This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Cloud Security Project"
Fraserscott (talk | contribs) m (→How can I participate in your project?) (Tag: Visual edit) |
Fraserscott (talk | contribs) (fixing url) |
||
| Line 138: | Line 138: | ||
* Threats models and BDD stories based on published standards (e.g. PCI/DSS) and best-practices (e.g. whitepapers) | * Threats models and BDD stories based on published standards (e.g. PCI/DSS) and best-practices (e.g. whitepapers) | ||
| − | To get involved, see the [https://github.com/owasp-cloud-security/owasp-cloud-security | + | To get involved, see the [https://github.com/owasp-cloud-security/owasp-cloud-security Github repository]. |
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --> | <!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE --> | ||
Revision as of 20:32, 1 November 2017
The OWASP Cloud Security ProjectThe rise of DevOps and cloud computing has given organisations unprecedented access to feature-rich and high-scalable elastic platforms that allow them to deliver products and services with a velocity and agility that has never been seen before. But with new capabilities come new attack vectors. The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat model templates and security control BDD stories that pool together the expertise and experience of the development, operations and security communities. Why threat modelling?Threat modelling addresses security issues at a fundamental, architectural level. Rather than trying to bolt on controls haphazardly, threat modelling results in more robust and secure systems by baking security into the design as well as identifying the gaps and weaknesses. Using templates allows the sharing of common threats in a way that can be tweaked and tuned by individual organisations. Improvements to the threat models can then be fed back to the community for the benefit of everyone. Why BDD?Behaviour Driven Development (BDD) adds a natural language layer on top of test-driven development by defining requirements in a machine parsable language that is also human readable. While adoption of BDD within development communities has been mixed (often because the developers end up having to duplicate effort as both producers and consumers of the BDD stories), BDD is actually an excellent fit for representing security control requirements in a way that is also continuously testable. Rather than burying a control requirement in a policy document that nobody reads, it can be represented in a way that an auditor would be happy with at the same time as being implemented as automated detective or preventative tests. By bringing together threat model templates and BDD stories for mitigating controls, provided by the community, the OWASP Cloud Security project helps organisations understand the risks they face on their journey into the cloud. DescriptionThe OWASP Cloud Security project started life as a BDD for Cloud Security session held at the awesome OWASP Summit 2017. In this session approximately ten people spent an hour discussing whether it made sense to use BDD a way of capturing cloud control requirements in a way that fostered collaboration between development, operations, and security. The question then became - where do the requirements come from? PCI/DSS or some other standard? After spending the rest of the summit in various threat modelling sessions, it became clear to the project leader that it would be good to threat model the cloud services and then to write BDD stories for the mitigating controls from those threat models. This project provides the following for an ever-expanding list of cloud providers and services:
LicensingThe OWASP Cloud Security project resources are all completely free to use! Documentation and related resources are licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. Code is licensed under the MIT license. |
What is OWASP Cloud Security Project?The OWASP Cloud Security project aims to help people secure their products and services running in the cloud by providing a set of easy to use threat model templates and security control BDD stories that pool together the expertise and experience of the development, operations, and security communities. PresentationProject LeaderRelated Projects
Openhub |
Source code and documentationThe home of the OWASP Cloud Security project is on is on GitHub. You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github. Please note that the project is still in its own organisation. This will be moved over to the OWASP organisation soon. News and EventsComing soon! In PrintThis project is not currently available to purchase as a book. Classifications
| |||||||
