This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "How to create verification project schedules"
From OWASP
Deleted user (talk | contribs) |
Deleted user (talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | == | + | == Overview == |
| − | |||
| − | + | If you are performing an application security verification, you can use [http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project OWASP Application Security Verification Standard (ASVS)] to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress. | |
| − | |||
| + | == Define Verification Tasks == | ||
| − | + | The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level. | |
| + | *Example level 1 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, finalize report. | ||
| + | *Example level 2 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, finalize report. | ||
| + | *Example level 3 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, finalize report. | ||
| + | *Example level 4 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, perform search for malicious code, finalize report. | ||
| − | |||
| − | + | Milestones would then correspond to the completion of a given verification task, and a final milestone would correspond to the completion of all verification tasks. | |
| − | |||
| − | |||
| − | |||
| − | |||
The increase in level of effort to perform OWASP ASVS verifications at different levels for a given application is intended to be relatively linear. | The increase in level of effort to perform OWASP ASVS verifications at different levels for a given application is intended to be relatively linear. | ||
| + | *Example level 1 overall duration: 1 - 2 weeks | ||
| + | *Example level 2 overall duration: 2 - 3 weeks | ||
| + | *Example level 3 overall duration: 3 - 4 weeks | ||
| + | *Example level 4 overall duration: 4+ weeks | ||
| − | + | The above estimates do not include time to perform remediation. The size and the complexity of the application(s) should always be taken into account. | |
| − | |||
| − | + | == Identify Verification Team Resources == | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
The next step to perform a verification is to identify resources that will be necessary, including both people and materials. | The next step to perform a verification is to identify resources that will be necessary, including both people and materials. | ||
| + | *Example people resources: project manager, team lead, verifier. | ||
| + | *Example material resources: dynamic scan tools, source code scan tools. | ||
| − | + | The availability and cost for both people (e.g. rate) and resources (e.g. license fees) should then be taken into account. | |
| − | |||
| − | |||
| − | |||
| − | |||
| + | == Assign Verification Team Resources to Verifications == | ||
| − | |||
The next step to perform a verification is to assign people and materials to individual tasks. | The next step to perform a verification is to assign people and materials to individual tasks. | ||
| + | *Example level 1 assignment: assign collect information to team lead | ||
| + | *Example level 1 assignment: assign perform initial design review to team lead and verifier. | ||
| + | *Example level 1 assignment: assign create report to team lead. | ||
| + | *Example level 1 assignment: assign perform scan to verifier. | ||
| + | *Example level 1 assignment: assign review scan results to verifier. | ||
| + | *Example level 1 assignment: assign finalize report to team lead and verifier. | ||
| − | + | The project manager may not in practice be assigned to a specific task, unless the project schedule is detailed enough to include tasks such as project status reviews. | |
| − | |||
| − | + | == Track Verification Progress == | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
The last step to perform a verification is to track verification progress. OWASP ASVS verification requirements and reporting requirements can be used towards this end. | The last step to perform a verification is to track verification progress. OWASP ASVS verification requirements and reporting requirements can be used towards this end. | ||
| + | *Example computation to determine a verification task’s percent complete: for each set of applicable verification requirements for each application, divide the number completed by the total number. | ||
| + | *Example computation to determine a reporting task’s percent complete: for each set of reporting requirements for each application, divide the number completed by the total number. | ||
| − | + | == Helpful hints == | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs. | + | *The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs. |
| − | |||
[[Category:OWASP Application Security Verification Standard Project]] | [[Category:OWASP Application Security Verification Standard Project]] | ||
[[Category:How To]] | [[Category:How To]] | ||
Revision as of 01:46, 30 December 2008
Overview
If you are performing an application security verification, you can use OWASP Application Security Verification Standard (ASVS) to help create a project schedule. The ASVS verification and reporting requirements can be translated into project tasks and milestones, provide insight as to what resources will be required to perform a given verification, and provide a basis for measuring progress.
Define Verification Tasks
The first step to perform a verification is to define verification tasks. Verification tasks will be different, depending on the targeted OWASP ASVS verification level.
- Example level 1 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, finalize report.
- Example level 2 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, finalize report.
- Example level 3 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, finalize report.
- Example level 4 tasks: Collect information, perform initial design review, create report, perform scan, review scan results, create manual tests, perform manual tests, review manual test results, perform detailed design review, review detailed design review results, perform search for malicious code, finalize report.
Milestones would then correspond to the completion of a given verification task, and a final milestone would correspond to the completion of all verification tasks.
The increase in level of effort to perform OWASP ASVS verifications at different levels for a given application is intended to be relatively linear.
- Example level 1 overall duration: 1 - 2 weeks
- Example level 2 overall duration: 2 - 3 weeks
- Example level 3 overall duration: 3 - 4 weeks
- Example level 4 overall duration: 4+ weeks
The above estimates do not include time to perform remediation. The size and the complexity of the application(s) should always be taken into account.
Identify Verification Team Resources
The next step to perform a verification is to identify resources that will be necessary, including both people and materials.
- Example people resources: project manager, team lead, verifier.
- Example material resources: dynamic scan tools, source code scan tools.
The availability and cost for both people (e.g. rate) and resources (e.g. license fees) should then be taken into account.
Assign Verification Team Resources to Verifications
The next step to perform a verification is to assign people and materials to individual tasks.
- Example level 1 assignment: assign collect information to team lead
- Example level 1 assignment: assign perform initial design review to team lead and verifier.
- Example level 1 assignment: assign create report to team lead.
- Example level 1 assignment: assign perform scan to verifier.
- Example level 1 assignment: assign review scan results to verifier.
- Example level 1 assignment: assign finalize report to team lead and verifier.
The project manager may not in practice be assigned to a specific task, unless the project schedule is detailed enough to include tasks such as project status reviews.
Track Verification Progress
The last step to perform a verification is to track verification progress. OWASP ASVS verification requirements and reporting requirements can be used towards this end.
- Example computation to determine a verification task’s percent complete: for each set of applicable verification requirements for each application, divide the number completed by the total number.
- Example computation to determine a reporting task’s percent complete: for each set of reporting requirements for each application, divide the number completed by the total number.
Helpful hints
- The amount of overhead that dedicated project management introduces can be significant. Project management activities should be tailored for a given verification to minimize costs.
