Top 10 2007-References

««««

Main ()

FIXUP: {{{1}}}: {{{2}}}

OWASP Projects

OWASP is the premier site for web application security. The OWASP site hosts many projects, forums, blogs, presentations, tools, and papers. OWASP hosts two major web application security conferences per year, and has over 80 local chapters.

The following OWASP projects are most likely to be useful:

• OWASP Guide to Building Secure Web Applications
• OWASP Testing Guide
• OWASP Code Review Project (in development)
• OWASP PHP Project (in development)
• OWASP Java Project
• OWASP .NET Project

Books

• [GAL1] Gallagher T., Landauer L., Jeffries B., "Hunting Security Bugs", Microsoft Press, ISBN 073562187X
• [HOW1] Howard M., Lipner S., "The Security Development Lifecycle", Microsoft Press, ISBN 0735622140
• [HOW2] Howard M., Le Blanc D., "Writing Secure Code", 2nd ed., Microsoft Press, ISBN 0735617228
• [SCH1] Schneier B., "Practical Cryptography", Wiley, ISBN 047122894X
• [WYS1] Wysopal et al, The Art of Software Security Testing: Identifying Software Security Flaws, ISBN 0321304861

Web Sites

• OWASP, http://www.owasp.org
• MITRE, Common Weakness Enumeration – Vulnerability Trends, http://cwe.mitre.org/documents/vuln-trends.html
• SANS Top 20, http://www.sans.org/top20/
• PCI Security Standards Council, publishers of the PCI standards, relevant to all organizations processing or holding credit card data, https://www.pcisecuritystandards.org/
• PCI DSS v1.1, https://www.pcisecuritystandards.org/pdfs/pci_dss_v1-1.pdf
• Build Security In, US CERT, https://buildsecurityin.us-cert.gov/daisy/bsi/home.html

««««

Main ()