|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
DOM Sandboxing
|
- Attenuated versions of existing apis to sandboxed code.
- Client side sandboxed apps maintaining state and authentication.
- Create a standard for modifying a sandboxed environment
- Deprecate and discourage standards which ambiently or undeniably pass credentials.
- Create a standard for authentication within a sandboxed environment (maybe interfacing with existing auth without passing creds like 0Auth works)
|
- Browser Security Report
- Browser Security Priority List
|
Jasvir Nagra Gareth Heyes @
|
Email John Wilander if you are unable to edit the Wiki and would like to sign up! @
Michael Coates
Eduardo Vela @
Stefano Di Paola
Isaac Dawson
Chris Eng @
Alexandre Miguel Aniceto @
|
view edit
|
HTML5 Security
|
- Handle autofocus in a unified and secure way.
- Discuss necessity and capability for the HTML5 form controls.
- Initiate and create documentation and references for developers that address security issues.
- Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags.
- Long Term Goal(s): Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier.
|
- Browser Security Report
- Browser Security Priority Report
|
Mario Heiderich Gareth Heyes @
|
John Wilander @
Michael Coates @
Tony UcedaVelez @
Stefano Di Paola
Isaac Dawson
Chris Eng @
Nishi Kumar @
Elke Roth-Mandutz @
Giorgio Fedon
Paolo Perego @
Eduardo Vela @
Abraham Kang @
Nuno Loureiro @
Alexandre Miguel Aniceto @
|
view edit
|
EcmaScript 5 Security
|
- Fix the problems with Object.defineProperty() and property unsealing / double-freezing.
- Raise awareness for the power or object freezing in a security context.
- Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented.
- Long Term Goal: Discuss the possibility of vendor supported client side security mechanisms.
|
- Browser Security Report
- Browser Security Priority List
|
Mario Heiderich TBC
|
John Wilander @
Michael Coates @
Stefano Di Paola
Isaac Dawson
Abraham Kang
Gareth Heyes
|
view edit
|
Enduser Warnings
|
- Clearly there is a need for warnings that users understand and that conveys the right information. Perhaps we can agree on some guidelines or at least exchange lessons learned.
|
- Browser Security Report
- Browser Security Priority List
|
John Wilander @
|
John Wilander @
Michael Coates @
Vishal Garg @
|
view edit
|
Site Security Policy
|
|
- Browser Security Report
- Browser Security Priority List
|
John Wilander @ Michal Coates @
|
John Wilander @
Michael Coates @
Stefano Di Paola
Tobias Gondrom @
Alexandre Miguel Aniceto @
|
view edit
|
Securing Plugins
|
|
- Browser Security Report
- Browser Security Priority List
|
|
John Wilander @
Michael Coates @
Giorgio Fedon
|
view edit
|
Blacklisting
|
|
- Browser Security Report
- Browser Security Priority List
|
|
John Wilander @
Michael Coates @
|
view edit
|
OS Integration
|
|
- Browser Security Report
- Browser Security Priority List
|
|
John Wilander @
Michael Coates @
|
view edit
|
|
|
|
|
|
|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
XSS and the Frameworks
|
- Work on how OWASP can engage with the major web frameworks to move towards a "secure by default" stance
- Work on OWASP resources to provide patches/design approaches in conjunction with the frameworks
|
- OWASP statement/Press release to publicly ask the frameworks to build security in
- Engagement plan on how we'd work with (if at all) a framework to get ESAPI or similar functionality integrated
- White paper or standard for what we want the web frameworks to provide in terms of XSS defenses. Turning the XSS Prevention Cheat Sheet into a standard/metric for frameworks would be great.
- OWASP Standard defining an appraisal methodology for a framework’s XSS prevention capability based on the other deliverable.
|
Justin Clarke @
|
Chris Eng @
Abraham Kang
Tony UcedaVelez @
Fred Donovan @
Juan Jose Rider @
|
view edit
|
XSS - Awareness, Resources, and Partnerships
|
- Work on what partners we can reach, and what resources they can provide us access to
- Work on who we can work with to reach a maximum amount of developers writing web applications
- Plan engagement with identified organizations
- Plan a call to action for OWASP chapters for identified XSS resources
|
- A concrete, specific business plan for investing OWASP Funds in a campaign designed to ensure that every developer knows about XSS and what to do to prevent it. The plan should have specific goals, measures, and targets over time so we know if it is on track.
|
Justin Clarke @
|
Chris Eng @
Abraham Kang
Sherif Koussa @
|
view edit
|
WAF Mitigations for XSS
|
- Improve XSS Attack Payload Detection Techniques
- Identifying Improper Output Handling Flaws in Web Apps
- Feasibility of Profile Page Scripts/Iframes
- Testing Injection of JS Sandbox Code in Responses
|
- White paper describing “Next Generation WAF Capabilities” such as the ones described above. Include areas requiring additional research and funding.
|
Ryan Barnett @
|
Lucas C. Ferreira @
Achim Hoffmann @
Justin Clarke @
Giorgio Fedon
Abraham Kang
Mario Heiderich
Gareth Heyes
Eduardo Vela @
Stefano Di Paola
David Lindsay
Juan Jose Rider @
|
view edit
|
|
|
|
|
|
view edit
|
|
|
|
|
|
|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
University Outreach
|
- Estimation of Security prorams currently exist in university settings around the world
- How can OWASP participate and influence the curricula of these educational programs?
- How can we foster relationships between OWASP and universities?
- How can the relationship between OWASP and universities be standardized?
- What can OWASP offer universities and what can they, in turn, expect from each other?
|
- A study with facts, numbers, and other metrics about application secuirity in academia. The OWASP Academic State of the World.
- A white paper with strategies for infiltrating academia with our priorities.
|
Martin Knobloch @
|
Nishi Kumar @
Cecil Su @
Elke Roth-Mandutz @
Heiko Richler @
Lucas C. Ferreira @
Jason Taylor @
Carlos Serrão @
Konstantinos Papapanagiotou @
Mateo Martinez @
L. Gustavo C. Barbato @
Edward Bonver @
Ricardo Melo @
Alexandre Agustini @
|
view edit
|
OWASP Academies
|
- Presentation of the discussion had in January – what were we looking for, what conclusions were reached and why;
- The OWASP Academic Portal Project – what is it, advantages, contributors, roadmap;
- Alternative ways of working with Universities when possible – Summer School proposal (ISCTE);
- OWASP Appsec Tutorial Series – How to best disseminate it and use it.
|
- Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
|
Sandra Paiva @
|
Martin Knobloch @
Paulo Coimbra @
Dinis Cruz @
Nishi Kumar @
Cecil Su @
Heiko Richler @
Lucas C. Ferreira @
Jason Taylor @
Mateo Martinez @
Konstantinos Papapanagiotou @
Carlos Serrão @
Matteo Meucci @
Elke Roth-Mandutz @
Daniel Brzozowski @
L. Gustavo C. Barbato @
Ricardo Melo @
Alexandre Agustini @
|
view edit
|
OWASP Training
|
- Presentation of the OWASP Training Model;
- How to keep the initiative alive – people, methodologies, contents, materials;
- Trainers Database – assessment of quality;
- Connection with the Paid Training Model;
- Set up a strategy to apply for currently available state European funding.
|
- Deliver the above as a fundable business plan complete with financial and resource requirements, timelines, metrics, etc…
- Team and Model to apply for currently available state European funding.
|
Sandra Paiva @
|
Martin Knobloch @
Paulo Coimbra @
Dinis Cruz @
Nishi Kumar @
Cecil Su @
Heiko Richler @
Lucas C. Ferreira @
L. Gustavo C. Barbato @
Jason Taylor @
Achim Hoffmann @
Mark Bristow @
Mateo Martinez @
Carlos Serrão @
Konstantinos Papapanagiotou @
Vishal Garg @
Matteo Meucci @
Jeremy Long @
Seba Deleersnyder @
Ralph Durkee @
Ricardo Melo @
|
view edit
|
Developer's Security Training Package
|
- To create an organized package that can be used by companies for the purposes of educating developers on securely coding web applications and web services
|
- A curriculum for the above based on OWASP materials and a plan to build it out.
|
Brad Causey @
|
Martin Knobloch @
Nishi Kumar @
Jason Taylor @
Carlos Serrão @
Konstantinos Papapanagiotou @
Daniel Brzozowski @
L. Gustavo C. Barbato @
Keith Turpin @
Ralph Durkee @
Mikko Saario @
Ricardo Melo @
Mateo Martinez @
Tobias Gondrom @
Alexandre Agustini @
Sherif Koussa @
|
|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
Applying ESAPI Input Validation
|
- Serial Decomp: Decode, canonicalize, filter
- Structured data (SSN, CC, etc.)
- Unstructured data (comments, blogs, etc.)
- Other input exaples (ws-, database, etc.)
|
- A clear and concise user guide for getting ESAPI input validation up and running.
|
Chris Schmidt @
|
Nishi Kumar @
Justin Clarke @
John Steven @
|
view edit
|
Defining AppSensor Detection Points
|
- Understand AppSensor Fundamentals
- Define AppSensor Detection Points applicable to most applications
- Implement detection points into code
|
- Status of AppSensor Whitepaper including AppSensor Roadmap
- Updated AppSensor-Tutorial code with new lessons and lesson structure enhancements
- Updated Getting Started Guide for new adopters and developers leveraging feedback from session
|
Michael Coates @
|
Ryan Barnett @
Colin Watson
Chris Schmidt @
|
view edit
|
Contextual Output Encoding
|
- Increase coverage and functionality of existing Output Encoding Codecs
- Create new codecs to cover more output encoding contextual needs
- Introduce these codecs in a way that doesn't interfere with ESAPI Modularization Tasks
- Draft an implementation guide for Application Framework Developers to implement ESAPI Output Encoding into their Application Frameworks
|
- Increase coverage and functionality of existing Output Encoding Codecs
- New drop in set of codecs for the ESAPI Encoder to use for additional contexts
- Implementation Guide for Framework Developers to integrate Output Encoding into their Application Framework. This should be a simple guide that can be distributed en masse to framework developers as a push to get them involved in making their frameworks more secure by eliminating XSS.
|
Chris Schmidt @
|
Justin Clarke @
Abraham Kang
|
view edit
|
Protecting Information Stored Client-Side
|
- Produce an informal threat model for each development scenario
- Impart clear and simple shared understanding of threats associated with each development scenario (and dispel common misunderstandings/idioms)
- Define solution that resists defined attacks
- Deliver solution implementation (snippets) to https://code.google.com/p/secure-coding-workshop/
|
- (see objectives) Threat Models
- (see objectives) Code Snippets
- Plan and Extra-summit work-items for exercises in Phone and RIA contexts during next summit
|
John Steven @
|
Elke Roth-Mandutz @
Jim Manico @
Chris Schmidt @
Justin Clarke @
Neil Matatall @
Tony UcedaVelez @
Fred Donovan @
Alexandre Miguel Aniceto @
Antonio Fontes @
|
view edit
|
Protecting Against CSRF
|
|
- A practical guideline for protecting against CSRF in the real world.
- A concise, clear standard for determining whether an application is vulnerable to CSRF.
|
|
Chris Schmidt @
Achim Hoffmann @
Ryan Barnett @
Mark Thomas @
Vishal Garg @
|
view edit
|
Providing Access to Persisted Data
|
- Create design and code examples for protecting access to database tables and rows by role
- Create design and code examples for protecting access to data when 'auto-wiring' and marshalling
- Create design and code examples for protecting sensitive data at rest
|
- A short reference architecture/coding examples type of guideline that clearly explains positive and negative examples of accessing persisted data.
|
Dan Cornell @
|
Chris Schmidt @
Justin Clarke @
Dan Cornell @
John Steven @
Ralph Durkee @
Alexandre Miguel Aniceto @
|
view edit
|
The Future of the OWASP Secure Coding Workshop
|
- Determine how to scale the idea
- Determine how to get funding for it
- Schedule at least two following OWASP Secure Coding Workshop days in 2011
|
- A business plan for OSCW to be evaluated by the community at large. What is the investment, schedule, metrics, benefit…
|
John Steven @ Chris Schmidt @
|
Justin Clarke @
Jeremy Long @Summit 2011 Working Sessions/Session032
|
view edit
|
ESAPI for Ruby
|
- Define which APIs needs to be implemented
- Define the module's namespace inside the gem
- Write cucumber scenarios to define overall integration tests
- Write rspec contexts for each API for fine grain test
- (hopefully: implementing at least 5% of APIs starting from their rspecs)
|
- Cucumber scenarios
- Rspec context for each API choosen
- 5% of APIs being implemented
|
Paolo Perego @
|
|
view edit
|
ESAPI-CORE
|
- Build ESAPI-core version 1 for Java 1.5+
- Document planning phase and design decisions around ESAPI-core
- Produce library usage documentation
|
- Build a design plan for ESAPI core.
- Deploy the first version of the ESAPI-core Jar.
|
Jim Manico @
|
Paolo Perego @
Jim Manico @
|
view edit
|
Building the OWASP Brazilian Leaders Group
|
- Define the members of the group
- Define the rules of engagement for the group
- Discuss how to fund Brazilian chapters
- Discuss the translation of OWASP materials to Portuguse
- Define the rules for hosting AppSec Brazil
|
- Objectives and working plan to improve OWASP presence in Brazil
|
Lucas C. Ferreira @
|
L. Gustavo C. Barbato @
Eduardo Jorge Feres Serrano Neves @
|
view edit
|
Government Outreach
|
- Determine realistic ways to promote OWASP offerings to governments around the world
- Determine what governments are looking for from OWASP
- Determine resources that governments could provide that would assist the OWASP mission
- Explore the practicality of liaison roles to/from government organizations
|
- A list of suggestions to pass along to the Global Connections Committe for the best ways of engaging government
- A high level outline of what OWASP has to offer governments at large
- A list of items that government agencies are looking for from OWASP
- An outline of strategy for pursuing interaction with different governments in depth
|
Doug Wilson @
|
Lucas C. Ferreira @
Mateo Martinez @
Colin Watson
Martin Knobloch @
|
view edit
|
Global Conferences Committee Monthly Meeting
|
- Develop v1 of OWASP Global Sponsorship Model
- Develop 2012 Call for AppSec Conferences (and new management system)
- Develop messaging plan for new initiatives
|
|
Mark Bristow @
|
Mark Bristow @
Lucas C. Ferreira @
Neil Matatall @
Ralph Durkee @
|
view edit
|
|
|
|
|
|
view edit
|
OWASP Certification
|
- Determine whether certification would have value for OWASP's Community
- Determine a model by which certification based on OWASP materials could succeed
- Determine a model for creation and distribution of a CC-licensed certification exam based on OWASP materials
- (if agreed) Determine a model for supporting the administration of certification based on OWASP Materials
|
- A business plan for evaluation by the community at large.
|
|
Dinis Cruz @
Matthew Chalmers @
Mateo Martinez @
Jeremy Long @
Matteo Meucci @
Seba Deleersnyder @
Daniel Brzozowski @
Paolo Perego @
Edward Bonver @
Ralph Durkee @
Nuno Loureiro @
Ricardo Melo @
Martin Knobloch @
Alexandre Miguel Aniceto @
|
|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
OWASP Board/Committee Governance
|
- Universal Committee Governance Document/Policies
- Review Board Governance and By-Laws (Including Board composition/elections)
- Committee alignment to OWASP Goals/Mission including Authorities, Individual Missions and Areas of Responsibility (AoR).
- Providing budgets to committees for direct oversight and spending in their AoR
- Additional transparency in OWASP accounting (Expenditures, Expense Reports for Officers/Committee Members.....)
|
- Universal Committee Governance Document and operating Policies
- Proposed updated OWASP By-Laws
- Committee mission clarifications and delineation of areas of responsibility
- New model for funding OWASP activities
- New policies to enhance transparency
|
Mark Bristow @ Jason Li @ Tom Brennan @
|
Jim Manico @
Nishi Kumar @
Joe Bernik
Matthew Chalmers @
Sarah Baso @
Doug Wilson @
Kate Hartmann @
John Steven @
Seba Deleersnyder @
|
view edit
|
OWASP Projects
|
- Review changes made in the last 2 years
- Discuss the high level steps of a project life-cycle
- Approve the OWASP GPC Governance Document
- Streamline project initialization process to make it easier for new projects
- Implement project governance change approved by the Board to limit use of "OWASP" brand name to projects of certain maturity
|
- Initial draft for an RFP for a centralized OWASP project hosting solution
- A project lifecycle flow chart to identify the necessary steps to improving the visibility of a project's health
- An envisioned structure for the future of OWASP Projects
|
Brad Causey @ Jason Li @
|
Seba Deleersnyder @
Nishi Kumar @
|
view edit
|
OWASP Industry Outreach
|
|
- The OWASP 2011 Industry Plan. To discuss plans for working with industry in a closer manner. The plan should contain specific activities, commitments, dates, and expected outcomes.
|
Eoin Keary @ Colin Watson
|
Lorna Alamri @
David Campbell
Eoin Keary
Matt Tesauro
Joe Bernik
Nishi Kumar @
Lucas C. Ferreira @
Tobias Gondrom @
Vehbi Tasar
Colin Watson
Jason Taylor @
Sarah Baso @
Mateo Martinez @
Konstantinos Papapanagiotou @
|
view edit
|
Membership
|
- Develop a plan for reaching out to other organizations in order to expand OWASP's exposure to the larger security and developer communities.
- Create a budget and funding plan for the Membership Committee
- Be ready to conduct a survey of new and existing OWASP Members and Supporters. Develop survey questions and specifics for the implementation.
|
- The OWASP 2011 Membership Plan – describing the membership program and recommendations, marketing plans. The plan should contain specific membership targets for all membership classes and detailed strategies for achieving the goals.
|
Dan Cornell @
|
Michael Coates @
Mateo Martinez @
Dan Cornell @
Tony UcedaVelez @
Ofer Maor @
|
view edit
|
Connections
|
- Define the mission of the Connections Committee
- Agree engagement/working patterns with the other global committees
|
- The OWASP 2011 Connection Plan – describing the current connections program and detailing the specifics for what will happen in 2011. The plan should contain specific goals and strategies for achieving the goals.
|
Jim Manico @ Justin Clarke @
|
Achim Hoffmann @
Doug Wilson @
Andre Gironda @
|
view edit
|
Chapters
|
- Challenges and solutions to run a successful OWASP chapter
|
- The OWASP 2011 Chapter Plan – describing the current state of OWASP chapters worldwide and identifying what will happen in 2011 to grow the number of chapters and improve their quality.
|
Seba @
|
Mandeep Khera
Matthew Chalmers @
Matteo Meucci @
Mateo Martinez @
Ferdinand Vroom @
Helen Gao @
L. Gustavo C. Barbato @
Ofer Maor @
Wojciech Dworakowski @
Martin Knobloch @
Vlatko Kosturjak @
Antonio Fontes @
|
view edit
|
Education
|
- Estimate how the past achievements do support the current educational developments
- Evaluate how we can get the projects involved in developing (or at least reviewing) training material
- Define new goals for the upcoming period
- Define success factors for the upcoming period
|
- The OWASP 2011 Education Plan – describing the specific plans for education in 2011 with schedule, targets, action plans, etc…
|
Martin Knobloch @
|
Nishi Kumar @
Cecil Su @
Jason Taylor @
|
view edit
|
Conferences - Improving Conference Planner Support
|
- Discuss the GCC's current 2011 Plan of action and new initiatives
- Review comments provided in the Conference Planner Survey
- Discuss mechanisms to improve Planner/Operational Support
- Discuss mechanisms to improve event marketing/sponsorships
- Discuss Global Conference Sponsorship Plan
|
- The OWASP 2011 Conference Plan – describing the plan for continuing to make our conferences even better, specifically defining the various tiers of conferences, naming, partnering with other entities, and other challenges.
|
Mark Bristow @
|
Lorna Alamri @
Nishi Kumar @
Lucas C. Ferreira @
Ralph Durkee @
Matthew Chalmers @
Matteo Meucci @
Mateo Martinez @
Neil Matatall @
Seba Deleersnyder @
L. Gustavo C. Barbato @
|
|
Name of Working Session
|
Objective(s)
|
Outcome(s) / Deliverable(s)
|
Owner/Leader
|
Members/Attendees
|
view edit
|
OWASP Around the World
|
- Internationalization
- Global Job Board
- New OWASP chapters in parts of the world where we have not spread much yet
|
- A white paper with specific recommendations on how we can ensure the greatest amount of access and involvement with OWASP for all people everywhere.
|
|
Matthew Chalmers @
Mateo Martinez @
Cecil Su @
|
view edit
|
What is an OWASP Leader?
|
- Define what it means to be an OWASP Leader
|
- Definition of critera for OWASP Leaders
- A standard defining exactly what characterizes an OWASP Leader, for use in providing benefits and prioritizing support.
|
Dinis Cruz @
|
Matthew Chalmers @
Chris Schmidt @
Mark Bristow @
Daniel Brzozowski @
Martin Knobloch @
Vlatko Kosturjak @
Antonio Fontes @
|
view edit
|
Overhauling the OWASP Website
|
- Revisit goals from previous working session
- Identify available Google Apps (e.g. Code Review, Moderator, Short Links, Project Hosting, Groups, etc) that we can leverage to support OWASP Website Infrastructure.
- Review Website Overhaul Proposal for consideration
- Decide what elements should be outsourced/contracted to expedite implementation
- Resolve on schedule for achieving goals
|
- A project plan describing the future of web support for the OWASP ecosystem (think social) that covers all the various constituents, stakeholders, users, leaders, etc…. The plan will define all the steps necessary to get there and provide a rough estimate of the effort to get there. To the maximum extent possible, the plan will be designed to be parallelizable so that parts can be worked independently.
|
Jason Li @
|
Larry Casey
Achim Hoffmann @
Michael Coates @
Colin Watson
Nishi Kumar @
Dinis Cruz @
Matthew Chalmers @
Justin Clarke @
Mark Bristow @
Seba Deleersnyder @
|
view edit
|
Computer Crime Laws
|
- Understand the current laws/frameworks in place in relation to computer crime and prevention
- Discuss ways these laws are currently failing consumers in protecting assets
- Discuss possible amendments to the laws/frameworks to better protect the public
|
- A study evaluating the existing computer crime laws and how they might be applied to the current set of application security attacks. Recommendations for a new legal framework.
|
Daniel Cuthbert @
|
Matthew Chalmers @
Abraham Kang
|
view edit
|
Sandboxed Tabs/Domains/Browser
|
|
- Browser Security Report
- Browser Security Priority List
|
|
John Wilander @
Michael Coates @
|
view edit
|
OWASP Security Refactorings
|
- Goals and Scope of initial "Security Refactorings"
- High level Organization of Code Example Smells
- Format to present Security Refactorings
- Solutions and Segmenting of work.
|
- 1. Goals and Scope of initial "Security Refactorings"
- 2. High level Organization of Code Example Smells
- 3. Format to present Security Refactorings
- 4. Solutions and Segmenting of work.
|
Abraham Kang @
|
Abraham Kang @
|
view edit
|
OWASP Portuguese Language Project
|
- Kickstart the project
- Define leadership and roles
- Prioritize documents
- List all Portuguese materials available
|
- A prioritized action plan for getting OWASP materials created in Portuguese
|
Lucas C. Ferreira @
|
Paulo Coimbra @
Sandra Paiva @
L. Gustavo C. Barbato @
Ricardo Melo @
Alexandre Agustini @
|
view edit
|
|
|
|
|
Summit 2011 Working Sessions/Session050
Summit 2011 Working Sessions/Session051
|
view edit
|
OWASP Testing Guide
|
- Show the v3, and debating what we need to create an excellent v4
|
- An updated outline for the testing guide that is tied into the OWASP common numbering scheme
- A short white paper with ideas for revisions to the Testing Guide for evaluation and discussion by the community at large.
- A committed project manager who can reach out to experts to get the document completed.
|
Matteo Meucci @
|
Nishi Kumar @
Cecil Su @
Lucas C. Ferreira @
Keith Turpin @
Achim Hoffmann @
Tom Neaves @
Vishal Garg @
Giorgio Fedon @
Stefano Di Paola @
Pavol Luptak @
Andre Gironda @
Edward Bonver @
Wojciech Dworakowski @
Vlatko Kosturjak @
Antonio Fontes @
Christian Martorella @
|
view edit
|
OWASP Java Project
|
- Restart the Java project
- Find new leadership
- Recruit volunteers
- Build a new Roadmap for the project
|
- Action plan for the project
- New project leader
|
Lucas C. Ferreira @
|
Mateo Martinez @
Daniel Brzozowski @
|
view edit
|
Board Structure
|
|
|
|
John Steven @
Michael Coates @
Colin Watson
Martin Knobloch @
Seba Deleersnyder @
Jim Manico @
Mark Bristow @
|
view edit
|
Risk Metrics
|
- Quantify business criticality of a deployed application
- Translate technical risks into business risks (speak the language of management)
- Translate technical risk into approximate financial risk
|
- Paper describing definitions and formula for determining business criticality
- Paper translating technical language and risks into business language and monetary risk
|
Chris Wysopal @
|
Tony UcedaVelez @
Eoin Keary @
Sherif Koussa @
Konstantinos Papapanagiotou @
Vishal Garg @
Mateo Martinez @
Mikko Saario @
Ofer Maor @
Nuno Loureiro @
Wojciech Dworakowski @
Tobias Gondrom @
Juan Jose Rider @
Alexandre Miguel Aniceto @
|
view edit
|
Tools Interoperability (Data Instrumentation)
|
- Defining consuming and instrumental tools data
|
- A standard schema for describing application security risks of all types, with a place for all relevant information – whether derived statically, dynamically, manually, or architecturally.
|
Dinis Cruz @
|
Stefano Di Paola @
Dan Cornell @
Jeremy Long @
Paolo Perego @
Sherif Koussa @
|
view edit
|
Metrics and Labeling
|
- Discuss positive security properties that should be tracked
- Discuss options for consumer-friendly labeling
- Discuss ways to encourage participation in risk labeling
|
- White paper sketching out a standard for a software security label and a plan to finalize the standard.
|
Chris Eng @
|
Vishal Garg @
Doug Wilson @
Alexandre Miguel Aniceto @
|
view edit
|
Counting and scoring application security defects
|
- Discuss existing methods for counting and scoring defects, by vendors and practitioners willing to share their methodologies.
- Discuss advantages and disadvantages of a standardized approach.
- Discuss the CWSS 0.1 draft and how it might be incorporated into a standard.
|
- White paper sketching out a standard for rating risks that accomodates individual minor defects all the way through architectural flaws (that may represent many individual defects)
|
Chris Eng @ Chris Wysopal @
|
Jason Taylor @
Justin Clarke @
Sherif Koussa @
Vishal Garg @
Matteo Meucci @
Elke Roth-Mandutz @
Mateo Martinez @
Doug Wilson @
Ofer Maor @
Wojciech Dworakowski @
Alexandre Miguel Aniceto @
|
view edit
|
Measuring SDLC process performance
|
- Determine which SDLC activities correlate with more secure software
- Determine how to measure the performance of these activities
|
- Paper describing the SDLC activities that matter and measurement techniques for their performance
|
Chris Wysopal @ Chris Eng @
|
Eoin Keary @
Nishi Kumar @
L. Gustavo C. Barbato @
Jason Taylor @
Matthew Chalmers @
Justin Clarke @
Seba Deleersnyder @
Sherif Koussa @
Vishal Garg @
Giorgio Fedon @
Ofer Maor @
Nuno Loureiro @
Tobias Gondrom @
|
view edit
|
OWASP Quotes
|
- Open letter to governments
- Open letter to insurance companies
- Tools inoperability
- Tools customization by security consultants
- Wiki leaks & WebAppSec
|
- A white paper on how OWASP can use “quotes” effectively to drive awareness and action. The paper will suggest specific strategies for obtaining, vetting, and promoting quotes to achieve our aims.
|
Dinis Cruz @
|
Matthew Chalmers @
|