This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Key Project Information:OWASP PCI Project"

From OWASP
Jump to: navigation, search
(→‎OWASP PCI Toolkit)
 
(78 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
----
+
=Main=
−
{| style="width:100%" border="0" align="center"
 
−
! colspan="8" align="center" style="background:#4058A0; color:white"|<font color="white">'''PROJECT INFORMATION'''
 
−
|-
 
−
| style="width:15%; background:#7B8ABD" align="center"|'''Project Name'''
 
−
| colspan="7" style="width:85%; background:#cccccc" align="left"|<font color="black">'''OWASP PCI TOOLKIT Project'''
 
−
|-
 
−
| style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
 
−
| colspan="7" style="width:85%; background:#cccccc" align="left"|
 
−
The OWASP PCI toolkit is a group of new and existing OWASP tools & Documentation that will provide organizations full support for PCI compliance process, from scoping to implementation.
 
−
The Toolkit consist of:
 
  
−
<b>OWASP PCI Scope Assessment tool (WPF .NET app)</b> this tool will allow organizations to create a full assessment scope. Based on the Open PCI DSS Scoping Toolkit Document, the tool will allow organizations to create a total report assessment, by providing the user with a complete analysis mechanism to all (inserted) system components
+
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
  
−
<b>OWASP PCI assessment criteria tool</b> once the scoping process has been finalized, the Assessment criteria toolkit will provide you with a complete analysis of the defined system components, based on the areas where the systems belong to. Example: A proxy server (Category 1) falls under the "Build and maintain a secure Network" requirements
+
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
−
The tool will deliver also, clear links and resources of existing OWASP tools and Documentation while applying the PCI testing procedures.
+
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
  
 +
==OWASP PCI Toolkit==
  
 +
OWASP PCI toolkit is an Open Source C# .NET Windows form project, that will help you to scope the PCI-DSS requirements for your System Components.
 +
Alpha version of this tool was released May 2014. So far it had 694 Downloads
 +
[[File:Screenshot_2016-05-11_18.27.07.png]]
 +
 +
The new version of this tool will be remake in Electron: http://electron.atom.io
 +
To allow a multi platform version.
 +
 +
Final Release :November 2016
 +
 +
We have had a total of 694 Downloads. Time for a new version with cooler features. We are working to make a Beta -Release for July 2016
 +
 +
==Introduction==
 +
 +
The PCI toolkit is based on a decision tree assessment methodology, which helps you identify if  your web applications are part of the PCI-DSS scope and how to apply the PCI-DSS requirements. By decomposing , one by one , you will be able to create an assessment and a final report of your scope delimitation and which OWASP guidelines must be used
 +
 +
==Licensing==
 +
OWASP PCI Toolkit is free to use. It is licensed under the [http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
 +
 +
==Preview tool==
 +
 +
[[File:Screenshot_2014-07-31_10.49.24.png|688px|thumb|left|alt=Printscreen|OWASP PCI Toolkit ''[[PCI Toolkit]]''.]]
 +
 +
==Download ==
 +
 +
latest release:
 +
https://sourceforge.net/projects/pcitoolkit/
 +
[[File:Project_Type_Files_TOOL.jpg]]
 +
 +
==User Guide==
 +
Go to:
 +
https://sourceforge.net/p/pcitoolkit/wiki/Home/
 +
 +
== Presentation ==
 +
https://www.owasp.org/index.php/File:Pci-dss.pdf
 +
 +
== Project Leader(s) ==
 +
 +
[[User:Johanna_Curiel | Johanna Curiel]]<br>
 +
[[User:Ignacio_Salom_Rangel | Ignacio Salom]]
 +
 +
== Related Projects ==
 +
* https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project
 +
* [[:Category:OWASP Application Security Verification Standard Project|OWASP Application Security Verification Standard]]
 +
 +
Based on the PCI Scoping toolkit methodology:
 +
http://www.isaca.org/Groups/Professional-English/pci-compliance/GroupDocuments/OpenPCIScopingToolkit.pdf
 +
 +
== Repository==
 +
 +
https://github.com/owaspjocur/OwaspPciToolkit
 +
 +
 +
 +
== News and Events ==
 +
* BlackHat 2014 Arsenal- 7 August 2014
 +
https://www.blackhat.com/us-14/arsenal.html#Curiel
 +
 +
* APPSEC EU 2014
 +
For more info visit: https://www.owasp.org/index.php/OWASP_Project_Summit_2014/Home#tab=Tracks_and_Sessions
 +
 +
 +
==PCI-DSS related projects==
 +
[[File:Cornucopia-pcidss-ecommerce-guidelines-small.jpg|link=https://www.pcisecuritystandards.org/pdfs/PCI_DSS_v2_eCommerce_Guidelines.pdf]]
 +
 +
OWASP Cornucopia Ecommerce Website Edition is referenced in the new [https://www.pcisecuritystandards.org Payment Card Industry Security Standards Council]  information supplement [https://www.pcisecuritystandards.org/pdfs/PCI_DSS_v2_eCommerce_Guidelines.pdf PCI DSS E-commerce Guidelines] v2, January 2013
 +
 +
==Classifications==
 +
 +
  {| width="200" cellpadding="2"
 +
  |-
 +
  | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=:Category:OWASP_Project#tab=Terminology]]
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]] 
 +
  |-
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=Defenders]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 +
  |}
  
−
|-
 
−
| style="width:15%; background:#7B8ABD" align="center"|
 
−
'''Key Project Information'''
 
−
| style="width:14%; background:#cccccc" align="center"|
 
−
Project Leader<br>Johanna Curiel, Tom Brennan
 
−
| style="width:15%; background:#cccccc" align="center"|
 
−
Project Contibutors<br>
 
−
| style="width:10%; background:#cccccc" align="center"|
 
−
Mailing List<br>[https://lists.owasp.org/mailman/listinfo/owasp-pci-project '''Subscribe here''']<br>[mailto:[email protected] '''Use here''']
 
−
| style="width:17%; background:#cccccc" align="center"|
 
−
License<br>[http://creativecommons.org/licenses/by-sa/3.0/ '''Creative Commons Attribution Share Alike 3.0''']
 
−
| style="width:14%; background:#cccccc" align="center"|
 
−
Project Type<br>[https://www.owasp.org/index.php/Category:OWASP_Project#tab=Alpha_Status_Projects '''Documentation + Tools''']
 
−
| style="width:15%; background:#cccccc" align="center"|
 
−
Sponsors<br>[http://www.whitehatsec.com/home/index.html '''WhiteHat Security''']<br>[http://www.orbitz.com/ '''Orbitz''']<br>[https://www.paymentsecuritypros.com/ '''SPSP''']
 
 
|}
 
|}
−
{| style="width:100%" border="0" align="center"
+
 
−
  ! align="center" style="background:#7B8ABD; color:white"|<font color="black">'''Release Status'''
+
= How to  =
−
  ! align="center" style="background:#7B8ABD; color:white"|<font color="black">'''Main Links'''
+
 
−
! align="center" style="background:#7B8ABD; color:white"|<font color="black">'''Related Projects'''
+
<b>Important Notice</b>
−
|-
+
 
−
| style="width:29%; background:#cccccc" align="center"|
+
Understanding of security vulnerabilities as explained in the OWASP top ten or SANS Top 25 is essential for using properly this scoping tool.
−
[[:Category:OWASP Project Assessment#Alpha Quality Documentation Criteria|'''Apha Quality''']]<br>[[:OWASP PCI Project - Assessment Frame|Please see here for complete information.]]
+
The tool helps to identify if the application falls within the PCI-DSS scope in order to become compliant however it is essential to identify if your organization has the necessary tools and know-how to be able to create a scope
−
| style="width:42%; background:#cccccc" align="center"|
+
*Knowledge of the most common security vulnerabilities in Web Applications
−
* add link(s)
+
*Knowledge of penetration tests and tools as advised by the PCI security council (ASV vendors)
−
  | style="width:29%; background:#cccccc" align="center"|
+
 
−
*  if any, add link(s)
+
Please check the guideline at:
−
|}
+
https://sourceforge.net/p/pcitoolkit/wiki/Home/
−
----
+
 
 +
=FAQs=
 +
 
 +
<b>What is PCI-DSS?</b>
 +
 
 +
The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step. The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents.
 +
 
 +
<b>How does the PCI toolkit work?</b>
 +
 
 +
The toolkit helps you identify if the application falls into the PCI-DSS scope and the necessary measures that must be taken in order to become compliant. The tool by it self does not scan your application but it guides you on the available tools, guidelines and documents related to understand much better how to properly execute the scope and test the application against security vulnerabilities
 +
 
 +
<b>What is the purpose of this tool?</b>
 +
 
 +
The main purposes is to offer an interactive guideline on how to determine if a web application falls into the PCI-DSS scope.
 +
The PCI-DSS requirements do not specify which guidelines , tools or how to implement the requirements, this tool helps you understand how to do it.
 +
 
 +
= Acknowledgements =
 +
==Volunteers==
 +
 
 +
Johanna Curiel
 +
 
 +
Ignacio Salom
 +
 
 +
 
 +
= Road Map and Getting Involved =
 +
 
 +
A prototype of the tool was released in May 2014
 +
-Alpha version 1.0 features
 +
*Series of Questions and answers regarding the Web application to be analyzed
 +
*For each application present in the environment to be analyzed,
 +
*Analysis and report of Card Holder Data present
 +
 
 +
 
 +
Alpha Release 1.1 Plan for Begin November 2015
 +
A complete remake of the Tool in Electron : http://electron.atom.io
 +
It will include:
 +
*Analysis Report of Testing Environment process and procedures
 +
* Reports in PDF format
 +
* Integration with OWASP OWFT and OWASP ZAP for preliminary analysis of web application vulnerabilities
 +
 
 +
 
 +
 
 +
==Feedback==
 +
Please email johanna[dot]curiel [at] owasp.org for feedback or submit issues at https://github.com/owaspjocur/OwaspPciToolkit/issues
 +
 
 +
__NOTOC__ <headertabs />
 +
 
 +
[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Download]]

Latest revision as of 22:35, 11 May 2016

OWASP Project Header.jpg

OWASP PCI Toolkit

OWASP PCI toolkit is an Open Source C# .NET Windows form project, that will help you to scope the PCI-DSS requirements for your System Components. Alpha version of this tool was released May 2014. So far it had 694 Downloads Screenshot 2016-05-11 18.27.07.png

The new version of this tool will be remake in Electron: http://electron.atom.io To allow a multi platform version.

Final Release :November 2016

We have had a total of 694 Downloads. Time for a new version with cooler features. We are working to make a Beta -Release for July 2016

Introduction

The PCI toolkit is based on a decision tree assessment methodology, which helps you identify if your web applications are part of the PCI-DSS scope and how to apply the PCI-DSS requirements. By decomposing , one by one , you will be able to create an assessment and a final report of your scope delimitation and which OWASP guidelines must be used

Licensing

OWASP PCI Toolkit is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Preview tool

Printscreen
OWASP PCI Toolkit PCI Toolkit.

Download

latest release: https://sourceforge.net/projects/pcitoolkit/ Project Type Files TOOL.jpg

User Guide

Go to: https://sourceforge.net/p/pcitoolkit/wiki/Home/

Presentation

https://www.owasp.org/index.php/File:Pci-dss.pdf

Project Leader(s)

Johanna Curiel
Ignacio Salom

Related Projects

Based on the PCI Scoping toolkit methodology: http://www.isaca.org/Groups/Professional-English/pci-compliance/GroupDocuments/OpenPCIScopingToolkit.pdf

Repository

https://github.com/owaspjocur/OwaspPciToolkit


News and Events

  • BlackHat 2014 Arsenal- 7 August 2014

https://www.blackhat.com/us-14/arsenal.html#Curiel

  • APPSEC EU 2014

For more info visit: https://www.owasp.org/index.php/OWASP_Project_Summit_2014/Home#tab=Tracks_and_Sessions


PCI-DSS related projects

Cornucopia-pcidss-ecommerce-guidelines-small.jpg

OWASP Cornucopia Ecommerce Website Edition is referenced in the new Payment Card Industry Security Standards Council information supplement PCI DSS E-commerce Guidelines v2, January 2013

Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png

Important Notice

Understanding of security vulnerabilities as explained in the OWASP top ten or SANS Top 25 is essential for using properly this scoping tool. The tool helps to identify if the application falls within the PCI-DSS scope in order to become compliant however it is essential to identify if your organization has the necessary tools and know-how to be able to create a scope

  • Knowledge of the most common security vulnerabilities in Web Applications
  • Knowledge of penetration tests and tools as advised by the PCI security council (ASV vendors)

Please check the guideline at: https://sourceforge.net/p/pcitoolkit/wiki/Home/

What is PCI-DSS?

The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step. The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents.

How does the PCI toolkit work?

The toolkit helps you identify if the application falls into the PCI-DSS scope and the necessary measures that must be taken in order to become compliant. The tool by it self does not scan your application but it guides you on the available tools, guidelines and documents related to understand much better how to properly execute the scope and test the application against security vulnerabilities

What is the purpose of this tool?

The main purposes is to offer an interactive guideline on how to determine if a web application falls into the PCI-DSS scope. The PCI-DSS requirements do not specify which guidelines , tools or how to implement the requirements, this tool helps you understand how to do it.

Volunteers

Johanna Curiel

Ignacio Salom


A prototype of the tool was released in May 2014 -Alpha version 1.0 features

  • Series of Questions and answers regarding the Web application to be analyzed
  • For each application present in the environment to be analyzed,
  • Analysis and report of Card Holder Data present


Alpha Release 1.1 Plan for Begin November 2015 A complete remake of the Tool in Electron : http://electron.atom.io It will include:

  • Analysis Report of Testing Environment process and procedures
  • Reports in PDF format
  • Integration with OWASP OWFT and OWASP ZAP for preliminary analysis of web application vulnerabilities


Feedback

Please email johanna[dot]curiel [at] owasp.org for feedback or submit issues at https://github.com/owaspjocur/OwaspPciToolkit/issues

Retrieved from "https://wiki.owasp.org/index.php?title=Key_Project_Information:OWASP_PCI_Project&oldid=216801"