Category:OWASP Application Security Assessment Standards Project

Currently there is a lack of standardization over what constitutes an application security assessment. With no single set of criteria being referenced, it is suggested that OWASP establish a set of standards defining and establishing a baseline approach to conducting differing types/levels of application security assessment. The standards should be flexible in design to accommodate a range of security assurance levels. The standards should not be viewed as placing requirements on any party. Rather, the standards should make recommendations about what should be done to be consistent with what the OWASP community believes is best practice. Adhering to the standards should help increase end user organization confidence that assessments meet an industry agreed-upon approach.

Objective

The Project’s primary objective is to establish common, consistent methods for application security assessments standards that organizations can use as guidance on what tasks should be completed, how the tasks should be completed, who should be involved and what level of assessment is appropriate based on business requirements. The following are seen as key tasks in order to meet this objective:

• Where practical, attempt to “standardize” nomenclature and definitions for common business application types.

• Where practical, attempt to “standardize” nomenclature and definitions of the differing security assessment types.

• Define standard application assessment process in SWIM flow chart.

• Define standard assessment scope per application type.

• Define standard testing boundaries for application assessments.

• Define what is needed on business end to prepare for application assessment.

• Establish where in SDLC should assessment steps be defined/conducted.

• Where practical, attempt to “standardize” skills nomenclature and establish baseline assessor qualifications and evaluation criteria.

• Establish a common set of application assessment levels:

• • Define degree of assessment depth per level
  • Define testing components required per level
  • Establish level of tool usage/type vs. hands on assessment per level
  • Establish linkages between level results and security metrics derived
  • Establish linkages between levels and Security Maturity Models

• Establish guidance parameters to allow organizations to determine appropriate assessment level based on business application to be assessed.

• Document integration/linkages to other OWASP projects.

This project will not define how to technically to conduct an assessment (refer to OWASP Testing Project); it is instead meant to tie business operations and information management practices to application security in order to establish a common, consistent set of standards which provide guidance in conducting such assessments.

Feedback and Participation

We hope you find the OWASP Application Security Assessment Standards Project useful. Please contribute back to the project by sending your comments, questions, and suggestions to [email protected]. To join the OWASP Assessment Standards mailing list or view the archives, please visit the subscription page.

Project Contributers

The Assessment Standards project lead is Cliff Barlow of KoreLogic Security. He can be reached at [email protected].

Key contributors:

• Bob Austin, KoreLogic Security

• Jeff Williams, Aspect Security