Top 10 2013/ProjectMethodology - Revision history

Zakiakhmad: /* FAQ */

2013-03-27T07:33:20Z

‎FAQ

Zakiakhmad: /* FAQ */

2013-03-27T07:31:36Z

‎FAQ

Zakiakhmad: /* FAQ */

2013-03-27T07:31:08Z

‎FAQ

Zakiakhmad: /* FAQ */

2013-03-27T07:30:38Z

‎FAQ

Zakiakhmad: /* FAQ */

2013-03-27T07:29:15Z

‎FAQ

Zakiakhmad: /* FAQ */ Add why three year cycles reasons

2013-03-27T07:28:54Z

‎FAQ: Add why three year cycles reasons

Rcbarnett at 14:56, 13 March 2013

2013-03-13T14:56:05Z

Wichers: /* Current Methodology */

2013-03-05T14:04:10Z

‎Current Methodology

Jmanico: /* Suggested Enhancements */

2013-03-03T01:25:50Z

‎Suggested Enhancements

Jmanico: /* Suggested Enhancements */

2013-03-03T01:25:02Z

‎Suggested Enhancements

@@ Line 91: / Line 91: @@
 =FAQ=
-# The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
+. The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
-Here are the reasons:
+: Here are the reasons:
-a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.<br/>
+: a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
-b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.<br/>
+: b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
-c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year. <br/>
+: c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
-# ...
+. ...

@@ Line 90: / Line 90: @@
 =FAQ=
 # The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
-:Here are the reasons:
+Here are the reasons:
 a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.<br/>
 b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.<br/>
 c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year. <br/>
 # ...

@@ Line 91: / Line 91: @@
 =FAQ=
 # The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
-: Here are the reasons:
+:Here are the reasons:
-a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
+a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.<br/>
-b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
+b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.<br/>
-c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
+c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year. <br/>
 # ...

@@ Line 91: / Line 91: @@
 =FAQ=
 # The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
-: Here are three reasons why OWASP release its Top 10 every three year:
+: Here are the reasons:
-##The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
+a) The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
-## It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
+b) It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
-## Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
+c) Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
 # ...

@@ Line 92: / Line 92: @@
 # The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
 : Here are three reasons why OWASP release its Top 10 every three year:
-: #The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
+##The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
-: # It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
+## It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
-: # Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
+## Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
 # ...

← Older revision		Revision as of 07:28, 27 March 2013
Line 90:		Line 90:

	=FAQ=		=FAQ=
−	* TBD	+	# The Three Cycle Reasons. Why OWASP Top 10 is release every three year cycle?
		+	: Here are three reasons why OWASP release its Top 10 every three year:
		+	: #The field does evolve pretty quick but Top 10 risks not substantially change every single year. Release every year is too much.
		+	: # It takes a lot of work to produce OWASP Top 10 update and spacing it out balances between the effort to produce and the amount of change when its updated.
		+	: # Lots of organizations, tools, etc, organize to the OWASP Top 10. So if it was published every single year, then everyone that chooses to align themselves to each update would have to do that work every year.
		+	# ...

@@ Line 73: / Line 73: @@
 # Additional data sources could be considered (please add links)
 #* WASC [http://projects.webappsec.org/w/page/13246995/Web-Hacking-Incident-Database Web Hacking Incident Database]
-#* Akamai State of the Internet Reports
+#** [https://www.google.com/fusiontables/DataSource?snapid=S91371616ef WHID Top Attack Methods for 2012]
 #* Firehosts Web Application Attack Reports
 #* Imperva's Web Application Attack Reports
 # Additional reports could be considered:
 #* Annual Symantec Internet Threat Reports
 #* Datalossdb
 #* IBM XForce threat reports
 # Public forum to brainstorm and discuss key topics
 # Remove corporate logos from the Top Ten PDF and provide a "Who we are" link similar to Apache for maximum vendor neutrality: http://hadoop.apache.org/who.html

@@ Line 35: / Line 35: @@
 # Publish a Final Release
-This certainly doesn't cover every nuance of what it takes to produce the Top 10. For example, one of the most common comments is "Why don't you combine these two items into one to make room for my favorite Risk?". Like combining XSS into Injection, since XSS is really just a client side injection issue. The goal of the OWASP Top 10 is to raise awareness of the most important Risks, not to include every possible Risks we can stuff into the Top 10. So, in some cases, we've kept related issues separate to try to increase awareness of each issue. But there is always debate as to what's best, which is clearly subjective. In the 2013 release candidate, we combined cryptographic storage and communications into a single category, and then pulled use of known vulnerable libraries out of the Security Misconfiguration category in order to bring more attention to the use of Known Vulnerable Libraries since we believe this is an extremely important issue that deserves more attention as the use of libraries becomes more and more prevalent. In past updates, to make room for new issues, we dropped the least important issues, like error handling and denial of service, which some people agreed with, but others did not.
+This certainly doesn't cover every nuance of what it takes to produce the Top 10. For example, one of the most common comments is "Why don't you combine these two items into one to make room for my favorite Risk?". Like combining XSS into Injection, since XSS is really just a client side injection issue. The goal of the OWASP Top 10 is to raise awareness of the most important Risks, not to include every possible Risk we can stuff into the Top 10. So, in some cases, we've kept related issues separate to try to increase awareness of each issue. But there is always debate as to what's best, which is clearly subjective. In the 2013 release candidate, we combined cryptographic storage and communications into a single category, and then pulled use of known vulnerable libraries out of the Security Misconfiguration category in order to bring more attention to the use of Known Vulnerable Libraries since we believe this is an extremely important issue that deserves more attention as the use of libraries becomes more and more prevalent. In past updates, to make room for new issues, we dropped the least important issues, like error handling and denial of service, which some people agreed with, but others did not.
 In 2010, the Release Candidate process worked like this:

@@ Line 67: / Line 67: @@
 # Use a public wiki or [http://code.google.com/p/owasptop10/issues/list google issues] to capture feedback - mailing lists are tough and things get lost
-# Use a public wiki to allow for public edits, not just feedback. These edits will all be tracked with rollback capabilities for editing and will allow the history of Top 10 edits to be "public".
+# Use a public wiki to allow for public edits, not just feedback. These edits will all be tracked with rollback capabilities for editing and will allow the history of Top 10 edit history to be "public" for maximum "open" and "visibility".
 # Establish a Top 10 panel to evaluate and make final decisions on inclusion & ranking
 #* Not feasible for everyone to vote on every item