This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Top 10 2010 AppSecDC"
Mark.bristow (talk | contribs) (Created page with '== The presentation == right OWASP Top 10 Update == The speaker == Dave Wichers is a cofounder and the Chief Operating Officer (COO) of Aspect S…') |
|||
| (5 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | == The | + | == The Presentation == |
[[Image:Owasp_logo_normal.jpg|right]] | [[Image:Owasp_logo_normal.jpg|right]] | ||
| − | OWASP Top 10 | + | This presentation will cover the [[OWASP Top 10]] - 2010 Release Candidate that is being released at the OWASP DC Conference. The OWASP Top 10 was originally released in 2003 to raise awareness of the importance of application security. As the field evolves, the Top 10 needs to be periodically updated to keep with up with the times. The Top 10 was updated in 2004 and the last update was in 2007, where it introduced Cross Site Request Forgery (CSRF) as the big new emerging web application security risk. |
| − | + | This update will be based on more sources of web application vulnerability information than the previous versions were when determining the new Top 10. It will also present this information in a more concise, compelling, and consumable manner, and include strong references to the many new openly available resources that can help address each issue, particularly OWASP's new [[ESAPI|Enterprise Security API (ESAPI)]] and [[ASVS|Application Security Verification Standard (ASVS)]] projects. | |
| − | |||
| − | + | A significant change for this update will be that the OWASP Top 10 will be focused on the Top 10 '''Risks''' to Web Applications, not just the most common vulnerabilities. At the conference will be the debut of the release candidate of the new Top 10, which will open up a 60 day comment period. After that time, a final version will be produced and released in early 2010. | |
| + | |||
| + | == Follow Up == | ||
| + | |||
| + | The release candidate for the OWASP Top Ten for 2010 has been officially released at the OWASP AppSec DC Conference today (Nov 13, 2009). This document is now up for open comment until Dec 31, 2009. We will then update the document and release a final version in early 2010, hopefully January. Please send all comments to: [email protected]. | ||
| + | |||
| + | The conference presentation which describes the changes, and goes through each item in the new Top 10 can be downloaded here: ([http://www.owasp.org/images/a/a1/AppSec_DC_2009_-_OWASP_Top_10_-_2010_rc1.pptx OWASP Top 10 - 2010 rc1 Presentation]). | ||
| + | |||
| + | [http://www.owasp.org/index.php/File:OWASP_T10_-_2010_rc1.pdf Click here to download the OWASP Top 10 - 2010 rc1] itself. | ||
| + | |||
| + | == The Speaker == | ||
| + | [[User:Wichers|Dave Wichers]] is a member of the OWASP Board, the OWASP Conferences Chair, and a coauthor, along with [[User:Jeff Williams|Jeff Williams]], of all previous versions of the OWASP Top Ten. | ||
| + | |||
| + | Dave is also the Chief Operating Officer (COO) of Aspect Security ([http://www.aspectsecurity.com www.aspectsecurity.com]), a company that specializes in application security services. Mr. Wichers brings over twenty years of experience in the information security field. Prior to cofounding Aspect, he ran the Application Security Services Group at a large data center company, Exodus Communications. | ||
| + | |||
| + | His current work involves helping customers, from small e-commerce sites to Fortune 500 corporations and the U.S. Government, secure their applications by providing application security design, architecture, and SDLC support services: including code review, application penetration testing, security policy development, security consulting services, and developer training. | ||
[[Category:OWASP_AppSec_DC_09]][[Category:OWASP_Conference_Presentations]] | [[Category:OWASP_AppSec_DC_09]][[Category:OWASP_Conference_Presentations]] | ||
Latest revision as of 00:08, 14 November 2009
The Presentation
This presentation will cover the OWASP Top 10 - 2010 Release Candidate that is being released at the OWASP DC Conference. The OWASP Top 10 was originally released in 2003 to raise awareness of the importance of application security. As the field evolves, the Top 10 needs to be periodically updated to keep with up with the times. The Top 10 was updated in 2004 and the last update was in 2007, where it introduced Cross Site Request Forgery (CSRF) as the big new emerging web application security risk.
This update will be based on more sources of web application vulnerability information than the previous versions were when determining the new Top 10. It will also present this information in a more concise, compelling, and consumable manner, and include strong references to the many new openly available resources that can help address each issue, particularly OWASP's new Enterprise Security API (ESAPI) and Application Security Verification Standard (ASVS) projects.
A significant change for this update will be that the OWASP Top 10 will be focused on the Top 10 Risks to Web Applications, not just the most common vulnerabilities. At the conference will be the debut of the release candidate of the new Top 10, which will open up a 60 day comment period. After that time, a final version will be produced and released in early 2010.
Follow Up
The release candidate for the OWASP Top Ten for 2010 has been officially released at the OWASP AppSec DC Conference today (Nov 13, 2009). This document is now up for open comment until Dec 31, 2009. We will then update the document and release a final version in early 2010, hopefully January. Please send all comments to: [email protected].
The conference presentation which describes the changes, and goes through each item in the new Top 10 can be downloaded here: (OWASP Top 10 - 2010 rc1 Presentation).
Click here to download the OWASP Top 10 - 2010 rc1 itself.
The Speaker
Dave Wichers is a member of the OWASP Board, the OWASP Conferences Chair, and a coauthor, along with Jeff Williams, of all previous versions of the OWASP Top Ten.
Dave is also the Chief Operating Officer (COO) of Aspect Security (www.aspectsecurity.com), a company that specializes in application security services. Mr. Wichers brings over twenty years of experience in the information security field. Prior to cofounding Aspect, he ran the Application Security Services Group at a large data center company, Exodus Communications.
His current work involves helping customers, from small e-commerce sites to Fortune 500 corporations and the U.S. Government, secure their applications by providing application security design, architecture, and SDLC support services: including code review, application penetration testing, security policy development, security consulting services, and developer training.
