SWAMP OWASP - Revision history

Johanna Curiel at 21:58, 6 June 2014

2014-06-06T21:58:53Z

Johanna Curiel at 21:35, 6 June 2014

2014-06-06T21:35:56Z

Johanna Curiel at 21:27, 6 June 2014

2014-06-06T21:27:11Z

Johanna Curiel at 21:23, 6 June 2014

2014-06-06T21:23:49Z

Johanna Curiel at 21:15, 6 June 2014

2014-06-06T21:15:20Z

Johanna Curiel: Created page with "PROJECT: Integrating OWASP tools into the SWAMP program for retroactive quality assurance ==What is SWAMP (Software Assurance Market Place)?== Researchers who develop new sof..."

2014-06-06T21:01:57Z

Created page with "PROJECT: Integrating OWASP tools into the SWAMP program for retroactive quality assurance ==What is SWAMP (Software Assurance Market Place)?== Researchers who develop new sof..."

New page

PROJECT: Integrating OWASP tools into the SWAMP program for retroactive quality assurance

==What is SWAMP (Software Assurance Market Place)?==
Researchers who develop new software assurance tools and methodologies will use the repositories and cyber infrastructure offered by the marketplace to improve their technologies and tools, while software developers and adopters will use the same services to hunt for vulnerabilities in their software. Educators will use these services to offer hands-on experience in software assurance techniques to their students.
By facilitating the sharing of tools, techniques, information, experiences and resources, the Software Assurance Marketplace will:
*Help advance the quality and adoption rate of software assurance tools;
*Lower the threshold for using them; and
*Make it easier to interpret and use the resulting output.

==Mission: Make OWASP Tools part of the SWAMP==
The Quality Assurance project within OWASP, aims to help develop OWASP tools to a higher quality standard. OWASP tools can become part of the SWAMP during this process where we aim to:
*Verify and assess flagship code/tool projects to use the SWAMP infrastructure for continuous code analysis against security vulnerabilities
*Verify that they meet the necessary requirements for proper deployment into SWAMP servers for automated assessment
*Make OWASP tools available through the SWAMP for users
*Help promote OWASP tools through the SWAMP to verify vulnerabilities in web applications’ code
*Automate the process of OWASP tools to verify Quality Assurance

==Phase One: Verify OWASP tools can be tested and deployed through the SWAMP==
The first objective during this phase is to verify that OWASP tools can be indeed build and deployed properly in SWAMP servers
The tools to be included in this phase are Tools written in Java, C or C++
Requirements to deploy these tools in SWAMP are
*Must work on Linux OS (Debian /Fedora/Red Hat/Scientific/Ubuntu)
*Build script written in C++/C or be able to use a simple build code such as : Configure+Make, Cmake, Make for example or a custom script in C/C++

==Phase Two: Promote the development of OWASP code analysis tools==
Right now SWAMP program focuses on tools that can be deployed in JAVA, C++/C in a Linux environment, however it is in their plan to extend to other languages such as PHP, .NET or Ruby on Rails
OWASP tools that focuses on Code analysis can play a big role here. In order to help these tools become part of the SWAMP program the following steps can help with this part:
*Help develop OWASP tools to higher quality standards to be part of SWAMP code analysis tools
*Explore the possibilities to obtain grants through DHS for these tools, therefore updating the quality to become part of the SWAMP analysis tools

==Phase Three: Continuous and Retroactive automated testing through the SWAMP program==
Once OWASP flagship projects are ready to be deployed and eventually, those tools that can execute code analysis for other languages than the ones supported by SWAMP right now, SWAMP environment can be used to help automate most of the testing and verification of code vulnerabilities in OWASP tools. At this phase, this becomes a retroactive process where SWAMP tools are used for code analysis of OWASP tools but at the same time OWASP tools become code analysis tools of the SWAMP.

@@ Line 32: / Line 32: @@
 ==Phase Two: Promote the development of OWASP code analysis tools==
-Right now SWAMP program focuses on tools that can be deployed in JAVA, C++/C in a Linux environment, however it is in their plan to extend to other languages such as PHP, .NET or Ruby on Rails
+Right now SWAMP program focuses on tools that can be deployed in JAVA, C++/C in a Linux environment, however it is in their plan to extend to other languages such as PHP, .NET or Ruby on Rails.
-OWASP tools that focuses on Code analysis can play a big role here. In order to help these tools become part of the SWAMP program the following steps can help with this part:
+OWASP tools that focuses on Code analysis can play a big role here. In order to help these tools become part of the SWAMP program, the following steps can help with this part:
 *Help develop OWASP tools to higher quality standards to be part of SWAMP code analysis tools
 *Explore the possibilities to obtain grants through DHS for these tools, therefore updating the quality to become part of the SWAMP analysis tools
@@ Line 42: / Line 42: @@
 ===Planning===
-Phase one==> Starting June until September 2014. This is linked to the QA plan:
+Phase one==> Starting 9 June until September/October 2014. This is linked to the QA plan:
 https://www.owasp.org/index.php/File:PilotProjectQA-approachPlan.pdf

@@ Line 42: / Line 42: @@
 ===Planning===
-Phase one==> Starting June until September 2014. This is linke dto the QA plan:
+Phase one==> Starting June until September 2014. This is linked to the QA plan:
 https://www.owasp.org/index.php/File:PilotProjectQA-approachPlan.pdf

@@ Line 9: / Line 9: @@
 ===More info:===
-http://www.dhs.gov/csd-swamp</br>
+http://www.dhs.gov/csd-swamp
 https://continuousassurance.org/

@@ Line 2: / Line 2: @@
 ==What is SWAMP (Software Assurance Market Place)?==
-Researchers who develop new software assurance tools and methodologies will use the repositories and cyber infrastructure offered by the marketplace to improve their technologies and tools, while software developers and adopters will use the same services to hunt for vulnerabilities in their software. Educators will use these services to offer hands-on experience in software assurance techniques to their students.
+The Software Assurance Marketplace (SWAMP) is committed to bringing a transformative change to the national software assurance landscape by providing a national marketplace that provides continuous software assurance capabilities to researchers and developers. By providing Software Assurance (SWA) researchers, tool developers, tool users, and educators who train our workforce a suite of secure and dependable analysis services, SWAMP will reduce the number of vulnerabilities deployed in software. Researchers who develop new SWA tools and methodologies will use the repositories and cyber infrastructure offered by the SWAMP to improve their technologies and tools, while software developers and adopters will use the same services to hunt for vulnerabilities in their software. Educators will use these services to offer hands-on experience in SWA techniques to their students. By facilitating the sharing of tools, techniques, information, experiences, and resources, the SWAMP will:
 *Help advance the quality and adoption rate of software assurance tools;
 *Lower the threshold for using them; and

@@ Line 1: / Line 1: @@
-PROJECT: Integrating OWASP tools into the SWAMP program for retroactive quality assurance
+=PROJECT: Integrating OWASP tools into the SWAMP program for retroactive quality assurance=
 ==What is SWAMP (Software Assurance Market Place)?==
@@ Line 7: / Line 7: @@
 *Lower the threshold for using them; and
 *Make it easier to interpret and use the resulting output.
 ==Mission: Make OWASP Tools part of the SWAMP==
-The Quality Assurance project within OWASP, aims to help develop OWASP tools to a higher quality standard. OWASP tools can become part of the SWAMP during this process where we aim to:
+The Quality Assurance project(see link on more info) within OWASP, aims to help develop OWASP tools to a higher quality standard. OWASP tools can become part of the SWAMP during this process where we aim to:
 *Verify and assess flagship code/tool projects to use the SWAMP infrastructure for continuous code analysis against security vulnerabilities
 *Verify that they meet the necessary requirements for proper deployment into SWAMP servers for automated assessment
@@ Line 15: / Line 19: @@
 *Help promote OWASP tools through the SWAMP to verify vulnerabilities in web applications’ code
 *Automate the process of OWASP tools to verify Quality Assurance
 ==Phase One: Verify OWASP tools can be tested and deployed through the SWAMP==
 The first objective during this phase is to verify that OWASP tools can be indeed build and deployed properly in SWAMP servers
-The tools to be included in this phase are Tools written in Java, C or C++
+The tools to be included in this phase are OWASP candidate flagship Tools/Code written in Java, C or C++
 Requirements to deploy these tools in SWAMP are
 *Must work on Linux OS (Debian /Fedora/Red Hat/Scientific/Ubuntu)
@@ Line 31: / Line 38: @@
 ==Phase Three: Continuous and Retroactive automated testing through the SWAMP program==
 Once OWASP flagship projects are ready to be deployed and eventually, those tools that can execute code analysis for other languages than the ones supported by SWAMP right now, SWAMP environment can be used to help automate most of the testing and verification of code vulnerabilities in OWASP tools. At this phase, this becomes a retroactive process where SWAMP tools are used for code analysis of OWASP tools but at the same time OWASP tools become code analysis tools of the SWAMP.