6

Consequently to this post - OWASP Conference Sponsorship - SEI has graciously agreed to not only sponsor the conference, but to become full OWASP Corporate Members too!

According to the membership terms, SEI can allocate an additional 20% of the membership fees to one of the many OWASP projects (all opensource, of course).

The question is, which project is the best choice?

The one thing I currently have no input on (if anyone has any, it would be wonderful to add here) is the specific financial needs of each project (i.e. what a specific project would specifically do with the cash).

Taking into consideration:

  • alignment with SEI goals and values
  • alignment with ITsec's membership
  • a project that SEI is likely to use internally (or already uses).
  • a project that could be recommended to our users...
  • specific financial needs of each project

I will add some of my own ideas, and those that I have heard around, but please add your own ideas and favorites - and vote up those that you deem most worthy!

Link to the OWASP Projects page.

Note: there are additional projects in Beta and Alpha status.

3
  • 2
    Brilliant news on the sponsorship, and kudos to @RobertCartaino and the folks at SEI!
    – Rory Alsop Mod
    Aug 25, 2011 at 14:16
  • 2
    I think it would be helpful to come up with some criteria to make the selection. My first though is the project should be as related and useful to IT Security as possible.
    – this.josh
    Aug 25, 2011 at 17:28
  • @this.josh I agree, I mentioned some criteria already in the question, if you have anything to add please do so! (though it is possible that everybody would have their own, personal criteria...) Also, most all OWASP projects are implicitly IT Security related... ;-)
    – AviD Mod
    Aug 25, 2011 at 17:53

8 Answers 8

Reset to default
6

ESAPI

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development.

With ports into most modern languages, ESAPI is really a swiss army knife for security functionality. Input validation, encodings, cryptography, authentication, authorization... pretty much most of what a typical programmer would need to meet most common security requirements, its all there in a single library.

3
  • darnit - you were 11 seconds faster than me:-)
    – Rory Alsop Mod
    Aug 25, 2011 at 14:20
  • Doesnt count - Im answering inline with asking :)
    – AviD Mod
    Aug 25, 2011 at 14:27
  • 1
    I am also voting for this one. I might even use it on our next project!
    – user2213
    Aug 25, 2011 at 18:58
4

WebGoat

WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson.

While there are already better solutions for this, I am adding it since I have received enormous benefits from WebGoat in the past, teaching scores of programmers about web attacks thanks to this.

1
  • 1
    As a programmer, I think there's nothing better than examples of exploits to say "look, if you build your code like this, this happens, and that's not very good" so I vote for this one. +1
    – user2213
    Aug 25, 2011 at 18:55
3

ModSecurity Core Rule Set (CRS)

ModSecurity™ is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity™ must be configured with rules. In order to enable users to take full advantage of ModSecurity™ out of the box, Trustwave's SpiderLabs is providing a free certified rule set for ModSecurity™ 2.x. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the Core Rules provide generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded. The Core Rules are heavily commented to allow it to be used as a step-by-step deployment guide for ModSecurity™.

While this is not something I personally deal with a lot, there have been a few questions on this:
And I'm sure most sys-admins would appreciate having a more complete ruleset out of the box....

2

One of the automated code review projects (I dont know enough about most of them, with the exception of O2, to know which are good):

  • O2 - formerly an addon/plugin to Ounce Labs commercial product, since cut loose once IBM acquired the company... very powerful and customizable (my vote for this one).

    The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews.
    O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge

  • Orizon -

    The OWASP Orizon project was created with the aim of providing a common ground for safe coding and code review methodologies to be applied to software. The project is approaching its first major release and it will be able to be used in a production environment in the near future.

  • Code Crawler -

    A tool aimed at assisting code review practitioners. It is a static code review tool which searches for key topics within .NET and J2EE/JAVA code. It's a Microsoft .NET 3.5 Windows Form application which supports the OWASP Code Review Project. It provides automatic STRIDE classification a very simple DREAD calculator and few minor utilities. Direct links to WAST 2.0 Threat Classification, Secure Java Development Guidelines and OWASP Tools are also part of the package.

2

ASVS would be another useful one

The primary aim of the OWASP Application Security Verification Standard (ASVS) Project is to normalize the range in the coverage and level of rigor available in the market when it comes to performing Web application security verification using a commercially-workable open standard`.

0
2

The OWASP Top Ten Project

The OWASP Top Ten represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.

1

AppSensor

The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into an existing application. Current efforts are underway to create the AppSensor tool which can be utilized by any existing application interested in adding detection and response capabilities.

Basically this is an application-based IDS/IPS.
I think this is a brilliant idea, but have yet to personally see it fully implemented....

1

OWASP Podcasts project

The OWASP foundation presents the OWASP PODCAST SERIES hosted and produced by Jim Manico. Listen as Jim interviews OWASP volunteers, industry experts and leaders within the field of web application security.

This is an awareness project, and it of course has real expenses - they are actually in deficit right now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .