
+      ---------------     ---------------    --------------             -----------
-      Code Quality             Fixme                Unfinished code               (fixme|hack|bug)
+      Code Quality        Fixme              Unfinished code            (fixme|hack|bug)
-      Authentication           Password             All access to credentials     (password|username|credentials|key|certificate)
+      Authentication      Password           All access to credentials  (password|username|credentials|key|certificate)
-      Access Control           JavaEE               Possible authorization        (isAdmin)
+      Access Control      JavaEE             Possible authorization     (isAdmin)
-      Obscenity                !$??%@*#$            Frustrated developers         (censored)
+      Obscenity           !$??%@*#$          Frustrated developers      (censored)
 ====P024 - OWASP Attack Surface Metric====

@@ Line 156: / Line 156: @@
 ====P022 - OWASP Access Control Rules Tester====
-* '''Project description''': Create a pentest/scanner/webscarab tool specifically focused on access control testing.  The tool can "spider" a site (either manually or automatically) while logged in as multiple different users. The tool should generates different sitemaps for each user (because they have different access).
+* '''Project description''': Create a pentest/scanner/webscarab tool specifically focused on access control testing.  The tool can "spider" a site (either manually or automatically) while logged in as multiple different users. The tool should generate different sitemaps for each user (because they have different access).
-** The tool should compare the sitemaps display where they're the same and different - potential access control problems.
+** The tool should compare the sitemaps and display where they're the same and different - potential access control problems.
-** The tool should also attempt to access items from other user's sitemaps in an attempt to find problems in the access control scheme.
+** The tool should then attempt to access items from other user's sitemaps in an attempt to find problems in the access control scheme.
 ====P023 - OWASP Code Review Tree====

@@ Line 120: / Line 120: @@
 ====P016 - OWASP .NET Access Control Tool====
-* '''Project description''': Create a tool that enables the easy development and use of CAS and RBS (Role Base Security) and frameworks for securing an application’s Business-Logic (for example using a CAS to prevent the user account’s from being changed, or an bank account from being accessed)
+* '''Project description''': Create a tool that enables the easy development and use of CAS (Code Access Security) and RBS (Role Base Security) and frameworks for securing an application’s Business-Logic (for example using a CAS to prevent the user account’s from being changed, or an bank account from being accessed)
 ====P017 - OWASP AppSensor - Detect and Respond to Attacks from Within the Application====

@@ Line 97: / Line 97: @@
 ====P013 - OWASP SiteGenerator Refresh====
-* '''Project description''': Bring the OWASP SiteGenerator project to release quality. Add more vulnerabilties (and document them using ORG). Implement the new engine (http based using interfaces) which allows the use of any backend web technology.
+* '''Project description''': Bring the [[Owasp_SiteGenerator | OWASP SiteGenerator Project]] to [[:Category:OWASP_Project_Assessment | release quality]]. Add more vulnerabilties (and document them using ORG). Implement the new engine (HTTP based using interfaces) which allows the use of any backend web technology.
 ** The enhancements should include the ability to save/log all requests receive, and should include multiple Sample Reports (namely for the current OWASP tools).
-** Produce documentation and articles about SiteGenerator, and work to evalutate current tools against generated applications to test their abilities.
+** Produce documentation and articles about [[Owasp_SiteGenerator | SiteGenerator]], and work to evalutate current tools against generated applications to test their abilities.
 ====P014 - OWASP Security Refactoring Tool Project====