Difference between revisions of "Commentary OWASP Top Ten 2004 Project"

Revision as of 13:02, 19 May 2006

J. Howard Beales, III

• Director of the Federal Trade Commission's Bureau of Consumer Protection
• Before the Information Technology Association of America's Internet Policy Committee, Friday, December 12, 2003

"With new vulnerabilities announced almost weekly, many businesses may feel overwhelmed trying to keep current. But there is help in the form of consensus lists of vulnerabilities and defenses. The Open Web Application Security Project has produced a similar list of the 10 most critical Web application and databases security vulnerabilities and the most effective ways to address them. Application vulnerabilities are often neglected, but they are as important to deal with as network issues. If every company eliminated these common vulnerabilities, their work wouldn't be done, but they, and the Internet, would be significantly safer."

Eugene H. Spafford

• Professor of Computer Sciences, Purdue University
• Executive Director of the Purdue University Center for Education and Research in Information Assurance and Security (CERIAS)

"Misconfiguration, inattention, and flawed software can spell disaster on the Internet. One of the primary areas of vulnerability is through WWW connections. By design, WWW services are intended to be open and accepting, and usually act as an interface to valuable resources. As such, it is critical that these services be secured. But with hundreds of potential vulnerabilities it can be overly daunting to decide where to start applying defensive measures. The OWASP Top 10 provides a consensus view of the most significant and likely vulnerabilities in custom WWW applications. Organizations should use it to focus their efforts, giving them confidence they are addressing those areas that will have the most impact on securing their applications."

Dr. Peter G. Neumann

• Principal Scientist, SRI International Computer Science Lab
• Moderator of the ACM Risks Forum, Author of "Computer-Related Risks"

"This ‘Ten-Most-Wanting’ List acutely scratches at the tip of an enormous iceberg. The underlying reality is shameful: most system and Web application software is written oblivious to security principles, software engineering, operational implications, and indeed common sense."

Steven M. Christey

• Principal Information Security Engineer and CVE Editor, Mitre

"This list is an important development for consumers and vendors alike. It will educate vendors to avoid the same mistakes that have been repeated countless times in other web applications. But it also gives consumers a way of asking vendors to follow a minimum set of expectations for web application security and, just as importantly, to identify which vendors are not living up to those expectations"

Jeffrey R. Williams

• Aspect Security CEO
• OWASP Top Ten Project Leader

"The OWASP Top Ten shines a spotlight directly on one of the most serious and often overlooked risks facing government and commercial organizations. The root cause of these risks is not flawed software, but software development processes that pay little or no attention to security. The most effective first step towards creating a security-aware culture in your organization is immediately adopting the Top Ten as a minimum standard for web application security."

Mark Curphey

• Founder of OWASP
• Director of Application Security Consulting, Foundstone Strategic Security.

"There is no silver bullet for web security despite what some technology companies would have you believe. Solving this complex and challenging problem is about having great people, great knowledge, great education, great business process and using great technology. The OWASP Top Ten creates a palatable well ordered and well thought out list from where you can start to understand your security posture (or that of your service providers) and plan the use of your valuable resources accordingly."

Dr. Charles P. Pfleeger

• CISSP
• Master Security Architect, Cable & Wireless
• Author of "Security in Computing"

"From web pages to back office number crunching, almost all organizations acquire applications code, many people write it, and everybody uses it. But flaws continue to be found in applications, even after nearly fifty years of programming experience. Worse, the same kinds of flaws appear over and over again. This failure to learn from not only our mistakes but also those of our parents’ generation creates far too many vulnerabilities for potential attack. It is no wonder that attacks against applications are on the rise. In compiling this list of the ten most critical applications code flaws, the OWASP has performed a real service to developers and users alike by focusing attention on common weaknesses and what can be done about them. Now it is up to software development organizations, programmers, and users to apply the thoughtful guidance presented here."