This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10-2017 Foreword"
(Created page with "{{Top_10_2017:TopTemplate |usenext=2017NextLink |next={{Top_10:LanguageFile|text=introduction|language=en|year=2017|language=en}} |useprev=Nothing |prev= |year=...") |
(Tag: Visual edit) |
||
| Line 8: | Line 8: | ||
}} | }} | ||
| − | {{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstLeft|title={{Top_10:LanguageFile|text=foreword}}|year=2017|language=en}} | + | {{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstLeft|title={{Top_10:LanguageFile|text=foreword}}|year=2017|language=en}}Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure. As our software becomes increasingly critical, complex, and connected, the difficulty of achieving application security increases exponentially. The rapid pace of modern software development processes makes risks even more critical to discover quickly and accurately. We can no longer afford to tolerate relatively simple security problems like those presented in this OWASP Top 10. |
| − | Insecure software is undermining our financial, healthcare, | + | The goal of the Top 10 project is to raise awareness about application security by identifying some of the most critical risks facing organizations. The Top 10 project is referenced by many standards, books, tools, and organizations, including MITRE, PCI DSS, DISA, FTC, and many more. The OWASP Top 10 was first released in 2003, with minor updates in 2004 and 2007. The 2010 version was revamped to prioritize by risk, not just prevalence, and this pattern was continued in 2013 and this latest 2017 release. |
| − | defense, energy, and other critical infrastructure. As our | + | We encourage you to use the Top 10 to get your organization started with application security. Developers can learn from the mistakes of other organizations. Executives should start thinking about how to manage the risk that software applications and APIs create in their enterprise. |
| − | + | In the long term, we encourage you to create an application security program that is compatible with your culture and technology. These programs come in all shapes and sizes, and you should avoid attempting to do everything prescribed in some process model. Instead, leverage your organization’s existing strengths to do and measure what works for you. | |
| − | + | We hope that the OWASP Top 10 is useful to your application security efforts. Please don’t hesitate to contact OWASP with your questions, comments, and ideas, either publicly to [mailto:[email protected] [email protected]] or privately to [mailto:[email protected] [email protected]]. {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=right|title={{Top_10:LanguageFile|text=aboutOWASP}}|year=2017|language=en}} | |
| − | security increases exponentially. We can no longer afford to | ||
| − | tolerate relatively simple security problems like those | ||
| − | presented in this OWASP Top 10. | ||
| − | |||
| − | The goal of the Top 10 project is to raise awareness about | ||
| − | application security by identifying some of the most critical | ||
| − | risks facing organizations. The Top 10 project is referenced | ||
| − | by many standards, books, tools, and organizations, including | ||
| − | MITRE, PCI DSS, DISA, FTC, and | ||
| − | |||
| − | |||
| − | |||
| − | minor updates in 2004 and 2007. The 2010 version was | ||
| − | revamped to prioritize by risk, not just prevalence | ||
| − | |||
| − | |||
| − | We encourage you to use the Top 10 to get your organization | ||
| − | started with application security. Developers can learn from | ||
| − | the mistakes of other organizations. Executives should start | ||
| − | thinking about how to manage the risk that software | ||
| − | applications create in their enterprise. | ||
| − | |||
| − | In the long term, we encourage you to create an application | ||
| − | security program that is compatible with your culture and | ||
| − | technology. These programs come in all shapes and sizes, | ||
| − | and you should avoid attempting to do everything prescribed | ||
| − | |||
| − | organization’s existing strengths to do and measure what | ||
| − | works for you. | ||
| − | |||
| − | We hope that the OWASP Top 10 is useful to your application | ||
| − | security efforts. Please don’t hesitate to contact OWASP with | ||
| − | your questions, comments, and ideas, either publicly to | ||
| − | [mailto:[email protected] [email protected]] or privately to [mailto:[email protected] [email protected]]. | ||
| − | |||
| − | |||
| − | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=right|title={{Top_10:LanguageFile|text=aboutOWASP}}|year=2017|language=en}} | ||
The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. At OWASP you’ll find free and open … | The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. At OWASP you’ll find free and open … | ||
| Line 96: | Line 59: | ||
|language=en | |language=en | ||
}} | }} | ||
| − | |||
<!-- [[Category:OWASP Top Ten Project]] --> | <!-- [[Category:OWASP Top Ten Project]] --> | ||
Revision as of 16:02, 16 April 2017
NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.
|
Foreword Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure. As our software becomes increasingly critical, complex, and connected, the difficulty of achieving application security increases exponentially. The rapid pace of modern software development processes makes risks even more critical to discover quickly and accurately. We can no longer afford to tolerate relatively simple security problems like those presented in this OWASP Top 10.
The goal of the Top 10 project is to raise awareness about application security by identifying some of the most critical risks facing organizations. The Top 10 project is referenced by many standards, books, tools, and organizations, including MITRE, PCI DSS, DISA, FTC, and many more. The OWASP Top 10 was first released in 2003, with minor updates in 2004 and 2007. The 2010 version was revamped to prioritize by risk, not just prevalence, and this pattern was continued in 2013 and this latest 2017 release. We encourage you to use the Top 10 to get your organization started with application security. Developers can learn from the mistakes of other organizations. Executives should start thinking about how to manage the risk that software applications and APIs create in their enterprise. In the long term, we encourage you to create an application security program that is compatible with your culture and technology. These programs come in all shapes and sizes, and you should avoid attempting to do everything prescribed in some process model. Instead, leverage your organization’s existing strengths to do and measure what works for you. We hope that the OWASP Top 10 is useful to your application security efforts. Please don’t hesitate to contact OWASP with your questions, comments, and ideas, either publicly to [email protected] or privately to [email protected]. |
About OWASP
The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. At OWASP you’ll find free and open …
Learn more at: https://www.owasp.org All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. We advocate approaching application security as a people, process, and technology problem, because the most effective approaches to application security require improvements in all of these areas. OWASP is a new kind of organization. Our freedom from commercial pressures allows us to provide unbiased, practical, cost-effective information about application security. OWASP is not affiliated with any technology company, although we support the informed use of commercial security technology. Similar to many open source software projects, OWASP produces many types of materials in a collaborative, open way. The OWASP Foundation is the non-profit entity that ensures the project’s long-term success. Almost everyone associated with OWASP is a volunteer, including the OWASP Board, Global Committees, Chapter Leaders, Project Leaders, and project members. We support innovative security research with grants and infrastructure.
|
