Difference between revisions of "Category:OWASP Application Security Assessment Standards Project"

Revision as of 17:43, 19 September 2006

Currently there is a lack of standardization over what constitutes an application security assessment. With no single set of criteria being referenced, it is suggested that OWASP establish a set of standards defining and establishing a baseline approach to conducting differing types/levels of application security assessment. The standards should be flexible in design to accommodate a range of security assurance levels. The standards should not be viewed as placing requirements on any party. Rather, the standards should make recommendations about what should be done to be consistent with what the OWASP community believes is best practice. Adhering to the standards should help increase end user organization confidence that assessments meet an industry agreed-upon approach.

Objective

The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements. The following are seen as key tasks in order to meet this objective:

• Where practical, attempt to “standardize” nomenclature and definitions for common business application types.

• Where practical, attempt to “standardize” nomenclature and definitions of the differing security assessment types.

• Define standard application assessment process in SWIM flow chart.

• Define standard assessment scope per application type.

• Define standard testing boundaries for application assessments.

• Define what is needed on business end to prepare for application assessment.

• Establish where in SDLC should assessment steps be defined/conducted.

• Where practical, attempt to “standardize” skills nomenclature and establish baseline assessor qualifications and evaluation criteria.

• Establish a common set of application assessment levels:

• • Define degree of assessment depth per level
  • Define testing components required per level
  • Establish level of tool usage/type vs. hands on assessment per level
  • Establish linkages between level results and security metrics derived
  • Establish linkages between levels and Security Maturity Models

• Establish guidance parameters to allow organizations to determine appropriate assessment level based on business application to be assessed.

• Document integration/linkages to other OWASP projects.

This project will not define how to technically to conduct an assessment (refer to OWASP Testing Project); it is instead meant to tie business operations and information management practices to application security in order to establish a common, consistent set of standards which provide guidance in conducting such assessments.

Current Project Status:

Phase I – Project Approach:

• Minimal feedback obtained. Contributors jumped in.

Phase II - Definitions:

• Define Common Business Application Types – Stub Started - Need Input.
• Define Security Assessment Types – Stub Started - Need Input.

Phase III – Assessment Context:

• Define Standard Application Assessment Process – Need Stub
• Define Standard Assessment Scope Per Application Type – Need Stub
• Define Standard Testing Boundaries For Application Assessments – Need Stub
• Define Business End Preparation For Application Assessment – Need Stub
• Establish Where In SDLC Should Assessment Steps Be Defined/Conducted – Need Stub
• Establish Baseline Assessor Qualifications And Evaluation Criteria – Stub Started - Need Input.

Phase IV – Assessment Levels:

[ Suggest Establishment of Definitions and Context prior to commencement ]

• Establish assessment level system common terminology and decision criteria - Included is analysis of potentially corresponding security measurements (i.e. common security metrics, security assurance/maturity models, related legislation, other standards, etc.).
• Create assessment levels based on previous Phase II and III objectives. Define assessment depth, testing components required, and level of tool usage/type (not product names) of tools used per level.
• Document corresponding linkages between assessment levels and common security metrics, security assurance/maturity models, related legislation, other documented national standards defined as component of first Phase III objective.
• Establish guidance parameters to allow organizations to determine appropriate assessment level based on business application to be assessed.

Also refer to project Roadmap.

Feedback and Participation

We hope you find the OWASP Application Security Assessment Standards Project useful. Please contribute back to the project by sending your comments, questions, and suggestions to [email protected]. To join the OWASP Assessment Standards mailing list or view the archives, please visit the subscription page.

Project Contributers

The Assessment Standards project lead is Cliff Barlow of KoreLogic Security. He can be reached at [email protected].

Key contributors:

• Bob Austin, KoreLogic Security

• Jeff Williams, Aspect Security

• Vinay Bansal, Cisco Systems

• Imre Kertesz, KoreLogic Security

Project Sponsors

The OWASP Application Security Assessment Standards Project is sponsored by: [1]