Top 10 2007-Where to Go From Here - Revision history

Wichers at 02:45, 19 April 2010

2010-04-19T02:45:43Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textorpaschilim.com

2009-05-27T18:28:02Z

Reverting to last version not containing links to www.textorpaschilim.com

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-27T15:59:35Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 08:22, 27 May 2009

2009-05-27T08:22:42Z

Deleted user at 11:32, 26 May 2009

2009-05-26T11:32:30Z

Deleted user at 19:32, 21 May 2009

2009-05-21T19:32:49Z

KirstenS at 14:12, 23 March 2009

2009-03-23T14:12:47Z

KirstenS: /* For C-level Executives */

2009-03-05T12:48:37Z

‎For C-level Executives

KirstenS: /* For Application Owners */

2009-03-05T12:46:25Z

‎For Application Owners

KirstenS: /* For Architects and Designers */

2009-03-05T12:45:56Z

‎For Architects and Designers

← Older revision		Revision as of 02:45, 19 April 2010
Line 68:		Line 68:
	*'''Adopt responsible disclosure practices''' and build a process to properly respond to vulnerability reports for your products		*'''Adopt responsible disclosure practices''' and build a process to properly respond to vulnerability reports for your products

		+	{{Top_10_2007:TopTemplate\|usenext=NextLink\|next=-References\|useprev=PrevLink\|prev=-Failure to Restrict URL Access\|usemain=MainLink\|main=}}

−	~~{{Top_10_2007~~:~~TopTemplate\|usenext=NextLink\|next=-References\|useprev=PrevLink\|prev=-Failure to Restrict URL Access\|usemain=MainLink\|main=}}~~	+	[[Category:OWASP Top Ten Project]]

@@ Line 1: / Line 1: @@
 {{Top_10_2007:TopTemplate|usenext=NextLink|next=-References|useprev=PrevLink|prev=-Failure to Restrict URL Access|usemain=MainLink|main=}}
@@ Line 5: / Line 4: @@
 The OWASP Top 10 is just the beginning of your web application security journey.
-''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two â¦who is shocked that any software company would ship a product before every last bug is fixed.''
+''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two …who is shocked that any software company would ship a product before every last bug is fixed.''
 ''Eric Sink, Guardian May 25, 2006''
@@ Line 17: / Line 16: @@
 *'''Ask questions about business requirements''', particularly missing non-functional requirements
 *Work through the [[OWASP_Secure_Software_Contract_Annex|OWASP Secure Software Contract Annex]] with your customer
-*'''Encourage safer design''' â include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
+*'''Encourage safer design''' – include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
 *'''Ensure that you have considered confidentiality, integrity, availability , and non-repudiation'''
 *'''Ensure your designs are consistent with security policy and standards''', such as COBIT or PCI DSS 1.1
@@ Line 23: / Line 22: @@
 == For Developers ==
-Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) â it takes a master to build secure software. Aim to become a master.
+Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) – it takes a master to build secure software. Aim to become a master.
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
-*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donât have one
+*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you don’t have one
-*'''Design your features securely''' â consider defense in depth and simplicity in design
+*'''Design your features securely''' – consider defense in depth and simplicity in design
 *'''Adopt coding standards''' which encourage safer code constructs
 *'''Refactor existing code to use safer constructs''' in your chosen platform, such as parameterized queries
@@ Line 40: / Line 39: @@
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
 *If your project has more than 4 developers, '''consider making at least one developer a security person'''
-*'''Design your features securely''' â consider defense in depth and simplicity in design
+*'''Design your features securely''' – consider defense in depth and simplicity in design
 *'''Adopt coding standards which encourage safer code constructs'''
 *'''Adopt the responsible disclosure policy''' to ensure that security defects are handled properly

@@ Line 1: / Line 1: @@
 http://www.textorpaschilim.com
 {{Top_10_2007:TopTemplate|usenext=NextLink|next=-References|useprev=PrevLink|prev=-Failure to Restrict URL Access|usemain=MainLink|main=}}
@@ Line 79: / Line 5: @@
 The OWASP Top 10 is just the beginning of your web application security journey.
-''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two ÃÂ¢ÃÂÃÂ¦who is shocked that any software company would ship a product before every last bug is fixed.''
+''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two â¦who is shocked that any software company would ship a product before every last bug is fixed.''
 ''Eric Sink, Guardian May 25, 2006''
@@ Line 91: / Line 17: @@
 *'''Ask questions about business requirements''', particularly missing non-functional requirements
 *Work through the [[OWASP_Secure_Software_Contract_Annex|OWASP Secure Software Contract Annex]] with your customer
-*'''Encourage safer design''' ÃÂ¢ÃÂÃÂ include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
+*'''Encourage safer design''' â include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
 *'''Ensure that you have considered confidentiality, integrity, availability , and non-repudiation'''
 *'''Ensure your designs are consistent with security policy and standards''', such as COBIT or PCI DSS 1.1
@@ Line 97: / Line 23: @@
 == For Developers ==
-Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) ÃÂ¢ÃÂÃÂ it takes a master to build secure software. Aim to become a master.
+Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) â it takes a master to build secure software. Aim to become a master.
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
-*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donÃÂ¢ÃÂÃÂt have one
+*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donât have one
-*'''Design your features securely''' ÃÂ¢ÃÂÃÂ consider defense in depth and simplicity in design
+*'''Design your features securely''' â consider defense in depth and simplicity in design
 *'''Adopt coding standards''' which encourage safer code constructs
 *'''Refactor existing code to use safer constructs''' in your chosen platform, such as parameterized queries
@@ Line 114: / Line 40: @@
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
 *If your project has more than 4 developers, '''consider making at least one developer a security person'''
-*'''Design your features securely''' ÃÂ¢ÃÂÃÂ consider defense in depth and simplicity in design
+*'''Design your features securely''' â consider defense in depth and simplicity in design
 *'''Adopt coding standards which encourage safer code constructs'''
 *'''Adopt the responsible disclosure policy''' to ensure that security defects are handled properly

@@ Line 1: / Line 1: @@
 [http://s1.shard.jp/galeach/new89.html asian dragon pet water
 ] [http://s1.shard.jp/frhorton/sprmxlc9l.html marraco africa
@@ Line 43: / Line 79: @@
 The OWASP Top 10 is just the beginning of your web application security journey.
-''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two Ã¢ÂÂ¦who is shocked that any software company would ship a product before every last bug is fixed.''
+''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two ÃÂ¢ÃÂÃÂ¦who is shocked that any software company would ship a product before every last bug is fixed.''
 ''Eric Sink, Guardian May 25, 2006''
@@ Line 55: / Line 91: @@
 *'''Ask questions about business requirements''', particularly missing non-functional requirements
 *Work through the [[OWASP_Secure_Software_Contract_Annex|OWASP Secure Software Contract Annex]] with your customer
-*'''Encourage safer design''' Ã¢ÂÂ include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
+*'''Encourage safer design''' ÃÂ¢ÃÂÃÂ include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
 *'''Ensure that you have considered confidentiality, integrity, availability , and non-repudiation'''
 *'''Ensure your designs are consistent with security policy and standards''', such as COBIT or PCI DSS 1.1
@@ Line 61: / Line 97: @@
 == For Developers ==
-Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) Ã¢ÂÂ it takes a master to build secure software. Aim to become a master.
+Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) ÃÂ¢ÃÂÃÂ it takes a master to build secure software. Aim to become a master.
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
-*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donÃ¢ÂÂt have one
+*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donÃÂ¢ÃÂÃÂt have one
-*'''Design your features securely''' Ã¢ÂÂ consider defense in depth and simplicity in design
+*'''Design your features securely''' ÃÂ¢ÃÂÃÂ consider defense in depth and simplicity in design
 *'''Adopt coding standards''' which encourage safer code constructs
 *'''Refactor existing code to use safer constructs''' in your chosen platform, such as parameterized queries
@@ Line 78: / Line 114: @@
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
 *If your project has more than 4 developers, '''consider making at least one developer a security person'''
-*'''Design your features securely''' Ã¢ÂÂ consider defense in depth and simplicity in design
+*'''Design your features securely''' ÃÂ¢ÃÂÃÂ consider defense in depth and simplicity in design
 *'''Adopt coding standards which encourage safer code constructs'''
 *'''Adopt the responsible disclosure policy''' to ensure that security defects are handled properly

@@ Line 1: / Line 1: @@
 http://www.textorpaschilim.com
 {{Top_10_2007:TopTemplate|usenext=NextLink|next=-References|useprev=PrevLink|prev=-Failure to Restrict URL Access|usemain=MainLink|main=}}
@@ Line 5: / Line 43: @@
 The OWASP Top 10 is just the beginning of your web application security journey.
-''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two â¦who is shocked that any software company would ship a product before every last bug is fixed.''
+''The world's six billion people can be divided into two groups: group one, who know why every good software company ships products with known bugs; and group two, who don't. Those in group 1 tend to forget what life was like before our youthful optimism was spoiled by reality. Sometimes we encounter a person in group two Ã¢ÂÂ¦who is shocked that any software company would ship a product before every last bug is fixed.''
 ''Eric Sink, Guardian May 25, 2006''
@@ Line 17: / Line 55: @@
 *'''Ask questions about business requirements''', particularly missing non-functional requirements
 *Work through the [[OWASP_Secure_Software_Contract_Annex|OWASP Secure Software Contract Annex]] with your customer
-*'''Encourage safer design''' â include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
+*'''Encourage safer design''' Ã¢ÂÂ include defense in depth and simpler constructs through using threat modeling (see [HOW1] in the book references)
 *'''Ensure that you have considered confidentiality, integrity, availability , and non-repudiation'''
 *'''Ensure your designs are consistent with security policy and standards''', such as COBIT or PCI DSS 1.1
@@ Line 23: / Line 61: @@
 == For Developers ==
-Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) â it takes a master to build secure software. Aim to become a master.
+Many developers already have a good handle on web application security basics. To ensure effective mastery of the web application security domain requires practice. Anyone can destroy (i.e. perform penetration testing) Ã¢ÂÂ it takes a master to build secure software. Aim to become a master.
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
-*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donât have one
+*'''Ask for secure code training''' if you have a training budget. Ask for a training budget if you donÃ¢ÂÂt have one
-*'''Design your features securely''' â consider defense in depth and simplicity in design
+*'''Design your features securely''' Ã¢ÂÂ consider defense in depth and simplicity in design
 *'''Adopt coding standards''' which encourage safer code constructs
 *'''Refactor existing code to use safer constructs''' in your chosen platform, such as parameterized queries
@@ Line 40: / Line 78: @@
 *Consider [[Membership | joining OWASP]] and attending [[:Category:OWASP_Chapter|local chapter]] meetings
 *If your project has more than 4 developers, '''consider making at least one developer a security person'''
-*'''Design your features securely''' â consider defense in depth and simplicity in design
+*'''Design your features securely''' Ã¢ÂÂ consider defense in depth and simplicity in design
 *'''Adopt coding standards which encourage safer code constructs'''
 *'''Adopt the responsible disclosure policy''' to ensure that security defects are handled properly

@@ Line 62: / Line 62: @@
 *'''Train your developers in secure coding techniques''' and ensure they keep these skills up to date
 *'''Include security-relevant code analysis tools in your budget'''
-*'''Notify your software producers of the importance of security to your bottom line'''.
+*'''Notify your software producers of the importance of security to your bottom line'''
 *'''Train your architects, designers, and business people in web application security fundamentals'''
 *'''Consider using third-party code auditors''', who can provide an independent assessment

@@ Line 47: / Line 47: @@
 Application owners in commercial settings are often time and resource constrained. Application owners should:
-*Work through the [http://www.owasp.org/index.php/OWASP_Secure_Software_Contract_Annex OWASP Secure Software Contract Annex] with the software producers
+*Work through the [[OWASP_Secure_Software_Contract_Annex|OWASP Secure Software Contract Annex]] with the software producers
 *'''Ensure business requirements include non-functional requirements (NFRs) such as security requirements'''
 *'''Encourage designs which include secure by default features''', defense in depth and simplicity in design