Category:OWASP Application Security Assessment Standards Project

Main

The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed and what level of assessment is appropriate based on business requirement.

Project Roadmap

• Define the Application Security Assessment procedure into a Vulnerability Management procedure. Every step of the Application Security Assessment process should make some outputs related to Vulnerabilities/Risk related to the application.
• Define how to prioritize WebApp Vulnerabilities working with CWE mapping and scoring systems as CWSS (referring to OWASP TOP 10)
• Define a process of App Security Assessment that is Threat/Vulnerability Centric and that contains at least the following milestones:
  • Use OWASP ASVS in order to define the AS-IS of the application validation process using the following techniques:
    • Maturity Model (referring to OWASP SAMM Project)
    • Attack Surface of the Application (referring to OWASP Code Review Project)
    • Threat Modeling of the Application (referring to OWASP Code Review Project)
    • WAPT/Code Review/VA (referring to OWASP Testing/Code Review Projects)
  • Use OWASP ASVS in order to define the TO-BE of the application validation process.
  • For each level definable as TO-BE of the application validation process define how to implement
    • Processes:
      • SSDLC (Referring to OWASP Development Guide)
      • Code Review (referring to OWASP Code Review Project and OWASP SAMM)
      • WAPT (referring to OWASP Testing Guide and OWASP SAMM)
    • Technical Projects:
      • OWASP ESAPI
      • OWASP AppSensor
  • Practical Examples
    • Demo on how to implement ESAPI/AppSensor in a production project
    • Tips on how to implement an Application Security Assessment Process into a production environment

>>>>A diagram which describes at high level the idea of the Application Security Process from initial assessment to final mitigation and review.

Project Contributors

The Application Security Assessment Standards project leader is Matteo Michelini of Lutech SpA.

Project About

OLD_PAGE

Currently there is a lack of standardization over what constitutes an application security assessment. With no single set of criteria being referenced, it is suggested that OWASP establish a set of standards defining and establishing a baseline approach to conducting differing types/levels of application security assessment. The standards should be flexible in design to accommodate a range of security assurance levels. The standards should not be viewed as placing requirements on any party. Rather, the standards should make recommendations about what should be done to be consistent with what the OWASP community believes is best practice. Adhering to the standards should help increase end user organization confidence that assessments meet an industry agreed-upon approach.

Objective

The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements. The following are seen as key tasks in order to meet this objective:

• Where practical, attempt to “standardize” nomenclature and definitions for common business application types.

• Where practical, attempt to “standardize” nomenclature and definitions of the differing security assessment types.

• Define standard application assessment process in SWIM flow chart.

• Define standard assessment scope per application type.

• Define standard testing boundaries for application assessments.

• Define what is needed on business end to prepare for application assessment.

• Establish where in SDLC should assessment steps be defined/conducted.

• Where practical, attempt to “standardize” skills nomenclature and establish baseline assessor qualifications and evaluation criteria.

• Establish a common set of application assessment levels:

• • Define degree of assessment depth per level
  • Define testing components required per level
  • Establish level of tool usage/type vs. hands on assessment per level
  • Establish linkages between level results and security metrics derived
  • Establish linkages between levels and Security Maturity Models

• Establish guidance parameters to allow organizations to determine appropriate assessment level based on business application to be assessed.

• Document integration/linkages to other OWASP projects.

This project will not define how to technically to conduct an assessment (refer to OWASP Testing Project); it is instead meant to tie business operations and information management practices to application security in order to establish a common, consistent set of standards which provide guidance in conducting such assessments.

Current Project Status:

OWASP Organization Backing

• Minimal feedback - Need Leadership Backing.

Phase I – Project Approach:

• Minimal feedback obtained. Contributors jumped in.

Phase II - Definitions:

• Define Common Business Application Types – Need Input.
• Define Security Assessment Types – Need Input.

Phase III – Assessment Context:

• Define Standard Application Assessment Process – Stub Started - Need Input.
• Define Standard Assessment Scope Per Application Type – Need Stub
• Define Standard Testing Boundaries For Application Assessments – Need Stub
• Define Business End Preparation For Application Assessment – Need Stub
• Establish Where In SDLC Should Assessment Steps Be Defined/Conducted – Need Stub
• Establish Baseline Assessor Qualifications And Evaluation Criteria – Stub Started - Need Input.

Phase IV – Assessment Levels:

[ Suggest Establishment of Definitions and Context prior to commencement ]

• Establish assessment level system common terminology and decision criteria - Included is analysis of potentially corresponding security measurements (i.e. common security metrics, security assurance/maturity models, related legislation, other standards, etc.).
• Create assessment levels based on previous Phase II and III objectives. Define assessment depth, testing components required, and level of tool usage/type (not product names) of tools used per level.
• Document corresponding linkages between assessment levels and common security metrics, security assurance/maturity models, related legislation, other documented national standards defined as component of first Phase III objective.
• Establish guidance parameters to allow organizations to determine appropriate assessment level based on business application to be assessed.

Also refer to project Roadmap.

Feedback and Participation

We hope you find the OWASP Application Security Assessment Standards Project useful. Please contribute back to the project by sending your comments, questions, and suggestions to [email protected]. To join the OWASP Assessment Standards mailing list or view the archives, please visit the subscription page.

Project Contributers

The Assessment Standards project lead is Cliff Barlow of KoreLogic Security. He can be reached at [email protected].

Key contributors:

• Bob Austin, KoreLogic Security

• Jeff Williams, Aspect Security

• Vinay Bansal, Cisco Systems

• Imre Kertesz, KoreLogic Security