OWASP

OWASP
Types501(c)(3) nonprofit organization
FocusWeb security, application security, vulnerability assessment
Coordinates39°44′47″N 75°33′03″W / 39.746343°N 75.5508357°W / 39.746343; -75.5508357 Edit this at Wikidata
MethodIndustry standards, conferences, workshops
RevenueDecrease $2.3 million[1]
Total Assets1,669,244 United States dollar (2021) Edit this on Wikidata
Websiteowasp.org Edit this on Wikidata

The Open Web Application Security Project [7] (OWASP) is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security.[8][9][10] The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 2021 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations.

History

Mark Curphey started OWASP on September 9, 2001.[2] Jeff Williams served as the volunteer Chair of OWASP from late 2003 until September 2011. As of 2015, Matt Konda chaired the Board.[11]

The OWASP Foundation, a 501(c)(3) non-profit organization in the US established in 2004, supports the OWASP infrastructure and projects. Since 2011, OWASP is also registered as a non-profit organization in Belgium under the name of OWASP Europe VZW.[12]

In February 2023, it was reported by Bil Corry, a OWASP Foundation Global Board of Directors officer,[13] on Twitter[7] that the board had voted for renaming from the Open Web Application Security Project to its current name, replacing Web with Worldwide.

Publications and resources

  • OWASP Top Ten: The "Top Ten", first published in 2003, is regularly updated.[14] It aims to raise awareness about application security by identifying some of the most critical risks facing organizations.[15][16][17] Many standards, books, tools, and many organizations reference the Top 10 project, including MITRE, PCI DSS,[18] the Defense Information Systems Agency (DISA-STIG), and the United States Federal Trade Commission (FTC),[19][20]
  • OWASP Software Assurance Maturity Model: The Software Assurance Maturity Model (SAMM) project's mission is to provide an effective and measurable way for all types of organizations to analyze and improve their software security posture. A core objective is to raise awareness and educate organizations on how to design, develop, and deploy secure software through a flexible self-assessment model. SAMM supports the complete software lifecycle and is technology and process agnostic. The SAMM model is designed to be evolutive and risk-driven in nature, acknowledging there is no single recipe that works for all organizations.[21]
  • OWASP Development Guide: The Development Guide provides practical guidance and includes J2EE, ASP.NET, and PHP code samples. The Development Guide covers an extensive array of application-level security issues, from SQL injection through modern concerns such as phishing, credit card handling, session fixation, cross-site request forgeries, compliance, and privacy issues.
  • OWASP Testing Guide: The OWASP Testing Guide includes a "best practice" penetration testing framework that users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues. Version 4 was published in September 2014, with input from 60 individuals.[22]
  • OWASP Code Review Guide: The code review guide is currently at release version 2.0, released in July 2017.
  • OWASP Application Security Verification Standard (ASVS): A standard for performing application-level security verifications.[23]
  • OWASP XML Security Gateway (XSG) Evaluation Criteria Project.[24]
  • OWASP Top 10 Incident Response Guidance. This project provides a proactive approach to Incident Response planning. The intended audience of this document includes business owners to security engineers, developers, audit, program managers, law enforcement & legal council.[25]
  • OWASP ZAP Project: The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience including developers and functional testers who are new to penetration testing.
  • Webgoat: a deliberately insecure web application created by OWASP as a guide for secure programming practices.[2] Once downloaded, the application comes with a tutorial and a set of different lessons that instruct students how to exploit vulnerabilities with the intention of teaching them how to write code securely.
  • OWASP AppSec Pipeline: The Application Security (AppSec) Rugged DevOps Pipeline Project is a place to find information needed to increase the speed and automation of an application security program. AppSec Pipelines take the principles of DevOps and Lean and applies that to an application security program.[26]
  • OWASP Automated Threats to Web Applications: Published July 2015[27] – the OWASP Automated Threats to Web Applications Project aims to provide definitive information and other resources for architects, developers, testers and others to help defend against automated threats such as credential stuffing. The project outlines the top 20 automated threats as defined by OWASP.[28]
  • OWASP API Security Project: focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs). Includes the most recent list API Security Top 10 2023.[29]

Certifications

They have several certification schemes to certify the knowledge of students in particular areas of security.

Security Fundamentals

Baseline set of security standards applicable across technology stacks teaching learners about the OWASP top ten vulnerabilities.[30]

Awards

The OWASP organization received the 2014 Haymarket Media Group SC Magazine Editor's Choice award.[9][41]

See also

References

  1. ^ "OWASP FOUNDATION INC". Nonprofit Explorer. ProPublica. May 9, 2013. Retrieved January 8, 2020.
  2. ^ a b c d Huseby, Sverre (2004). Innocent Code: A Security Wake-Up Call for Web Programmers. Wiley. p. 203. ISBN 0470857447.
  3. ^ "OWASP Foundation Staff". OWASP. February 12, 2023. Retrieved May 3, 2022.
  4. ^ "OWASP Foundation Global Board". OWASP. February 14, 2023. Retrieved March 20, 2023.
  5. ^ "OWASP Foundation's Form 990 for fiscal year ending Dec. 2017". October 26, 2018. Retrieved January 8, 2020 – via ProPublica Nonprofit Explorer.
  6. ^ "OWASP Foundation's Form 990 for fiscal year ending Dec. 2020". October 29, 2021. Retrieved January 18, 2023 – via ProPublica Nonprofit Explorer.
  7. ^ a b Corry, Bil [@bilcorry] (February 25, 2023). "A change you might notice about @owasp , the Board voted to change the "W" from "Web" to "Worldwide", making it the "Open Worldwide Application Security Project"" (Tweet). Retrieved July 7, 2024 – via Twitter.
  8. ^ "OWASP top 10 vulnerabilities". developerWorks. IBM. April 20, 2015. Retrieved November 28, 2015.
  9. ^ a b "SC Magazine Awards 2014" (PDF). Media.scmagazine.com. Archived from the original (PDF) on September 22, 2014. Retrieved November 3, 2014.
  10. ^ "OWASP Internet of Things". Retrieved December 26, 2023.
  11. ^ "Board". OWASP. Archived from the original on September 16, 2017. Retrieved February 27, 2015.
  12. ^ "OWASP Europe". OWASP. Archived from the original on April 17, 2016. Retrieved July 7, 2024.
  13. ^ "Global Board". owasp.org. Archived from the original on April 29, 2024. Retrieved July 7, 2024.
  14. ^ "OWASP Top Ten". owasp.org. Archived from the original on July 6, 2024. Retrieved July 7, 2024.
  15. ^ Trevathan, Matt (October 1, 2015). "Seven Best Practices for Internet of Things". Database and Network Journal. Archived from the original on November 28, 2015.
  16. ^ Crosman, Penny (July 24, 2015). "Leaky Bank Websites Let Clickjacking, Other Threats Seep In". American Banker. Archived from the original on November 28, 2015.
  17. ^ Pauli, Darren (December 4, 2015). "Infosec bods rate app languages; find Java 'king', put PHP in bin". The Register. Retrieved December 4, 2015.
  18. ^ "Payment Card Industry (PCI) Data Security Standard" (PDF). PCI Security Standards Council. November 2013. p. 55. Retrieved December 3, 2015.
  19. ^ "Open Web Application Security Project Top 10 (OWASP Top 10)". Knowledge Database. Synopsys. Synopsys, Inc. 2017. Retrieved July 20, 2017. Many entities including the PCI Security Standards Council, National Institute of Standards and Technology (NIST), and the Federal Trade Commission (FTC) regularly reference the OWASP Top 10 as an integral guide for mitigating Web application vulnerabilities and meeting compliance initiatives.
  20. ^ "Authorization remains #1 issue – OWASP 2023 Top 10 List". Cerbos. Retrieved September 2, 2024.
  21. ^ "What is OWASP SAMM?". OWASP SAMM. Retrieved November 6, 2022.
  22. ^ Pauli, Darren (September 18, 2014). "Comprehensive guide to obliterating web apps published". The Register. Retrieved November 28, 2015.
  23. ^ Baar, Hans; Smulters, Andre; Hintzbergen, Juls; Hintzbergen, Kees (2015). Foundations of Information Security Based on ISO27001 and ISO27002 (3 ed.). Van Haren. p. 144. ISBN 9789401800129.
  24. ^ "Category:OWASP XML Security Gateway Evaluation Criteria Project Latest". Owasp.org. Archived from the original on November 3, 2014. Retrieved November 3, 2014.
  25. ^ "OWASP Incident Response Project – OWASP". Archived from the original on April 6, 2019. Retrieved December 12, 2015.
  26. ^ "OWASP AppSec Pipeline". Open Web Application Security Project (OWASP). Archived from the original on January 18, 2020. Retrieved February 26, 2017.
  27. ^ "AUTOMATED THREATS to Web applications" (PDF). OWASP. July 2015.
  28. ^ "OWASP Automated Threats to Web Applications". owasp.org. Archived from the original on June 29, 2024. Retrieved July 7, 2024.
  29. ^ "OWASP API Security Project – OWASP Foundation". OWASP.
  30. ^ "qa.com | Certified OWASP Security Fundamentals (QAOWASPF)". www.qa.com. Retrieved October 25, 2024.
  31. ^ "A01 Broken Access Control – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  32. ^ "A02 Cryptographic Failures – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  33. ^ "A03 Injection – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  34. ^ "A04 Insecure Design – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  35. ^ "A05 Security Misconfiguration – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  36. ^ "A06 Vulnerable and Outdated Components – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  37. ^ "A07 Identification and Authentication Failures – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  38. ^ "A08 Software and Data Integrity Failures – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  39. ^ "A10 Server Side Request Forgery (SSRF) – OWASP Top 10:2021". owasp.org. Retrieved October 25, 2024.
  40. ^ "Server Side Request Forgery Prevention – OWASP Cheat Sheet Series". cheatsheetseries.owasp.org. Retrieved December 13, 2024.
  41. ^ "Winners | SC Magazine Awards". Awards.scmagazine.com. Archived from the original on August 20, 2014. Retrieved July 17, 2014. Editor's Choice [...] Winner: OWASP Foundation

Read other articles:

Pecheneg

Tempat pemukiman Pecheneg 1015. Pecheneg atau Patzinaks (Turkish: Peçenek(ler)code: tr is deprecated , Hongaria: Besenyő(k)code: hu is deprecated , bahasa Yunani: Πατζινάκοι, Πετσενέγοι, Πατζινακίται, Latin: Pacinacae, Bissenicode: la is deprecated ) adalah bangsa Turkik semi-nomaden di Asia Tengah. Mereka menuturkan bahasa Pecheneg, yang masuk ke dalam rumpun bahasa Turkik. Pranala luar Wikimedia Commons memiliki media mengenai Pechenegs. www.patzinakia....

 

 

Minamidaitōjima

For the administrative unit, see Minamidaitō, Okinawa. Island within Ryukyu Islands MinamidaitōjimaNative name: 南大東島 Minamidaitō-jimaAerial Photograph of MinamidaitōjimaGeographyLocationPhilippine SeaCoordinates25°50′N 131°14′E / 25.833°N 131.233°E / 25.833; 131.233ArchipelagoDaitō IslandsArea30.57 km2 (11.80 sq mi)Length4.85 km (3.014 mi)Coastline18.3 km (11.37 mi)Highest elevation75 m (246 ft)Admi...

 

 

Innsbruck Airport

Airport in Innsbruck, Austria Innsbruck AirportFlughafen InnsbruckIATA: INNICAO: LOWISummaryOwnerTiroler Flughafenbetriebs GmbHServesInnsbruck, AustriaElevation AMSL1,906 ft / 581 mCoordinates47°15′37″N 011°20′38″E / 47.26028°N 11.34389°E / 47.26028; 11.34389Websiteinnsbruck-airport.comMapINNLocation within AustriaRunways Direction Length Surface ft m 08/26 6,562 2,000 Asphalt Statistics (2021)Passengers125,495Aircraft movements2,010Cargo (in...

CBU-97 Sensor Fuzed Weapon

Artikel ini perlu diwikifikasi agar memenuhi standar kualitas Wikipedia. Anda dapat memberikan bantuan berupa penambahan pranala dalam, atau dengan merapikan tata letak dari artikel ini. Untuk keterangan lebih lanjut, klik [tampil] di bagian kanan. Mengganti markah HTML dengan markah wiki bila dimungkinkan. Tambahkan pranala wiki. Bila dirasa perlu, buatlah pautan ke artikel wiki lainnya dengan cara menambahkan [[ dan ]] pada kata yang bersangkutan (lihat WP:LINK untuk keterangan lebih lanjut...

 

 

Morgan Freeman

American actor and producer (born 1937) For the director, see Morgan J. Freeman. Morgan FreemanFreeman in 2023Born (1937-06-01) June 1, 1937 (age 86)Memphis, Tennessee, U.S.OccupationsActorproducernarratorYears active1964–presentOrganizationRevelations EntertainmentWorksFull listSpouses Jeanette Adair Bradshaw ​ ​(m. 1967; div. 1979)​ Myrna Colley-Lee ​ ​(m. 1984; div. 2010)​Children4Aw...

 

 

Injection well

Deep injection well for disposal of hazardous, industrial and municipal wastewater; a Class I well under USEPA regulations.[1] An injection well is a device that places fluid deep underground into porous rock formations, such as sandstone or limestone, or into or below the shallow soil layer. The fluid may be water, wastewater, brine (salt water), or water mixed with industrial chemical waste.[1] Definition The U.S. Environmental Protection Agency (EPA) defines an injection we...

Aldosterone

Mineralocorticoid steroid hormone Aldosterone Skeletal formula of the fictitious aldehyde form[1] Ball-and-stick model of the 18-acetal-20-hemiketal form based on crystallography[2][3] Names IUPAC name 11β,21-Dihydroxy-3,20-dioxopregn-4-en-18-al Systematic IUPAC name (1S,3aS,3bS,9aR,9bS,10S,11aR)-10-Hydroxy-1-(hydroxyacetyl)-9a-methyl-7-oxo-1,2,3,3a,3b,4,5,7,8,9,9a,9b,10,11-tetradecahydro-11aH-cyclopenta[a]phenanthrene-11a-carbaldehyde Other names Aldocorten; Aldocort...

 

 

Ward No. 136, Kolkata Municipal Corporation

Kolkata Municipal Corporation in West Bengal, IndiaWard No. 136Kolkata Municipal CorporationInteractive Map Outlining Ward No. 136Ward No. 136Location in KolkataCoordinates: 22°32′23″N 88°16′54″E / 22.539806°N 88.281556°E / 22.539806; 88.281556Country IndiaStateWest BengalCityKolkataNeighbourhoodsGarden Reach (Metiabruz)ReservationOpenParliamentary constituencyDiamond HarbourAssembly constituencyMetiaburuzBorough15Government • TypeMayor-Co...

 

 

Maultasche

MaultaschenJenisPastaTempat asalGermanyBahan utamaPasta dough, minced meat, smoked meat, spinach, bread crumbs, onionsSunting kotak info • L • BBantuan penggunaan templat ini  Media: Maultaschen Maultaschen (singular Maultascheⓘ) adalah makanan utama di kawasan Jerman. lbsPastaJenis Acini di pepe • Agnolotti • Anelli • Anellini • Barli telur • Bigoli • Bucatini • C...

André-Jean Festugière

André-Jean FestugièreAndré Jean Festugière dans la notice nécrologique écrite par Ernst Vogt dans Sonderdruck aus dem Jahrbuch des Bayerischen Akademie des Wissenschaften 1983BiographieNaissance 15 mars 18988e arrondissement de ParisDécès 13 août 1982 (à 84 ans)Saint-DizierNom de naissance Jean Paul Philippe FestugièreNationalité françaiseFormation École normale supérieure (1918-1920)École pratique des hautes études (1932-1936)Lycée Louis-le-Grand de ParisCollège Stani...

 

 

2020年夏季奧林匹克運動會羽毛球混合雙打比賽

第三十二届夏季奥林匹克运动会羽毛球混合雙打比賽比賽場館武藏野之森綜合體育廣場日期2021年7月24日至7月30日参赛选手32（16對組合）位選手，來自15個國家和地區奖牌获得者01 ! 王懿律黃東萍  中国02 ! 鄭思維黃雅瓊  中国03 ! 渡邊勇大東野有紗  日本← 2016 里約熱內盧2024 巴黎 → 2020年夏季奧林匹克運動會羽毛球比賽 參賽資格 單打   男...

 

 

Post office

Customer service facility of a postal system Posting house redirects here. For other uses, see Post House (disambiguation). For national postal networks, sometimes called the Post Office, see Mail. For other uses, see Post Office (disambiguation). A post office building in Edithburgh, Australia The West Toledo Branch Post Office in Toledo, Ohio, in 1912 A post office is a public facility and a retailer that provides mail services, such as accepting letters and parcels, providing post office b...

Tongue

Muscular organ in the mouth of most vertebrates For other uses, see Tongue (disambiguation). TongueThe human tongueDetailsPrecursorPharyngeal arches, lateral lingual swelling, tuberculum impar[1]SystemAlimentary tract, gustatory systemArteryLingual, tonsillar branch, ascending pharyngealVeinLingualNerveSensoryAnterior two-thirds: Lingual (sensation) and chorda tympani (taste)Posterior one-third: Glossopharyngeal (IX)MotorHypoglossal (XII), except palatoglossus muscle supplied by the p...

 

 

Mathieu Eugene

American politician Mathieu EugeneMember of the New York City Councilfrom the 40th districtIn officeApril 25, 2007 – December 31, 2021Preceded byYvette ClarkeSucceeded byRita Joseph Personal detailsBorn (1953-04-26) April 26, 1953 (age 71)Cap-Haïtien, HaitiPolitical partyDemocraticWebsiteOfficial website Mathieu Eugene (born April 26, 1953) is a Haitian-American politician. A Democrat, he was a New York City Councilmember for the 40th district, and was the first Haitian-born ...

 

 

Continental Indoor Football League

US indoor football league Continental Indoor Football LeagueMost recent season or competition:2014 Continental Indoor Football League seasonContinental Indoor Football League logoFormerlyOhio-Penn Indoor Football LeagueGreat Lakes Indoor Football LeagueSportIndoor footballFounded2005FounderEric SpitaleriJeff SpitaleriCory TrappFirst season2006Owner(s)Stuart SchweigertJim O'BrienRob LichtCountryUnited StatesMost recentchampion(s)Erie Explosion (2nd title)Most titlesCincinnati CommandosErie Exp...

Pinto Aceh

Pinto Aceh Pinto Aceh atau Pinto Khob adalah ragam hias atau motif khas Aceh yang terkenal. Ragam hias pinto aceh tidak hanya diterapkan pada kain atau batik, tetapi juga dalam bentuk benda-benda cendera mata lainnya, seperti tas, pin atau bros, liontin, dan pada buah tangan dalam bentuk lainnya.[1] Meskipun pada awalnya motif perhiasan Pinto Aceh hanya diciptakan untuk bros jenis perhiasan dada kaum perempuan, tetapi penerapannya kian beragam seiring waktu.[2] Sejarah Ragam h...

 

 

Falun

Letak Falun di Swedia Untuk aliran spiritual, lihat Falun Gong. Falun merupakan nama kota di Swedia. Letaknya di bagian tengah. Penduduknya berjumlah 35.000 jiwa (2005). Falun juga merupakan ibu kota Daerah Dalarna. La Grande mine de cuivre à Falun, patrimoine mondial Östanforsån à Falun.Kristinegymnasiet (Lycée de Christine) à Falun Artikel bertopik geografi atau tempat Swedia ini adalah sebuah rintisan. Anda dapat membantu Wikipedia dengan mengembangkannya.lbs

 

 

الجمعية الملكية

  الجمعية الملكية الجمعية الملكية‌   البلد المملكة المتحدة[1]  المقر الرئيسي لندن  تاريخ التأسيس نوفمبر 1660  العضوية أورسيد  [لغات أخرى]‏[2][3]  الرئيس أدريان سميث  [لغات أخرى]‏ (30 نوفمبر 2020–)[4]  المالية إجمالي الإيرادات 111693000 ج�...

Dora Pejačević

Croatian composer (1885–1923) Portrait of Dora Pejačević Countess Maria Theodora Paulina Dora Pejačević (Hungarian: Gróf verőczei Pejácsevich Mária Theodóra Paulina Dóra; 10 September 1885 – 5 March 1923) was a Croatian composer, pianist and violinist and one of the first composers to introduce the orchestral song to Croatian music.[1][2] Her Symphony in F-sharp minor is considered by scholars to be the first modern symphony in Croatian music.[3] Pejačev...

 

 

Gereja Katolik di Togo

Bagian dari seriGereja Katolik menurut negara Afrika Afrika Selatan Afrika Tengah Aljazair Angola Benin Botswana Burkina Faso Burundi Chad Eritrea Eswatini Etiopia Gabon Gambia Ghana Guinea Guinea-Bissau Guinea Khatulistiwa Jibuti Kamerun Kenya Komoro Lesotho Liberia Libya Madagaskar Malawi Mali Maroko Mauritania Mauritius Mesir Mozambik Namibia Niger Nigeria Pantai Gading Republik Demokratik Kongo Republik Kongo Rwanda Sao Tome dan Principe Senegal Seychelles Sierra Leone Somalia Somaliland ...