|Type||501(c)(3) Nonprofit organization|
|Focus||Web Security, Application Security, Vulnerability Assessment|
|Method||Industry standards, Conferences, Workshops|
|Martin Knobloch, Chair; Chenxi Wang, Co-Chair; Andrew van der Stock, Treasurer; Owen Pendlebury, Secretary; Matt Konda; Greg Anderson; Sherif Mansour|
|Karen Staley, Executive Director; Kelly Santalucia, Membership and Business Liaison; Laura Grau, Event Manager; Tiffany Long, Community Manager; Claudia Cassanovas, Project Coordinator; Dawn Aitken, Program Assistant|
The Open Web Application Security Project (OWASP), an online community, produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.
The OWASP Foundation, a 501(c)(3) non-profit organization (in the USA) established in 2004, supports the OWASP infrastructure and projects. Since 2011, OWASP is also registered as a non-profit organization in Belgium under the name of OWASP Europe VZW.
Publications and resources
- OWASP Top Ten: The "Top Ten", first published in 2003, is regularly updated. It aims to raise awareness about application security by identifying some of the most critical risks facing organizations. Many standards, books, tools, and organizations reference the Top 10 project, including MITRE, PCI DSS, Defense Information Systems Agency (DISA-STIG), the United States Federal Trade Commission (FTC), and many more.
- OWASP Software Assurance Maturity Model: The Software Assurance Maturity Model (SAMM) project is committed to building a usable framework to help organizations formulate and implement a strategy for application security that is tailored to the specific business risks facing the organization.
- OWASP Development Guide: The Development Guide provides practical guidance and includes J2EE, ASP.NET, and PHP code samples. The Development Guide covers an extensive array of application-level security issues, from SQL injection through modern concerns such as phishing, credit card handling, session fixation, cross-site request forgeries, compliance, and privacy issues.
- OWASP Testing Guide: The OWASP Testing Guide includes a "best practice" penetration testing framework that users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues. Version 4 was published in September 2014, with input from 60 individuals.
- OWASP Code Review Guide: The code review guide is currently at release version 1.1 and the second best selling OWASP book in 2008.
- OWASP Application Security Verification Standard (ASVS): A standard for performing application-level security verifications.
- OWASP XML Security Gateway (XSG) Evaluation Criteria Project.
- OWASP Top 10 Incident Response Guidance. This project provides a proactive approach to Incident Response planning. The intended audience of this document includes business owners to security engineers, developers, audit, program managers, law enforcement & legal council.
- OWASP ZAP Project: The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience including developers and functional testers who are new to penetration testing.
- Webgoat: a deliberately insecure web application created by OWASP as a guide for secure programming practices. Once downloaded, the application comes with a tutorial and a set of different lessons that instruct students how to exploit vulnerabilities with the intention of teaching them how to write code securely.
- OWASP AppSec Pipeline: The Application Security (AppSec) Rugged DevOps Pipeline Project is a place to find information needed to increase the speed and automation of an application security program. AppSec Pipelines take the principles of DevOps and Lean and applies that to an application security program.
- OWASP Automated Threats to Web Applications: Published July 2015, The OWASP Automated Threats to Web Applications Project aims to be a source of definitive information and other resources for architects, developers, testers and others to help defend against automated threats such as credential stuffing. The project outlines the top 20 automated threats as defined by OWASP.
- Huseby, Sverre (2004). Innocent Code: A Security Wake-Up Call for Web Programmers. Wiley. p. 203. ISBN 0470857447.
- "OWASP top 10 vulnerabilities". developerWorks. IBM. 20 April 2015. Retrieved 28 November 2015.
- "SC Magazine Awards 2014" (PDF). Media.scmagazine.com. Retrieved 3 November 2014.
- Curphey, Mark. "The Start of OWASP – A True Story - SourceClear". SRC:CLR. Retrieved 2014-07-17.
- Board Archived September 16, 2017, at the Wayback Machine.. OWASP. Retrieved on 2015-02-27.
- OWASP Europe, OWASP, 2016
- OWASP Top Ten Project on owasp.org
- Trevathan, Matt (1 October 2015). "Seven Best Practices for Internet of Things". Database and Network Journal. Retrieved 28 November 2015 – via – via HighBeam (subscription required).
- Crosman, Penny (24 July 2015). "Leaky Bank Websites Let Clickjacking, Other Threats Seep In". American Banker. Retrieved 28 November 2015 – via – via HighBeam (subscription required).
- Pauli, Darren (4 December 2015). "Infosec bods rate app languages; find Java 'king', put PHP in bin". The Register. Retrieved 4 December 2015.
- "Payment Card Industry (PCI) Data Security Standard" (PDF). PCI Security Standards Council. November 2013. p. 55. Retrieved 3 December 2015.
"Open Web Application Security Project Top 10 (OWASP Top 10)". Knowledge Database. Synopsys. Synopsys, Inc. 2017. Retrieved 2017-07-20.
Many entities including the PCI Security Standards Council, National Institute of Standards and Technology (NIST), and the Federal Trade Commission (FTC) regularly reference the OWASP Top 10 as an integral guide for mitigating Web application vulnerabilities and meeting compliance initiatives.
- Pauli, Darren (18 September 2014). "Comprehensive guide to obliterating web apps published". The Register. Retrieved 28 November 2015.
- Baar, Hans; Smulters, Andre; Hintzbergen, Juls; Hintzbergen, Kees (2015). Foundations of Information Security Based on ISO27001 and ISO27002 (3 ed.). Van Haren. p. 144. ISBN 9789401800129.
- "Category:OWASP XML Security Gateway Evaluation Criteria Project Latest". Owasp.org. Retrieved November 3, 2014.
- "OWASP AppSec Pipeline". Open Web Application Security Project (OWASP). Retrieved 26 February 2017.
- "AUTOMATED THREATS to Web applications" (PDF). OWASP. July 2015.
- The list of automated threat events
"Winners | SC Magazine Awards". Awards.scmagazine.com. Archived from the original on August 20, 2014. Retrieved 2014-07-17.
Editor's Choice [...] Winner: OWASP Foundation