This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:OWASP Legal Project"
Deleted user (talk | contribs) |
|||
Line 2: | Line 2: | ||
{{ProjectTabs | | {{ProjectTabs | | ||
Proj_About= | Proj_About= | ||
− | + | <table width="100%" valign="top"><tr><th width="50%"> </th><th> </th></tr><tr valign="top"><td> | |
− | '' | + | ''OWASP Documentation Project'' |
− | + | '''Secure Software Development Contract Annex (Contract Annex)''' | |
− | ''' | + | The Secure Software Development Contract Annex developed by the OWASP Legal Project helps software developers and their clients negotiate and capture important contractual terms and conditions related to the security of the software to be developed or delivered. The goal of the Contract Annex is to ensure, at each stage of the life cycle, that appropriate attention has been paid to security. |
+ | |||
+ | For more information, please [mailto:[email protected] contact us]. | ||
+ | |||
+ | '''How the Contract Annex Works''' | ||
Here are two examples: | Here are two examples: | ||
Line 13: | Line 17: | ||
* '''Implementation.''' Developer agrees to provide and follow a set of secure coding guidelines and to use a set of common security control programming interfaces (such as the [http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API OWASP ESAPI]). Guidelines will indicate how code should be formatted, structured, and commented. Common security control programming interfaces will define how security controls must be called and how security controls shall function. All security-relevant code shall be thoroughly commented. Specific guidance on avoiding common security vulnerabilities shall be included. Also, all code shall be reviewed by at least one other Developer against the security requirements and coding guideline before it is considered ready for unit test. | * '''Implementation.''' Developer agrees to provide and follow a set of secure coding guidelines and to use a set of common security control programming interfaces (such as the [http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API OWASP ESAPI]). Guidelines will indicate how code should be formatted, structured, and commented. Common security control programming interfaces will define how security controls must be called and how security controls shall function. All security-relevant code shall be thoroughly commented. Specific guidance on avoiding common security vulnerabilities shall be included. Also, all code shall be reviewed by at least one other Developer against the security requirements and coding guideline before it is considered ready for unit test. | ||
* '''Security Analysis and Testing.''' Developer will perform application security analysis and testing (also called "verification") according to the verification requirements of an agreed-upon standard (such as the [http://www.owasp.org/index.php/ASVS OWASP ASVS]). The Developer shall document verification findings according to the reporting requirements of the standard. The Developer shall provide the verification findings to Client. | * '''Security Analysis and Testing.''' Developer will perform application security analysis and testing (also called "verification") according to the verification requirements of an agreed-upon standard (such as the [http://www.owasp.org/index.php/ASVS OWASP ASVS]). The Developer shall document verification findings according to the reporting requirements of the standard. The Developer shall provide the verification findings to Client. | ||
− | |||
− | |||
− | |||
+ | </td><td> | ||
+ | ; | ||
+ | <br>'''Latest News''' | ||
* [http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API OWASP Enterprise Security API (ESAPI)] has been integrated into the OWASP Secure Software Development Contract Annex | * [http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API OWASP Enterprise Security API (ESAPI)] has been integrated into the OWASP Secure Software Development Contract Annex | ||
* [http://www.owasp.org/index.php/ASVS OWASP Application Security Verification Standard (ASVS)] has been integrated into the OWASP Secure Software Development Contract Annex | * [http://www.owasp.org/index.php/ASVS OWASP Application Security Verification Standard (ASVS)] has been integrated into the OWASP Secure Software Development Contract Annex | ||
− | + | * Request for users/adopters/supporters. Please let us know your stories! | |
− | + | * [http://www.owasp.org/index.php/Category:OWASP_Legal_Project#tab=News Legal Project News Archives] | |
+ | * [mailto:[email protected] Legal Project Mailing List] | ||
+ | </td></tr> | ||
+ | </table> | ||
Revision as of 14:08, 6 May 2009
About
OWASP Documentation Project Secure Software Development Contract Annex (Contract Annex) The Secure Software Development Contract Annex developed by the OWASP Legal Project helps software developers and their clients negotiate and capture important contractual terms and conditions related to the security of the software to be developed or delivered. The goal of the Contract Annex is to ensure, at each stage of the life cycle, that appropriate attention has been paid to security. For more information, please contact us. How the Contract Annex Works Here are two examples:
|
|
FAQ
This project has produced a book that can be downloaded or purchased. Feel free to browse the full catalog of available OWASP books. |
You can view the content in the wiki at OWASP_Secure_Software_Contract_Annex
More About the Contract Annex
Related projects
Contract Annex
OWASP Contract Annex - Release (This is the current official release version)
Download free:
OWASP Contract Annex - Release
Wiki Version
News
Project News
- 03/20/2009 - OWASP Contract Annex updated to support the use of OWASP ESAPI.
- 01/22/2009 - OWASP Contract Annex updated to support the use of OWASP ASVS.
- 01/01/2009 - OWASP Contract Annex language integrated into the SANS Application Security Procurement Language.
- 11/30/2006 - OWASP Contract Annex Release version published.
Mailing List
Subscribe here
Use here
Contributors/Users
Project Leader
Jeff Williams
Project Contributors
Mike Boberski
The OWASP Legal project is sponsored by:
Users and Adopters
Coming soon! Please let us know how your organization is using the OWASP Contract Annex. Include your name, organization's name, and brief description of how you use the annex. The project lead can be reached at Jeff Williams Thanks for supporting OWASP!
This project licensed under the Licensed under Creative Commons Attribution ShareAlike 3.0.
Articles Below - More About the Contract Annex and Using It
Pages in category "OWASP Legal Project"
The following 15 pages are in this category, out of 15 total.