OWASP student projects - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textrelletoboelo.com

2009-05-27T18:29:22Z

Reverting to last version not containing links to www.textrelletoboelo.com

Deleted user at 16:18, 22 May 2009

2009-05-22T16:18:56Z

OWASP at 15:56, 16 January 2007

2007-01-16T15:56:03Z

OWASP at 14:32, 30 July 2006

2006-07-30T14:32:37Z

OWASP at 15:23, 24 July 2006

2006-07-24T15:23:58Z

Jeff Williams at 15:27, 21 June 2006

2006-06-21T15:27:24Z

Jeff Williams at 15:26, 21 June 2006

2006-06-21T15:26:54Z

Jeff Williams at 15:23, 21 June 2006

2006-06-21T15:23:29Z

New page

These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security.

# '''[[:Category:Principle|AppSec Principles]]''' - do some research and flesh out one of the OWASP principles. Talk about how the principle works in general, and then examine how it is applied in various contexts.

# '''[[:Category:Attack|Attacks]]''' - flesh out the list of attacks, develop each one with content and links.

# '''[[:Category:Vulnerability|Vulnerabilities]]''' - work to fill out writeups of vulnerabilities and clean up the vulnerability lists. There's lots of linking to other articles here needed. We're integrating CLASP, CWE, Fortify, and other sources of vulnerabilities to make the best resource anywhere.

# '''[[:Category:Countermeasure|Countermeasures]]''' - general cleanup and linking of these articles. Probably some stubs in there that need significant writing.

# '''[[:Category:OWASP Metrics Project|AppSec Metrics]]''' - this project is harder, but desperately needed. Could involve paper exercises or actual tools. If someone wants to implement the "software facts" label, that would be a thesis level project

# '''[[:Category:OWASP Java Project|Java Project]]''' - great opportunity to do research and bring together all the best information in one place for Java developers

@@ Line 1: / Line 1: @@
 These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security. Please contact us at [mailto:owasp@owasp.org?subject=Student_Projects_at_OWASP owasp@owasp.org].
@@ Line 27: / Line 26: @@
 # '''Data Flow''' - Adding true data flow analysis to LAPSE. Check out the jDFA project at sourceforge to see whether that can be applied to find tainted data attacks like XSS and SQL injection (as well as others)
-# '''Security Across the SDLC''' - Integrated security activities across the lifecycle.  Currently people are talking about âtouchpointsâ and âactivitiesâ but thereâs no unifying line of sight or theme.
+# '''Security Across the SDLC''' - Integrated security activities across the lifecycle.  Currently people are talking about “touchpoints” and “activities” but there’s no unifying line of sight or theme.
-# '''Honeycomb''' - It seems simple, but when you start trying to organize ALL the information thatâs out there it gets incredibly difficult.  The simple taxonomies are wrong, bad, and misleading.  Honeycomb is using a folksonomy approach that I hope will allow us to do something new here.  But it really needs someone to think it through â perfect for a thesis.
+# '''Honeycomb''' - It seems simple, but when you start trying to organize ALL the information that’s out there it gets incredibly difficult.  The simple taxonomies are wrong, bad, and misleading.  Honeycomb is using a folksonomy approach that I hope will allow us to do something new here.  But it really needs someone to think it through – perfect for a thesis.
 # '''Honeycomb+Tools''' - Integrating the Honeycomb information into tools would be incredibly helpful.  Things like the OWASP report generator need it.  Threat modeling tools need it.  Scanners need it.  We need to prepare the information there for tool use.
@@ Line 40: / Line 39: @@
 * Contact owasp@owasp.org to get guidance on your project
 * Research everything you can find about that topic on the internet (and books)
-* Ensure that youâre not overlapping with other existing OWASP articles
+* Ensure that you’re not overlapping with other existing OWASP articles
 * Create a clear, well-organized, comprehensive article
 * You can't just copy other people's work -- you have to think and write in your own words
 * Be sure to link with articles you use and any other applicable articles
-You can use the "talk" pages associated with each article to propose ideas, ask questions, etcâ¦  Members of the OWASP community will respond and guide your work.
+You can use the "talk" pages associated with each article to propose ideas, ask questions, etc…  Members of the OWASP community will respond and guide your work.

@@ Line 1: / Line 1: @@
 These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security. Please contact us at [mailto:owasp@owasp.org?subject=Student_Projects_at_OWASP owasp@owasp.org].
@@ Line 26: / Line 27: @@
 # '''Data Flow''' - Adding true data flow analysis to LAPSE. Check out the jDFA project at sourceforge to see whether that can be applied to find tainted data attacks like XSS and SQL injection (as well as others)
-# '''Security Across the SDLC''' - Integrated security activities across the lifecycle.  Currently people are talking about “touchpoints” and “activities” but there’s no unifying line of sight or theme.
+# '''Security Across the SDLC''' - Integrated security activities across the lifecycle.  Currently people are talking about âtouchpointsâ and âactivitiesâ but thereâs no unifying line of sight or theme.
-# '''Honeycomb''' - It seems simple, but when you start trying to organize ALL the information that’s out there it gets incredibly difficult.  The simple taxonomies are wrong, bad, and misleading.  Honeycomb is using a folksonomy approach that I hope will allow us to do something new here.  But it really needs someone to think it through – perfect for a thesis.
+# '''Honeycomb''' - It seems simple, but when you start trying to organize ALL the information thatâs out there it gets incredibly difficult.  The simple taxonomies are wrong, bad, and misleading.  Honeycomb is using a folksonomy approach that I hope will allow us to do something new here.  But it really needs someone to think it through â perfect for a thesis.
 # '''Honeycomb+Tools''' - Integrating the Honeycomb information into tools would be incredibly helpful.  Things like the OWASP report generator need it.  Threat modeling tools need it.  Scanners need it.  We need to prepare the information there for tool use.
@@ Line 39: / Line 40: @@
 * Contact owasp@owasp.org to get guidance on your project
 * Research everything you can find about that topic on the internet (and books)
-* Ensure that you’re not overlapping with other existing OWASP articles
+* Ensure that youâre not overlapping with other existing OWASP articles
 * Create a clear, well-organized, comprehensive article
 * You can't just copy other people's work -- you have to think and write in your own words
 * Be sure to link with articles you use and any other applicable articles
-You can use the "talk" pages associated with each article to propose ideas, ask questions, etc…  Members of the OWASP community will respond and guide your work.
+You can use the "talk" pages associated with each article to propose ideas, ask questions, etcâ¦  Members of the OWASP community will respond and guide your work.

@@ Line 15: / Line 15: @@
 * Ensure that you’re not overlapping with other existing OWASP articles
 * Create a clear, well-organized, comprehensive article
-* Link with other applicable articles
+* You can't just copy other people's work -- you have to think and write in your own words
 You can use the "talk" pages associated with each article to propose ideas, ask questions, etc…  Members of the OWASP community will respond and guide your work.

← Older revision		Revision as of 15:23, 24 July 2006
Line 7:		Line 7:
	# '''[[:Category:OWASP Metrics Project\|AppSec Metrics]]''' - this project is harder, but desperately needed. Could involve paper exercises or actual tools. If someone wants to implement the "software facts" label, that would be a thesis level project		# '''[[:Category:OWASP Metrics Project\|AppSec Metrics]]''' - this project is harder, but desperately needed. Could involve paper exercises or actual tools. If someone wants to implement the "software facts" label, that would be a thesis level project
	# '''[[:Category:OWASP Java Project\|Java Project]]''' - great opportunity to do research and bring together all the best information in one place for Java developers		# '''[[:Category:OWASP Java Project\|Java Project]]''' - great opportunity to do research and bring together all the best information in one place for Java developers
		+
		+	Many of these projects are research projects that will help students develop their understanding of how application security works. Students who want to participate should:
		+
		+	* Choose an article topic from the Principle or Attack page
		+	* Contact owasp@owasp.org to get guidance on your project
		+	* Research everything you can find about that topic on the internet (and books)
		+	* Ensure that you’re not overlapping with other existing OWASP articles
		+	* Create a clear, well-organized, comprehensive article
		+	* Link with other applicable articles
		+
		+	You can use the "talk" pages associated with each article to propose ideas, ask questions, etc… Members of the OWASP community will respond and guide your work.

← Older revision		Revision as of 15:26, 21 June 2006
Line 1:		Line 1:
−	These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security.	+	These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security. Please contact us at [mailto:owasp@owasp.org?subject=Student_Projects_at_OWASP].

	# '''[[:Category:Principle\|AppSec Principles]]''' - do some research and flesh out one of the OWASP principles. Talk about how the principle works in general, and then examine how it is applied in various contexts.		# '''[[:Category:Principle\|AppSec Principles]]''' - do some research and flesh out one of the OWASP principles. Talk about how the principle works in general, and then examine how it is applied in various contexts.

@@ Line 1: / Line 1: @@
-These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security. Please contact us at [mailto:owasp@owasp.org?subject=Student_Projects_at_OWASP].
+These projects require some research, thinking, and some hard work, but I think they would be very valuable in getting students to really understand software security. Please contact us at [mailto:owasp@owasp.org?subject=Student_Projects_at_OWASP owasp@owasp.org].
 # '''[[:Category:Principle|AppSec Principles]]''' - do some research and flesh out one of the OWASP principles. Talk about how the principle works in general, and then examine how it is applied in various contexts.
 # '''[[:Category:Attack|Attacks]]''' - flesh out the list of attacks, develop each one with content and links.
 # '''[[:Category:Vulnerability|Vulnerabilities]]''' - work to fill out writeups of vulnerabilities and clean up the vulnerability lists. There's lots of linking to other articles here needed.  We're integrating CLASP, CWE, Fortify, and other sources of vulnerabilities to make the best resource anywhere.
 # '''[[:Category:Countermeasure|Countermeasures]]''' - general cleanup and linking of these articles. Probably some stubs in there that need significant writing.
-# '''[[:Category:OWASP Metrics Project|AppSec Metrics]]''' - this project is harder, but desperately needed. Could involve paper exercises or actual tools.  If someone wants to implement the "software facts" label, that would be a thesis level project
 # '''[[:Category:OWASP Java Project|Java Project]]''' - great opportunity to do research and bring together all the best information in one place for Java developers
 Many of these projects are research projects that will help students develop their understanding of how application security works. Students who want to participate should: