Copyright © - The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License.

The OWASP Foundation

OWASP

http://www.owasp.org

OWASP Overview

Pete PerfettiNY-NJ Metro Committee MemberPeter.Perfetti@owasp.org

OWASP 2

Agenda

OWASP Introduction OWASP Project Parade OWASP Near You?

OWASP 3

Agenda

OWASP Introduction OWASP Project Parade OWASP Near You?

OWASP 4

OWASP

The Open Web Application Security Project (OWASP)

International not-for-profit charitable Open Source organization funded primarily by volunteers time, OWASP Memberships, and OWASP Conference fees

Participation in OWASP is free and open to all

OWASP 5

OWASP Mission

to make application security "visible," so that people and organizations can make informed decisions about application security risks

OWASP 6

OWASP Mission

Through Research Grants and Funding, “Make People Aware of The Real Threat”

OWASP 7

OWASP MissionMake people and

organizations “AWARE” that security does not end after the test!

OWASP

OWASP Resources and Community

OWASP 99

www.owasp.org

OWASP

130+ Chapters Worldwide

10

OWASP

OWASP Conferences (2008-2009)

11

NYCSep 2008

NYCSep 2008

San Jose?Sep 2009San Jose?Sep 2009

BrusselsMay 2008BrusselsMay 2008 Poland

May 2009Poland

May 2009

TaiwanOct 2008Taiwan

Oct 2008

PortugalNov 2008PortugalNov 2008 Israel

Sep 2008Israel

Sep 2008

IndiaAug 2008

IndiaAug 2008

Gold CoastFeb 2008

+2009

Gold CoastFeb 2008

+2009

MinnesotaOct 2008

MinnesotaOct 2008

DenverSpring 2009

DenverSpring 2009

GermanyNov 2008GermanyNov 2008

OWASP

Summit Portugal

2009 Focus80+ application security experts from 20+

countries

New Free Tools and Guidance (SoC08) New Outreach Program

technology vendors, framework providers, and standards bodies

new program to provide free one- day seminars at universities and developer conferences worldwide

New Global Committee StructureEducation, Chapter, Conferences, Industry,

Projects and Tools, Membership12

OWASP 13

Agenda

OWASP Introduction OWASP Project Parade OWASP Near You?

OWASP

OWASP Projects: Improve Quality and Support

Define Criteria for Quality Levels Alpha, Beta, Release

Encourage Increased Quality Through Season of Code Funding and Support Produce Professional OWASP books

Provide Support Full time executive director (Kate Hartmann) Full time project manager (Paulo Coimbra) Half time technical editor (Kirsten Sitnick) Half time financial support (Alison Shrader) Looking to add programmers (Interns and professionals)

OWASP 15

OWASP Top 10

The Ten Most Critical Web Application Security Vulnerabilities

2007 Release A great start, but not

a standard 3rd version of theTop

10 2009 coming soon

OWASP 16

Key Application Security Vulnerabilities

www.owasp.org/index.php?title=Top_10_2007

OWASP

The ‘Big 4’ Documentation Projects

Building Guide

Building Guide

Code Review Guide

Code Review Guide

Testing Guide

Testing Guide

Application Security Desk Reference (ASDR)

OWASP

The Guide

Complements OWASP Top 10

310p Book Free and open source

Gnu Free Doc License Many contributors Apps and web services Most platforms

Examples are J2EE, ASP.NET, and PHP

Comprehensive Project Leader and

Editor Andrew van der Stock,

vanderaj@owasp.org

OWASP

Uses of the Guide

DevelopersUse for guidance on implementing security

mechanisms and avoiding vulnerabilities

Project ManagersUse for identifying activities (threat modeling,

code review, penetration testing) that need to occur

Security TeamsUse for structuring evaluations, learning about

application security, remediation approaches

OWASP

Each Topic

Includes Basic Information (like OWASP T10) How to Determine If You Are Vulnerable How to Protect Yourself

Adds Objectives Environments Affected Relevant COBIT Topics Theory Best Practices Misconceptions Code Snippets

OWASP 21

Testing Guide v2: Index

1. Frontispiece1. Frontispiece

2. Introduction2. Introduction

3. The OWASP Testing Framework 3. The OWASP Testing Framework

4. Web Application Penetration Testing 4. Web Application Penetration Testing

5. Writing Reports: value the real risk 5. Writing Reports: value the real risk

Appendix A: Testing ToolsAppendix A: Testing Tools

Appendix B: Suggested ReadingAppendix B: Suggested Reading

Appendix C: Fuzz Vectors Appendix C: Fuzz Vectors

Version 3.0 Released TODAY !! Check your emailVersion 3.0 Released TODAY !! Check your email

OWASP 22

What Is the OWASP Testing Guide?

Information GatheringBusiness Logic TestingAuthentication TestingSession Management TestingData Validation TestingDenial of Service TestingWeb Services TestingAjax Testing

Testing PrinciplesTesting ProcessCustom Web Applications

Black Box TestingGrey Box Testing

Risk and ReportingAppendix: Testing ToolsAppendix: Fuzz Vectors

OWASP

Soc08 version 3 Improve version 2

improved 9 articles Total of 10 Testing categories

and 66 controls. New sections and controls

Configuration Management Authorization Testing 36 new articles

New Encoded Injection Appendix;

OWASP 24

How the Guide helps the security industry

A structured approach to the testing activities

A checklist to be followed A learning and training tool

Testers

A tool to understand web vulnerabilities and their impact

A way to check the quality of security tests

Organisations

More generally, the Guide aims to provide a pen-testing standard that creates a 'common ground' between the testing groups and its

‘customers’.

This will raise the overall quality and understanding of this kind of activity and therefore the general level of security of our

applications

OWASP

Tools

http://www.owasp.org/index.php/Phoenix/Tools

Best known OWASP ToolsWebGoatWebScarab

Remember:A Fool with a Tool is still a Fool

OWASP 26

Tools – At Best 45%

MITRE found that all application security tool vendors’ claims put together cover only 45% of the known vulnerability types (over 600 in CWE)

They found very little overlap between tools, so to get 45% you need them all (assuming their claims are true)

OWASP

OWASP WebGoat

27

OWASP

OWASP WebScarab

28

OWASP

OWASP CSRFTester

29

OWASP

OWASP CSRFGuard 2.0

30

Adds token to: href attribute src attribute hidden field in all

forms

Actions: Log Invalidate Redirect

http://www.owasp.org/index.php/CSRFGuard

OWASP

The OWASP Enterprise Security API

31

OWASP

Coverage

OWASP

Create Your ESAPI Implementation

Your Security ServicesWrap your existing libraries and servicesExtend and customize your ESAPI

implementationFill in gaps with the reference implementation

Your Coding GuidelineTailor the ESAPI coding guidelinesRetrofit ESAPI patterns to existing code

33

OWASP

OWASP CLASP

Comprehensive, Lightweight Application Security ProcessPrescriptive and ProactiveCentered around 7 AppSec

Best PracticesCover the entire software

lifecycle (not just development)

34

Adaptable to any development process CLASP defines roles across the SDLC 24 role-based process components Start small and dial-in to your needs

OWASP 35

The CLASP Best Practices

1. Institute awareness programs2. Perform application assessments3. Capture security requirements4. Implement secure development practices5. Build vulnerability remediation

procedures6. Define and monitor metrics7. Publish operational security guidelines

OWASP 36

OW

ASP Fram

ework

SDLC & OWASP Guidelines

OWASP

Want More ?

OWASP .NET Project OWASP ASDR Project OWASP AntiSamy Project OWASP AppSec FAQ Project OWASP Application Security Assessment Standards

Project OWASP Application Security Metrics Project OWASP Application Security Requirements Project OWASP CAL9000 Project OWASP CLASP Project OWASP CSRFGuard Project OWASP CSRFTester Project OWASP Career Development Project OWASP Certification Criteria Project OWASP Certification Project OWASP Code Review Project OWASP Communications Project OWASP DirBuster Project OWASP Education Project OWASP Encoding Project OWASP Enterprise Security API OWASP Flash Security Project OWASP Guide Project OWASP Honeycomb Project OWASP Insecure Web App Project OWASP Interceptor Project

OWASP JBroFuzz OWASP Java Project OWASP LAPSE Project OWASP Legal Project OWASP Live CD Project OWASP Logging Project OWASP Orizon Project OWASP PHP Project OWASP Pantera Web Assessment Studio Project OWASP SASAP Project OWASP SQLiX Project OWASP SWAAT Project OWASP Sprajax Project OWASP Testing Project OWASP Tools Project OWASP Top Ten Project OWASP Validation Project OWASP WASS Project OWASP WSFuzzer Project OWASP Web Services Security Project OWASP WebGoat Project OWASP WebScarab Project OWASP XML Security Gateway Evaluation Criteria

Project OWASP on the Move Project

37

OWASP

SoC2008 selection OWASP Code review guide, V1.1 The Ruby on Rails Security Guide v2 OWASP UI Component Verification Project (a.k.a.

OWASP JSP Testing Tool) Internationalization Guidelines and OWASP-

Spanish Project OWASP Application Security Desk Reference

(ASDR) OWASP .NET Project Leader OWASP Education Project The OWASP Testing Guide v3 OWASP Application Security Verification

Standard Online code signing and integrity verification

service for open source community (OpenSign Server)

Securing WebGoat using ModSecurity OWASP Book Cover & Sleeve Design OWASP Individual & Corporate Member Packs,

Conference Attendee Packs Brief OWASP Access Control Rules Tester OpenPGP Extensions for HTTP - Enigform and

mod_openpgp OWASP-WeBekci Project OWASP Backend Security Project

38

OWASP Application Security Tool Benchmarking Environment and Site Generator refresh

Teachable Static Analysis Workbench OWASP Positive Security Project GTK+ GUI for w3af project OWASP Interceptor Project - 2008 Update Skavenger SQL Injector Benchmarking Project (SQLiBENCH) OWASP AppSensor - Detect and Respond to

Attacks from Within the Application Owasp Orizon Project OWASP Corporate Application Security Rating

Guide OWASP AntiSamy .NET Python Static Analysis OWASP Classic ASP Security Project OWASP Live CD 2008 Project

OWASP 39

OWASP Projects Are Alive!

2001

2003

2005

2007

2009 …

OWASP 40

Agenda

OWASP Introduction OWASP Project Parade OWASP Near You?

OWASP

www.owasp.tv56 videos - 40 h

41

OWASP

Upcoming Conferences

February 2009 - Day 3 Italy OWASP Day III: "Web Application Security: research meets industry" 23rd February 2009 - Bari (Italy)

February 2009 - OWASP AppSec Australia 2009 - Gold Coast Training & Conference, Gold Coast Convention Center, QLD Australia

March 2009 - OWASP Front Range Conference March 5th, 2nd Annual 1-Day Conference in Denver, Colorado

May 2009 - OWASP AppSec Europe 2009 Poland May 11th - 14th - Conference and Training, Qubus

Hotel, Krakow, Poland Back to back with Confidence09

June 2009 - OWASP AppSec - Dublin Ireland October 2009 - OWASP AppSec US 2009 - Washington, D.C.

42

OWASP

NY/NJ Metro Chapter

Meetings Local Mailing List Presentations & Groups Open forum for discussion Meet fellow InfoSec professionals Create (Web)AppSec awareness Local projects?

OWASP 44

Subscribe to local chapter mailing list

Find your local chapter at www.owasp.org Post your (Web)AppSec questions Keep up to date! Get OWASP news letters Contribute to discussions!

OWASP 45

Thank you for your time

Any Questions?

www.owasp.org