This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Zezengorri Code Project"

From OWASP
Jump to: navigation, search
(→‎Project Leader)
(Edicion)
 
(26 intermediate revisions by the same user not shown)
Line 5: Line 5:
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
−
==OWASP Code Library Project==
+
==OWASP Code Library Project ==
−
This  is   Zezengorri  a   library   to  allows   you   to   add   security   in  the  development   IDE   from   the day   one,  of  the   moment   you   decide   implement   security  development   to   your   projects, starting  in  design  phase  of    new projects,  and  in old projects for  see  what  you  miss  detecting the  vulnerabilities   of   the  web   server,  the  computer  and   the   programming   language   before starting   the   development   on  in  parallel   with  the   Lifecycle  software  development.
+
'''Zezengorri''' is a library that allows you to add security to your development IDE from day one. From the moment you decide to implement secure development to your projects.
 +
 
 +
You can start either while designing your new projects or implement it in old projects. You can use it to detect vulnerabilities of your web server and the programming language even before starting the development parallel to the system development life circle.
  
 
==Description==
 
==Description==
−
When  developers,   team   leaders   or   project   managers   add   security   to   a   web   application,   the   first thing  that   comes   up  is   the  question  of  which   technologies   are  handled  in   my  web   project,   what operating   system   the   web   server   supports,  what  version   of  server   or   what  version  of  the database   the  application  uses,   for  this  Owasp  define  the  threat   modeling   (knowing  what  we have).
+
Whenever developers, team leaders or project managers add security to a web application, the first question that comes to mind is which technologies will be implemented in the web project, what operating system is supported by the web server and on which version the server or database runs. For these reasons, OWASP defined a threat modeling document.  
  
−
This   project   Zezengorri   is   a   code   library   is   a   downloadable   package   that   adheres   to   the   root   of the   web   project,   and   from   them   this   can,   analyzes   and   seeks   to   collect   in   a   simple   web   page   the characteristics   of   all   the   security   components   for   examples:   if   our   website   uses   or   not   HSTS,   the versions   of   Chipset   active,   the   use   of   SSL   certificate   for   the   web   page   among   other   securities characteristics   important   measure   in   the   during   the   life   cycle   development   software   .   Each   of these   item   is   display   in   a   new   web page   in   a   list   of   item   any   show   if   is   active   or   not,   the   version   of the   plugin   and   a   web link.   That   links   redirect   to   the   CVE   page   and   the   CVE   score   of   this   item. determine   if   the   project   can   be   promoted   to   the   next   category.   The   information   requested   is   also intended   to   help   Project   Leaders   think   about   the   road map   and   feature   priorities,   and   give guidance   to   the   reviews   as   a   result   of   that   effort.
+
This project '''Zezengorri''' is a code library is a downloadable package that adheres to the root of the web project, and from them this can, analyzes and seeks to collect in a simple web page the characteristics of all the security components for examples: if our website uses or not '''HSTS''', the versions of '''Chipset''' active, the use of '''SSL''' certificate for the web page among other securities characteristics important measure in the during the life cycle development software . Each of these item is display in a new web page in a list of item any show if is active or not, the version of the plugin and a web link. That links redirect to the '''CVE''' page and the '''CVE''' score of this item. determine if the project can be promoted to the next category. The information requested is also intended to help Project Leaders think about the road map and feature priorities, and give guidance to the reviews as a result of that effort.
  
−
Creating  a  new  set  of  project  pages  from   scratch  can  be  a  challenging  task.  By  providing  a sample  layout,  with  instructional  text  and   examples,   the   OWASP  Code  Project  Template  makes  it easier  for  Project  Leaders  to   create   effective  security  projects  and  hence  helps  promote  security.
+
Apart from detecting and resolving security issues, the recompiled information is also useful to project leaders who can use it to create risk-models for the websites they manage.
  
 
==Licensing==
 
==Licensing==
Line 27: Line 29:
 
== Project Resources ==
 
== Project Resources ==
  
−
[[Https://drive.google.com/file/d/0B6d-UqLnHsOnUTZLTXVLbEZyY0E/view?usp=sharing|Secure Codding Life Cycle]]
+
[Https://drive.google.com/file/d/0B6d-UqLnHsOnUTZLTXVLbEZyY0E/view?usp=sharing|Secure Applications Security in IT deparment]  
 +
 
 +
[Https://drive.google.com/file/d/0B6d-UqLnHsOnSDlwQW5tNGRKMkxSblVWX1g0RHZuNTJjM2tV/view?usp=sharing|Source Applications Security using  .Net]
 +
 
 +
== Project Leader ==
  
−
[[Https://drive.google.com/file/d/0B6d-UqLnHsOnSDlwQW5tNGRKMkxSblVWX1g0RHZuNTJjM2tV/view?usp=sharing|Source Codding .Net]]
+
Project leader's name:
  
−
[[Http://www.swtestacademy.com/automated-security-testing-using-zap/|Security Automate Test]]
+
'''-Gustavo Nieves Arreaza'''
  
−
== Project Leader ==
+
Volunteers :
 +
 
 +
'''-Lubyn Rodriguez(PM)'''
 +
 
 +
'''-Hernan Pantoja(Developer)'''
  
−
Project leader's name:Gustavo Nieves Arreaza
+
'''-Samuel Morales(Developer)'''
  
−
Volunteers : Lubyn Rodriguez(Project Managment)
+
'''-Manuel Heyers(Developer)'''
  
 
== Related Projects ==
 
== Related Projects ==
Line 62: Line 72:
  
 
== News and Events ==
 
== News and Events ==
−
* [1 Nov 2017]  Release Page  Explain the Concept, with a white Paper
+
* '''[1 Nov 2017]''' Release Page  Explain the Concept, with a white Paper
−
* [19 Jan 2018] 1.0  Release Candidate is available for download.  This release provides final bug fixes and product stabilization.  Any feedback (good or bad) in the next few weeks would be greatly appreciated.
+
* '''[3 Apr 2018]''' The Inacap Institute and their students also start to participate in the Zezengorri owasp https://www.inacap.cl/tportalvp/alumnos.
 +
* '''[19 Aug 2018]''' 1.0  Release Candidate is available for download.  This release provides final bug fixes and product stabilization.  Any feedback (good or bad) in the next few weeks would be greatly appreciated.  
 +
* Repository: [https://github.com/VascoArreaza/OWASPZezengorri]
  
 
|}
 
|}
  
 
=FAQs=
 
=FAQs=
−
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->==How can I participate in your project?==
+
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->==How can I participate in our project?==
−
For  this  first  Phase:  If   you   have   experience   in   web   development   with  languages    such  as  Node.JS, C #,  Java.  
+
If you have experience in web development using for example: Node.JS, C# or Java and are interested in learning about applications security please contact us via the official mail: '''gustavo.nievesarreaza@owasp.com'''
  
−
And  you   want  to  learn  about  security  on  web  pages.  You  can   participate   please  contact  us  by  the official  mail  of  the   project  leader  Zezengorri
+
==If I am not a programmer can I participate in our project?==
 +
Yes, you can certainly participate in the project if you are not a programmer or technician. The project needs different skills and expertise for different times during its development ,Currently we are looking for IT persons that are willing to investigate how implement and improve the security in applications.
  
−
==If I am not a programmer can I participate in your project?==
+
We are looking right now people for make our:
−
Yes,  you  can  certainly  participate  in  the  project  if  you  are   not  a  programmer  or  technical.  The project  needs  different  skills  and  expertise  and  different  times  during  its  development.  Currently, we  are  looking   for   researchers  to  like  know  how      computer,server,databases  and  network  work and  how  can  secure,  the  web  applications  whe  these  is  use  this  resources;  and  writers  for document  all  we  are  going  to  do.
 
  
−
= Acknowledgements =
+
'''-QA'''
−
==Volunteers==
 
  
−
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
+
'''-Marketing'''
−
The  OWASP  Security  Zenzengorri  Principles  project  is  developed  by  a  worldwide  team  of volunteers.  A  live  update  of  project    contributors  is  found  here .
 
  
−
The  first  contributors  to  the  project  were:
+
'''-Development (using Node.Js and Python)'''
−
*
 
  
−
= Road Map and Getting Involved =
+
= Acknowledgements =
 +
==Volunteers==
  
 
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
 
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
−
==Roadmap==
+
The  OWASP  Security  '''Zenzengorri'''  Principles  project  is  developed  by  a  worldwide  team  of volunteers.  A   live   update   of  project    contributors   is   found   here .
−
As of '''''february'' , 2017, the highest priorities for the next 6 months''' are:
 
−
<strong></strong>'''● Complete   the   first   draft   of  the   Code   Project   Template'''
 
  
−
'''● Get   other   people   to   review   the  Code  Project  Template  and  provide   feedback'''
+
The   first   contributors   to  the  project   are:
  
−
'''● Incorporate  feedback  into  changes  in  the  Code  Project  Template'''
+
'''-Lubyn Rodriguez(PM)'''
  
−
'''● Finalize  the  Code  Project  template  and  have  it  reviewed  to  be  promoted  from  an'''
+
'''-Hernan Pantoja(Developer)'''
  
−
'''Incubator  Project  to  a  Lab  Project'''
+
'''-Samuel Morales(Developer)'''
  
−
As  of  september  ,  2017,  the  highest  priorities  for  the  next  6  months  are:<strong>
+
'''-Manuel Heyers(Developer)'''
  
−
Release  version  of  library  1.0
+
= Road Map and Getting Involved =
  
−
'''● Promote  the   library  in  conferences'''
+
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
−
 
+
==Roadmap==
−
'''● Get   academic   support'''
+
As of '''''february'' , 2017, the highest priorities for the next 6 months''' are: 
−
 
+
* Complete the first draft of the Code Project Template
−
'''● Recruit  more  volunteers'''</strong>
+
* Get other people to review the Code Project Template and provide feedback
−
 
+
* Incorporate feedback into changes in the Code Project Template
−
Subsequent  Releases  will  add
+
* Finalize the Code Project template and have it reviewed to be promoted from an
−
 
+
As of '''august , 2017, the highest priorities for the next 6 months''' are:
−
* Internationalization Support
+
* Promote the library in conferences
−
* Additional Unit Tests
+
* Get academic support
−
* Automated Regression tests
+
* Recruit more volunteers
 +
As of '''march , 2018, the highest priorities for the next 6 months''' are:
 +
* Release version of library 1.0
 +
* Fundraise for growth the project
 +
<strong></strong>
  
 
==Getting Involved==
 
==Getting Involved==
−
Involvement  in  the  development  and  promotion  of    Code  Project  Template    is  actively encouraged.  Some  of  the  ways  you  can  help  are  as  follows:
 
  
 
===Coding===
 
===Coding===
−
We  could  implement  some  of  the  later  items  on  the  roadmap  sooner  if  someone  wanted  to  help out  with  unit  or  automated  regression  tests
+
If you have experience in programming in Node.js or Python and you want programming tools for secure applications.
−
===Localization===
 
−
Are  you   fluent  in   another  language?  Can  you   help  translate  the  text  strings  in  the    Code  Project Template    into  that  language?
 
  
−
German French Russian Portuguese
 
  
 
===Testing===
 
===Testing===
 
Do  you  have  a  flair  for  finding  bugs  in  software?  We  want  to  product  a  high  quality  product,  so any  help  with  Quality  Assurance  would  be  greatly  appreciated.  Let  us  know  if  you  can  offer  your help.
 
Do  you  have  a  flair  for  finding  bugs  in  software?  We  want  to  product  a  high  quality  product,  so any  help  with  Quality  Assurance  would  be  greatly  appreciated.  Let  us  know  if  you  can  offer  your help.
−
===Feedback===
+
 
−
Please use the [https://lists.owasp.org/mailman/listinfo/OWASP_Code_Project_Template Code Project Template project mailing list] for feedback about:
 
−
<ul>
 
−
<li>What do like?</li>
 
−
<li>What don't you like?</li>
 
−
<li>What features would you like to see prioritized on the roadmap?</li>
 
−
</ul>
 
  
 
=Minimal Viable Product=
 
=Minimal Viable Product=
−
The   functionalities   of   this   code   library   are   when   it   is   downloaded   and   implemented.
+
−
 
+
The functionalities of this code library are when it is downloaded and implemented.
−
-Detect   vulnerabilities
+
-Detect vulnerabilities
−
 
+
-Compare vulnerabilities, with an updated database online.
−
-Relate  vulnerabilities,   with   an   updated   database   online. -Ranking   the   severity   of   vulnerabilities   with  their  criticality. -Describe  solutions  for  fix   the   vulnerabilities
+
-Ranking the severity of vulnerabilities
 +
-Show how fix the vulnerabilities
 +
-Define you own security test in you own program language.
  
−
-Help  with  the  implementation  of  classes  and  functions  to  implement  secure development
+
= Media =
−
 
 
−
=Project About=
 
−
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
 
−
The  functionalities  of  this  code  library  are  when  it  is  downloaded  and  implemented.
 
−
* -Detect  vulnerabilities
 
−
* -Relate  vulnerabilities,  with  an  updated  database  online.
 
−
* -Ranking  the  severity  of  vulnerabilities  with  their  critical.
 
−
* -Describe  solutions  for  fix  the  vulnerabilities
 
−
* -Help  with  the  implementation  of  classes  and  functions  to  implement  secure development
 
−
* Teach  about  secure  coding  subject  to  developer  team
 
−
{{:Projects/OWASP_Example_Project_About_Page}}
 
  
 +
-How Implement secure applications in IT: [[File:SDLC y Owasp English.pdf|thumb]]
 +
-Secure you part of the Deal: [[File:Clouds Security and OWASP.pdf|thumb]]
  
−
__NOTOC__ <headertabs></headertabs>  
+
__NOTOC__ <headertabs>Media</headertabs>
  
 
[[Category:OWASP Project]]   
 
[[Category:OWASP Project]]   

Latest revision as of 14:22, 14 October 2019

OWASP Project Header.jpg

OWASP Code Library Project

Zezengorri is a library that allows you to add security to your development IDE from day one. From the moment you decide to implement secure development to your projects.

You can start either while designing your new projects or implement it in old projects. You can use it to detect vulnerabilities of your web server and the programming language even before starting the development parallel to the system development life circle.

Description

Whenever developers, team leaders or project managers add security to a web application, the first question that comes to mind is which technologies will be implemented in the web project, what operating system is supported by the web server and on which version the server or database runs. For these reasons, OWASP defined a threat modeling document.

This project Zezengorri is a code library is a downloadable package that adheres to the root of the web project, and from them this can, analyzes and seeks to collect in a simple web page the characteristics of all the security components for examples: if our website uses or not HSTS, the versions of Chipset active, the use of SSL certificate for the web page among other securities characteristics important measure in the during the life cycle development software . Each of these item is display in a new web page in a list of item any show if is active or not, the version of the plugin and a web link. That links redirect to the CVE page and the CVE score of this item. determine if the project can be promoted to the next category. The information requested is also intended to help Project Leaders think about the road map and feature priorities, and give guidance to the reviews as a result of that effort.

Apart from detecting and resolving security issues, the recompiled information is also useful to project leaders who can use it to create risk-models for the websites they manage.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of these

as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP and any contributions are Copyright © by OWASP Years 2017-2018.

Project Resources

Applications Security in IT deparment

Applications Security using .Net

Project Leader

Project leader's name:

-Gustavo Nieves Arreaza

Volunteers :

-Lubyn Rodriguez(PM)

-Hernan Pantoja(Developer)

-Samuel Morales(Developer)

-Manuel Heyers(Developer)

Related Projects

Owasp Secure Coding Practiques

Classifications

Project Type Files CODE.jpg
Incubator Project Owasp-builders-small.png
Owasp-defenders-small.png

News and Events

  • [1 Nov 2017] Release Page Explain the Concept, with a white Paper
  • [3 Apr 2018] The Inacap Institute and their students also start to participate in the Zezengorri owasp https://www.inacap.cl/tportalvp/alumnos.
  • [19 Aug 2018] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated.
  • Repository: [1]

How can I participate in our project?

If you have experience in web development using for example: Node.JS, C# or Java and are interested in learning about applications security please contact us via the official mail: [email protected]

If I am not a programmer can I participate in our project?

Yes, you can certainly participate in the project if you are not a programmer or technician. The project needs different skills and expertise for different times during its development ,Currently we are looking for IT persons that are willing to investigate how implement and improve the security in applications.

We are looking right now people for make our:

-QA

-Marketing

-Development (using Node.Js and Python)

Volunteers

The OWASP Security Zenzengorri Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here .

The first contributors to the project are:

-Lubyn Rodriguez(PM)

-Hernan Pantoja(Developer)

-Samuel Morales(Developer)

-Manuel Heyers(Developer)

Roadmap

As of february , 2017, the highest priorities for the next 6 months are: 

  • Complete the first draft of the Code Project Template
  • Get other people to review the Code Project Template and provide feedback
  • Incorporate feedback into changes in the Code Project Template
  • Finalize the Code Project template and have it reviewed to be promoted from an

As of august , 2017, the highest priorities for the next 6 months are:

  • Promote the library in conferences
  • Get academic support
  • Recruit more volunteers

As of march , 2018, the highest priorities for the next 6 months are:

  • Release version of library 1.0
  • Fundraise for growth the project

Getting Involved

Coding

If you have experience in programming in Node.js or Python and you want programming tools for secure applications.


Testing

Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.


The functionalities of this code library are when it is downloaded and implemented. 

-Detect vulnerabilities
-Compare vulnerabilities, with an updated database online.
-Ranking the severity of vulnerabilities
-Show how fix the vulnerabilities
-Define you own security test in you own program language.

-How Implement secure applications in IT: File:SDLC y Owasp English.pdf -Secure you part of the Deal: File:Clouds Security and OWASP.pdf

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Zezengorri_Code_Project&oldid=255438"