|
|
| Line 5: |
Line 5: |
| | [[Category:OWASP Download]] | | [[Category:OWASP Download]] |
| | [[Category:OWASP Beta Quality Document]] | | [[Category:OWASP Beta Quality Document]] |
| | + | |
| | | | |
| | == Welcome to the OWASP Education Project== | | == Welcome to the OWASP Education Project== |
| Line 12: |
Line 13: |
| | The first list of modules can be found [[OWASP Education Project Modules|here]]. | | The first list of modules can be found [[OWASP Education Project Modules|here]]. |
| | | | |
| − | == Education Material Categorized == | + | ==== Educational Material ==== |
| | | | |
| − | The education materialis categorized in two manors, by the CLASP roles and a more global way of general concern.
| + | === Categorized educational material === |
| − | ==== Profession / Interest ==== | + | The categorized educational material can be found [[OWASP Education Material Categorized|here]]. |
| − | Below you find the education material categorized by profession and interest.
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Common'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Management'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Student'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Developer'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Tester'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| | | | |
| | + | === Resources and links === |
| | | | |
| − | ==== OWASP Top Ten ====
| + | This project is not standalone. There is an awfull lot of information that can be found throughout this site and from other resources on the Internet. <br> |
| − | The [[:Category:OWASP_Top_Ten_Project |'''OWASP Top Ten''']] represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list. There are currently versions in English, French, Japanese, Korean and Turkish. A Spanish version is in the works. We urge all companies to adopt this awareness document within their organization and start the process of ensuring that their web applications do not contain these flaws. Adopting the OWASP Top Ten is perhaps the most effective first step towards changing the software development culture within your organization into one that produces secure code.
| + | This project will draw pieces of information from: |
| − | {| style="width:100%" border="0" align="center"
| + | * The [http://www.owasp.org/index.php/Category:OWASP_Video Video's] |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| + | * The presentations, currently being inventorized in the [[OWASP Education Presentation|consolidation page of OWASP presentations]]¨ |
| − | '''[[Top_10_2007-A1|A1 - Cross Site Scripting (XSS)]]'''
| + | * [http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project WebGoat] |
| − | |-
| + | * ... |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| + | One of the modules to create will be a Resources module, not limited to OWASP. |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A2|A2 - Injection Flaws]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A3|A3 - Malicious File Execution]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A4|A4 - Insecure Direct Object Reference]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A5|A5 - Cross Site Request Forgery (CSRF)]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A6|A6 - Information Leakage and Improper Error Handling]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A7|A7 - Broken Authentication and Session Management]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A8|A8 - Insecure Cryptographic Storage]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A9|A9 - Insecure Communications]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[Top_10_2007-A10|A10 - Failure to Restrict URL Access]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Presentation'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | | |
| − | <br>
| |
| − | | |
| − | ==== OWASP Tooling ====
| |
| − | An [[:Category:OWASP_Project |'''OWASP Project''']] is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team. Tools and documents are organized into the following categories:
| |
| − | PROTECT - These are tools and documents that can be used to guard against security-related design and implementation flaws.
| |
| − | DETECT - These are tools and documents that can be used to find security-related design and implementation flaws.
| |
| − | LIFE CYCLE - These are tools and documents that can be used to add security-related activities into the Software Development Life Cycle (SDLC).
| |
| − | | |
| − | <hr><br>''' Protect:'''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_AntiSamy_Project|OWASP AntiSamy Java Project]] '''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Video's '''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training video
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF; color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Enterprise_Security_API|OWASP Enterprise Security API (ESAPI) Project]] '''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material | |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | | |
| − | <br>''' Detect:'''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Live_CD_Project|OWASP Live CD Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_WebScarab_Project|OWASP WebScarab Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | | |
| − | <br>''' Life Cycle:'''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_WebGoat_Project|OWASP WebGoat Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | <br>
| |
| − | ==== OWASP Documentation ====
| |
| − | An [[:Category:OWASP_Project |'''OWASP Project''']] is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team. Tools and documents are organized into the following categories:
| |
| − | PROTECT - These are tools and documents that can be used to guard against security-related design and implementation flaws.
| |
| − | DETECT - These are tools and documents that can be used to find security-related design and implementation flaws.
| |
| − | LIFE CYCLE - These are tools and documents that can be used to add security-related activities into the Software Development Life Cycle (SDLC).
| |
| − | | |
| − | <hr><br> '''Protect: '''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Guide_Project|OWASP Development Guide]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Ruby_on_Rails_Security_Guide_V2|OWASP Ruby on Rails Security Guide V2]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material | |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | | |
| − | | |
| − | <br>''' Detect:'''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Code_Review_Project|OWASP Code Review Guide]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Testing_Project|OWASP Testing Guide]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Top_Ten_Project|OOWASP Top Ten Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | | |
| − | <br>''' Life Cycle:'''
| |
| − | | |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_AppSec_FAQ_Project|OWASP AppSec FAQ Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Legal_Project|OWASP Legal Project]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">
| |
| − | '''[[:Category:OWASP_Source_Code_Review_OWASP_Projects_Project|OWASP Source Code Review for OWASP-Projects]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | <br>
| |
| − | | |
| − | ==== CLASP roles ====
| |
| − | [http://www.owasp.org/index.php/Category:OWASP_CLASP_Project '''CLASP'''] (Comprehensive, Lightweight Application Security Process) provides a well-organized and structured approach for moving security concerns into the early stages of the software development lifecycle, whenever possible. | |
| | | | |
| − | {| style="width:100%" border="0" align="center"
| + | === Donated Material === |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Architect]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Designer]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Implementer]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Project Manager]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Requirements Specifier]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Security Auditor]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="white">'''[[Test Analyst]]'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Beginner'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Experienced'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Expert'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| | | | |
| − | ==== SAMM Disciplines & Functions ====
| + | The following training material and presentations were donated to the education project and will be integrated in future Education Tracks. |
| − | {| style="width:100%" border="0" align="center"
| + | * [[Education Donated: OWASP Safe Browsing]] |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Alignment & Governance'''
| + | * [[Education Donated: OWASP ASVS 1.0 ~2 day training deck]] |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Education & Guidance'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Standards & Compliance'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material | |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Strategic Planning'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material | |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Requirements & Design'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Threat Modeling'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Security Requirements'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Defensive Design'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Verification & Assessment'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Architectuur Review'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Code Review'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Security Testing'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| − | {| style="width:100%" border="0" align="center"
| |
| − | ! colspan="4" align="center" style="background:#FFFFFF color:white"|<font color="003399">'''Deployment & Operations'''
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Vulnerability Mangement'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Infrastrucxture Hardening'''
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |-
| |
| − | | style="width:25%; background:#7B8ABD" align="left"| '''Operational Enablement'''
| |
| − | * beginner
| |
| − | * mediate
| |
| − | * expert
| |
| − | | colspan="3" style="width:75%; background:#cccccc" align="left"|
| |
| − | * training material
| |
| − | |}
| |
| | | | |
| − | | + | ==== About the Project ==== |
| − | == Goals & Roadmap == | + | === Goals & Roadmap === |
| | | | |
| | Currently the project goals are to create Educational Tracks: | | Currently the project goals are to create Educational Tracks: |
| Line 648: |
Line 45: |
| | * ... | | * ... |
| | Further breakdown of tasks and future developments are listed in the [[OWASP Education Project Roadmap|road map]].<br> | | Further breakdown of tasks and future developments are listed in the [[OWASP Education Project Roadmap|road map]].<br> |
| | + | <br> |
| | | | |
| − | == Spoc007 Progress == | + | |
| | + | === Spoc007 Progress === |
| | The Education project was selected for [http://www.owasp.org/index.php/SpoC_007_-_OWASP_Education_Project Spoc007 participation] (see page for progress). | | The Education project was selected for [http://www.owasp.org/index.php/SpoC_007_-_OWASP_Education_Project Spoc007 participation] (see page for progress). |
| | | | |
| | The SpoC007 goal is to finish Sub Goals 1, 2, 3 and perform Sub Goal 4 during the coming months ([[OWASP Education Project Roadmap|road map]]). | | The SpoC007 goal is to finish Sub Goals 1, 2, 3 and perform Sub Goal 4 during the coming months ([[OWASP Education Project Roadmap|road map]]). |
| | | | |
| − | == Project Guiding Principles == | + | ==== Participation ==== |
| | + | === Project Guiding Principles === |
| | | | |
| | This project aims to provide in building blocks of web application security knowledge that can easily be integrated in awareness sessions or presentations on this topic. The building blocks provided by this project can then be bundled together in eduction tracks.<br> | | This project aims to provide in building blocks of web application security knowledge that can easily be integrated in awareness sessions or presentations on this topic. The building blocks provided by this project can then be bundled together in eduction tracks.<br> |
| | An important guideline is therefore that the material produced is modular.<br> | | An important guideline is therefore that the material produced is modular.<br> |
| | | | |
| − | == Resources and links ==
| |
| − |
| |
| − | This project is not standalone. There is an awfull lot of information that can be found throughout this site and from other resources on the Internet. <br>
| |
| − | This project will draw pieces of information from:
| |
| − | * The [http://www.owasp.org/index.php/Category:OWASP_Video Video's]
| |
| − | * The presentations, currently being inventorized in the [[OWASP Education Presentation Rating|consolidation page of OWASP presentations]]¨
| |
| − | * [http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project WebGoat]
| |
| − | * ...
| |
| − | One of the modules to create will be a Resources module, not limited to OWASP.
| |
| | | | |
| − | == Feedback and Participation: == | + | === Feedback and Participation: === |
| | | | |
| | We hope you find the OWASP Education Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to the [http://lists.owasp.org/mailman/listinfo/owasp-education mailing list]. | | We hope you find the OWASP Education Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to the [http://lists.owasp.org/mailman/listinfo/owasp-education mailing list]. |
| Line 675: |
Line 66: |
| | If you used material from our project, please use the available [[:Image:Education_Track_Evaluation_Template.doc|evaluation forms]] and let uw know how we can improve our modules and tracks. | | If you used material from our project, please use the available [[:Image:Education_Track_Evaluation_Template.doc|evaluation forms]] and let uw know how we can improve our modules and tracks. |
| | | | |
| − | == Project Contributors == | + | === Project Contributors === |
| | | | |
| | If you contribute to this Project, please add your name here.<br> | | If you contribute to this Project, please add your name here.<br> |
| | Project Lead: | | Project Lead: |
| − | * [[User:Sdeleersnyder|Sebastien Deleersnyder]] | + | * [[User:knoblochmartin| Martin Knobloch]] |
| | | | |
| | Contributors: | | Contributors: |
| | | | |
| | + | * [[User:Sdeleersnyder|Sebastien Deleersnyder]] |
| | * [[User:medelibero|Mike de Libero]] | | * [[User:medelibero|Mike de Libero]] |
| | * [[User:Bunyamin|Bunyamin Demir]] | | * [[User:Bunyamin|Bunyamin Demir]] |
| | * [[User:xxradar|Philippe Bogaerts]] | | * [[User:xxradar|Philippe Bogaerts]] |
| | * [[User:Brennan|Tom Brennan]] | | * [[User:Brennan|Tom Brennan]] |
| − | * [[User:knoblochmartin| Martin Knobloch]]
| |
| | * [[User:Mccorga| Grady McCorkle]] | | * [[User:Mccorga| Grady McCorkle]] |
| | * you? ... | | * you? ... |
Web Application Security Education and Awareness is needed throughout the entire organization, each area and level of organizations have specific needs and requirements regarding education. A manager needs other information than a security professional or developer. Novices to the profession require other training than people with several years of experience.
This Education project aims to provide in building blocks of web application security information. These modules can be combined together in education tracks targeting different audiences.
The first list of modules can be found here.
This project is not standalone. There is an awfull lot of information that can be found throughout this site and from other resources on the Internet.
This project will draw pieces of information from:
The following training material and presentations were donated to the education project and will be integrated in future Education Tracks.
The SpoC007 goal is to finish Sub Goals 1, 2, 3 and perform Sub Goal 4 during the coming months (road map).
This project aims to provide in building blocks of web application security knowledge that can easily be integrated in awareness sessions or presentations on this topic. The building blocks provided by this project can then be bundled together in eduction tracks.
An important guideline is therefore that the material produced is modular.
We hope you find the OWASP Education Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to the mailing list.
If you contribute to this Project, please add your name here.
Project Lead:
