This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP API Security Project"

From OWASP
Jump to: navigation, search
(Project About)
(Undo revision 202361 by David Shaw (talk))
Line 124: Line 124:
 
* Wiki editing support.
 
* Wiki editing support.
 
* Writing support for the book.
 
* Writing support for the book.
 +
 +
=Project About=
 +
 +
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
 +
<span style="color:#ff0000">
 +
This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says "OWASP_Example_Project". When in doubt, ask the OWASP Projects Manager.
 +
Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project
 +
</span>
 +
 +
{{:Projects/OWASP_Example_Project_About_Page}}
 +
 +
 +
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 +
__NOTOC__ <headertabs />
 +
 +
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Breakers]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]

Revision as of 18:05, 20 October 2015

OWASP Project Header.jpg

OWASP API Security Project

This project seeks to address the ever-increasing number of organizations that are deploying potentially sensitive APIs as part of their software offerings. These APIs are used for internal tasks and to interface with third parties. Unfortunately, many APIs do not undergo the rigorous security testing that would render them secure from attack.

The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs and illustrating how these risks may be mitigated. In order to facilitate this goal, the OWASP API Security Project will create and maintain a Top 10 API Security Risks document, as well as a documentation portal for best practices when creating or assessing APIs.

Description

While working as developers or information security consultants, many people have encountered APIs as part of a project. While there are some resources to help create and evaluate these projects (such as the OWASP REST Security Cheat Sheet), there has not be a comprehensive security project designed to assist builders, breakers, and defenders in the community.

This project aims to create:

  • The OWASP Top Ten API Security Risks document, which can easily underscore the most common risks in the area.
  • Create a documentation portal for developers to build APIs in a secure manner.
  • Work with the security community to maintain living documents that evolve with security trends.

Licensing

The OWASP API Security Project documents are free to use!

The OWASP API Security Project is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

What is the OWASP API Security Project?

The OWASP API Security Project seeks to deliver actionable documentation on creating and deploying verifiably secure web APIs, as well as illustrating the major risks and shortfalls that APIs may encounter. By helping developers create resilient software, and helping assessors understand the subtle risks an API may entail, the goal of this project is to bring security to an increasingly programmatic world.

Presentation

The OWASP API Security Project will be presented in 2016.

Project Leader

Related Projects

Quick Download

Once API Security documents are created, they will be available for direct download here.

News and Events

There has not yet been press coverage of this project.

In Print

There are no current print materials for this project.

Classifications

New projects.png Owasp-builders-small.png
Owasp-breakers-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

How can I participate in your project?

This project welcomes contributors of all sorts. The easiest way to get involved is to contact the Project Leader, and indicate that you're willing to help.

What type of contributors are you seeking?

We're currently looking for software developers who have experience building out resilient APIs, and security assessors who have assessed APIs. This project is currently in the "research" stage, meaning that the more you can contribute to building out the project, the better!

Can I still participate if I'm not a developer/assessor?

Sure -- we just need to figure out the correct role. If you're strong with technical writing, that would be great; if there are other skill sets you think you can bring to the table, please let us know.

Contributors

The OWASP API Security Project is small, but will be maintained by volunteers. If you'd like to volunteer, please contact the Project Leader.

The creator of this project and current Project Leader is David Shaw.

A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.  

The roadmap for this project is straightforward: we'll begin by conducting research and seeking feedback from developers and security auditors on the problems they most frequently encounter via web-based APIs. We'll create, from this research, the OWASP Top Ten API Risks, a sub-project of the API Security Project. Once this document is created (and maintained), we will also create guidelines in order to demonstrate each of the risks (as well as other, non-top-ten risks) and illustrate how to prevent them.

Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active.

As of October 2013, the priorities are:

  • Finish the referencing for each principle.
  • Update the Project Template.
  • Use the OWASP Press to develop a book.
  • Finish and publish the book on Lulu.

Involvement in the development and promotion of the OWASP Security Principles Project is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

  • Helping find references to some of the principles.
  • Project administration support.
  • Wiki editing support.
  • Writing support for the book.

This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says "OWASP_Example_Project". When in doubt, ask the OWASP Projects Manager. Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project


PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: N/A
Purpose: N/A
License: N/A
who is working on this project?
Project Leader(s): N/A
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: N/A
Project Roadmap: Not Yet Created
Key Contacts
  • Contact the GPC to contribute to this project
  • Contact the GPC to review or sponsor this project
current release
pending
last reviewed release
pending


other releases