CISO AppSec Guide: Quick Reference to OWASP Guides & Projects

< Back to the Application Security Guide For CISOs

Appendix B: Quick Reference to OWASP Guides & Projects

This quick reference maps typical CISO's functions and information security domains to different sections of the OWASP' CISO Guide and relevant OWASP projects.

To do:

• Check cross-references back to other parts of guie and add links/anchors
• Check for other OWASP projects

CISO Function	Security Domain	OWASP CISO Guide	OWASP Projects
Develop and implement policies, standards and guidelines for application security	Standards and Policies	Part I - Section 1.3 "Information Security Standards, Policies and Compliance"	OWASP Development Guide - Policy Frameworks CLASP - Identify Global Security Policy SAMM - Policy & Compliance Code Review - Code Reviews and Compliance
Develop, implement and manage application security governance	Governance	Part III - Section 1.3.1 "Application Security Governance, Risk and Compliance"	SAMM - Governance How to Write Job Requisitions
Develop and implement software security development and security testing processes	Security Engineering Processes	Part III - Section 1.4 "Targeting Software Security Activities and S-SDLC Processes" Part III - Section 1.5 "How to Choose the Right OWASP Projects and Tools For Your Organization"	Development Guide Code Review Guide Secure Coding Practices Testing Guide Comprehensive Lightweight Application Security Process (CLASP) Introduction CLASP Concepts Software Assurance Maturity Model(SAMM) Testing Tools Application Security Verification Standard Project
Develop, articulate and implement a risk management strategy for applications	Risk Strategy	Part I - Section 1.4.4 "Risk Management Strategies" Part II - "Criteria for Managing Application Security Risks"	SAMM - Strategy & Metrics Application Threat Modeling - Risk Mitigation Strategies
Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited	Audit & Compliance	Part I - Section 1.3.2 "Capturing Application Security Requirements" Part III - Section 1.3 "Addressing CISO's Application Security Functions"	Application Security Verification Standards Capture Security Requirements SAMM - Security Requirements Testing Guide - Security Requirements Test Derivation OWASP Cornucopia Legal - Secure Software Contract Annex
Measure and monitor security and risks of application assets within the organization	Risk Metrics & Monitoring	Part IV - "Selection of Metrics for Managing Risks & Application Security Investments"	Types of Application Security Metrics CLASP - Define and Monitor Metrics SAMM Strategy & Metrics
Define, identify and assess the inherent security of critical application assets, assess the threats, vulnerabilities, business impacts and recommend countermeasurers/corrective actions	Risk Analysis & Management	Part I - Section 1.4 "Risk Management" Part II Criteria for Managing Application Security Risks	Top Ten Web Application Risks Top Ten Mobile Application Risks Top Ten Cloud Risks Implementation of NIST Risk Management Verification Activities Risk Rating Methodology Threat Risk Modelling Application Threat Modelling
Assess procurement of new application processes, services, technologies and security tools	Procurement	[Part III - Section 1.4.2.1 "Assess Risks before Procurement of Third Party Components"	Secure Software Contract Annex Verification of Contract Requirements
Oversee the training on application security for development, operational and information security teams	Security Training	Part III- Section 1.5.3 "People, Processes and Technology"	[1] Education Projects Appsec Training Videos Conference Videos Application Security FAQs CLASP - Institute Security Awareness Program
Develop, articulate and implement continuity planning/disaster recovery	Business Continuity / Disaster Recovery	Part IV - Addressing CISO's Application Security Functions"	Cloud Business Continuity and Resiliency
Investigate and analyse suspected and actual application security incidents and recommend corrective actions	Incident Response	Part I Section 1.4.6 "Addressing the Business Concerns after a Security Incident"	.NET Incident Response CLASP - Manage Security Issue Disclosure Process