Summit 2011 Working Sessions

WORK IN PROGRESS

	Name of Working Session	Objective(s)	Outcome(s) / Deliverable(s)	Owner/Leader	Members/Attendees
view edit	Risk Metrics	Quantify business criticality of a deployed application Translate technical risks into business risks (speak the language of management) Translate technical risk into approximate financial risk	Paper describing definitions and formula for determining business criticality Paper translating technical language and risks into business language and monetary risk	Chris Wysopal @	Tony UcedaVelez @ Eoin Keary @ Sherif Koussa @ Konstantinos Papapanagiotou @ Vishal Garg @ Mateo Martinez @ Mikko Saario @ Ofer Maor @ Nuno Loureiro @ Wojciech Dworakowski @ Tobias Gondrom @ Juan Jose Rider @ Alexandre Miguel Aniceto @
view edit	Tools Interoperability (Data Instrumentation)	Defining consuming and instrumental tools data	A standard schema for describing application security risks of all types, with a place for all relevant information – whether derived statically, dynamically, manually, or architecturally.	Dinis Cruz @	Stefano Di Paola @ Dan Cornell @ Jeremy Long @ Paolo Perego @ Sherif Koussa @
view edit	Metrics and Labeling	Discuss positive security properties that should be tracked Discuss options for consumer-friendly labeling Discuss ways to encourage participation in risk labeling	White paper sketching out a standard for a software security label and a plan to finalize the standard.	Chris Eng @	Vishal Garg @ Doug Wilson @ Alexandre Miguel Aniceto @
view edit	Counting and scoring application security defects	Discuss existing methods for counting and scoring defects, by vendors and practitioners willing to share their methodologies. Discuss advantages and disadvantages of a standardized approach. Discuss the CWSS 0.1 draft and how it might be incorporated into a standard.	White paper sketching out a standard for rating risks that accomodates individual minor defects all the way through architectural flaws (that may represent many individual defects)	Chris Eng @ Chris Wysopal @	Jason Taylor @ Justin Clarke @ Sherif Koussa @ Vishal Garg @ Matteo Meucci @ Elke Roth-Mandutz @ Mateo Martinez @ Doug Wilson @ Ofer Maor @ Wojciech Dworakowski @ Alexandre Miguel Aniceto @
view edit	Measuring SDLC process performance	Determine which SDLC activities correlate with more secure software Determine how to measure the performance of these activities	Paper describing the SDLC activities that matter and measurement techniques for their performance	Chris Wysopal @ Chris Eng @	Eoin Keary @ Nishi Kumar @ L. Gustavo C. Barbato @ Jason Taylor @ Matthew Chalmers @ Justin Clarke @ Seba Deleersnyder @ Sherif Koussa @ Vishal Garg @ Giorgio Fedon @ Ofer Maor @ Nuno Loureiro @ Tobias Gondrom @
view edit	Common structure and numbering for all guides	Discuss and review current document project structures and key elements. Review proposal to align to ASVS and discuss whether the current version of ASVS provides an adequate baseline. Review other options for structure and numbering. Develop a draft structure and numbering plan. Discuss any dependencies which may exist, such as common nomenclature and definitions.	A written recommendation for a unified category and numbering system for applicable document projects. Agreement from applicable document project leaders to adopt the finalized version of the system. An implementation plan discussing when projects will implement the new system.	Keith Turpin @ Matteo Meucci @ Vishal Garg @	Lucas C. Ferreira @ Vlatko Kosturjak @
view edit	Creating a unified "finding"			Dinis Cruz @	Abraham Kang @