Upload File

the open web application security project

24
The Open Web Application Security Project

Upload: kaye-ball

Post on 01-Jan-2016

24 views

Category:

Documents


0 download

Report

Tags:

DESCRIPTION

The Open Web Application Security Project. “Security is a process, not a product” -- Bruce Schneier. What if the software world was only…. 100 apps written by 100 developers at 100 companies. 83 apps have a serious vulnerability. 72 apps have Cross Site Scripting. 40 - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: The Open Web Application Security Project

The Open Web Application Security Project

Page 2: The Open Web Application Security Project

“Security is a process, not a product”

-- Bruce Schneier

Page 3: The Open Web Application Security Project

What if the software world was only…

100 apps written by 100 developers at 100 companies

Page 4: The Open Web Application Security Project

83apps have a serious vulnerability

Page 5: The Open Web Application Security Project

72apps have Cross Site Scripting

Page 6: The Open Web Application Security Project

40apps have SQL injection

Page 7: The Open Web Application Security Project

1company has a

responsible appsec program

Page 8: The Open Web Application Security Project

1developer has any security training

Page 9: The Open Web Application Security Project

100apps contain codeof unknown origin

Page 10: The Open Web Application Security Project

90apps use unpatched libraries

with known flaws

Page 11: The Open Web Application Security Project

5apps have had a scan or pentest

Page 12: The Open Web Application Security Project

1app has had a manualsecurity code review

Page 13: The Open Web Application Security Project

0apps provide any

visibility into security

Page 14: The Open Web Application Security Project

Why?

Page 15: The Open Web Application Security Project
Page 16: The Open Web Application Security Project

“Don’t hate the playa

Hate the game”

-- Ice T

Page 17: The Open Web Application Security Project

The first rule of security is…

…You do not talk about security

Page 18: The Open Web Application Security Project

We Trust

We Blame

We Hide

Toxic?

Page 19: The Open Web Application Security Project

AppSecVisibility

Cycle

Audit

Developers

Infosec

Legal

Architects

Users

Research

Business

MonitorThreat

Create SecurityArchitecture

Define SecurityRequirements

ImplementControls

ShareFindings

UnderstandLaws

VerifyCompliance

UnderstandStakeholders

Our Mission: Visibility

Page 20: The Open Web Application Security Project

Growing Ecosystems

Page 21: The Open Web Application Security Project

OWASP Foundation(OWASP Board)

Proj

ects

Mem

bers

hip

Educ

ation

Conf

eren

ces

Indu

stry

Chap

ters

Conn

ectio

ns

OWASP Leaders(Chapters and Project)

OWASP Meritocracy

OWASP Members

OWASP Users and Participants

Page 22: The Open Web Application Security Project

DCSep 2009Nov 2010

BrusselsMay 2008

PolandMay 2009

TaiwanOct 07-08

PortugalNov 2008 Israel

Sep 07-08India

Aug 2008Nov 2009

AustraliaFeb 08-09

MinnesotaOct 08-11

DenverSpring 08-10

SwedenJune 2010

IrelandSept 08-09June 2011

GreeceJune 2012

New YorkNov 2008 Oct 2012 China

Oct 2010

New ZealandJuly 09-10

BrazilOct 09-10

GermanyOct 08-10

Page 23: The Open Web Application Security Project

Today

• Getting Started with OWASP T10 and Guides• Building a Software Assurance Program• Using the OWASP Live CD

=====LUNCH=====

• OWASP Enterprise Security API (ESAPI)• OWASP O2• The DISA AppSec STIG and OWASP Tools• Discussion

Page 24: The Open Web Application Security Project

Jeff WilliamsAspect Security CEO

OWASP Foundation [email protected]://www.owasp.org

twitter @planetlevel410-707-1487

Join Us


NetScaler Application Firewall and OWASP Top Ten – 2013 · The Open Web Application Security Project (OWASP) released the OWASP Top 10 for 2013 for web application security. This

Stat of Web Application Security · State of Web Application Security OWASP Open Web Application Security Project A volunteer group, a not-for-profit charitable organization Produces

WordPress Security White Paper · 2013 OWASP Top 10 The Open Web Application Security Project (OWASP) is an online community dedicated to web application security. The OWASP Top 108

Automated Mobile Application Security Testing with Mobile ... · Automated Mobile Application Security Testing with ... A FREE and Open Source Security Tool for Mobile ... Some Android

4.23 The Open Web Application Security Project (OWASP ...inicio.inai.org.mx/DocumentosdeInteres/4_23_OWASP2.pdf726 4.23 The Open Web Application Security Project (OWASP), Guía de

The Open Web Application Security Project

WordPress - Open Source Foundation for Application Security

How secure is your software?static.summit.cio.nl/uploads/b/i/bi637cp59uob7wt4.pdf · the Open Web Application Security Project (OWASP) Application Security Verification Standard [3]

“Blame it on the Goat!” The Open Web Application Security Project (OWASP) WebGoat Teaching Environment for Web Application Security 10/21/2008 Marina Arseniev

Introduction Purpose of Session: - Provide Overview Web Application Security Threats and Defense Using the Open Web Application Security Project (OWASP)

Thailand Open Web Application Security Days OWASP Top-10 2013

OWASP Security Shepherd Project - Global AppSec2014.appsec.eu/wp-content/uploads/2014/07/Sean.Duggan...The Open Web Application Security Project O OWASP The Open Web Application Security

REQUISITOS TÉCNICOS DE LA PÁGINA WEB CANAL DE …...OWASP (Open Web Application Security Project). 2. WASC (Web Application Security Consortium). Para Código Fuente: 1. OWASP (Open

Web Application Security · OWASP Open Web Application Security Project Dedicated to helping organizations understand and improve the security of their web application and web services

Open Source Security & IoT Development the OWASP Way · OWASP –The Open Web Application Security Project •The Open Web Application Security Project (OWASP) is a not-for-profit

MOBILE APPLICATION SECURITY WITH OPEN-SOURCE TOOLS · 2015 EMC Proven Professional Knowledge Sharing 4 Continued importance of Application Security Application Software is one of

OWASP CODE REVIEW GUIDE · OWASP Code Review Guide V1.1 2008 8 ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT The Open Web Application Security Project (OWASP) is an open community

OWASP APPSEC EUROPE 2015 · OPEN WEB APPLICATION SECURITY PROJECT OWASP is an open-source application security organisation made up of corporations, educational organisations, and

2014 Open Source Development and Application Security Survey … · 2015-09-18 · 2014 Open Source Development and Application Security Survey Analysis Version 1.0 Released: July

Penetration Testing Services · • Information Systems Security Assessment Framework (ISSAF) • Web Application Security Consortium (WASC) Threat Classification • Open Web Application

Unraveling some of the Mysteries around DOM-based XSS · Open Web Application Security Project (OWASP) Aspect Security () Focused exclusively on Application Security Code Review

How to Use this Template - ISSS 2020€¦ · Fortinet Security Fabric Open Ecosystem Network Security Network Security Device, Access, and Application Security Multi-Cloud Security

Stat of Web Application Security - OWASP · State of Web Application Security OWASP Open Web Application Security Project A volunteer group, a not-for-profit charitable organization

A Guide to Building Secure Web Applications Guide to Building Secure Web Applications The Open Web Application Security Project Mark Curphey The Open Web Application Security Project

OWASP-A6 Open Web Application Security Project

IN3210 Network Security Web Application Security...The OWASP Foundation The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization

Lecture 16. OWASP: The Open Web Application Security Project

Live 2014 Survey Results: Open Source Development and Application Security Survey

Port 80 (and 443!) Is Wide Open Scanning for Application ...OWASP Top 10 list Open Web Application Security Project – an open organization dedicated to fight insecure software “The

Security Ninjas: An Open Source Application Security Training Program

OWASP CODE REVIEW GUIDE - mirrors.ocf.berkeley.edu · OWASP Code Review Guide V1.1 2008 8 ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT The Open Web Application Security Project

El Open Web Application Security ProjectowOWASP

APPLICATION CYBER SECURITY Lab Manual · DCS-04 – APPLICATION CYBER SECURITY BLOCK 4 LABORATORY MANUAL . Odisha State Open University ... 5 Study “How to make strong passwords”

infoShare 2011 - Paweł Krawczyk - Why care about application security (open)

Open Web Application Security Project - OWASP · – Web application threats and countermeasures ... – Web hacking/security is easy to understand/teach ... (Western/French Switzerland)