3 ms·
Never heard of OWASP before Do programmers really follow it? Is it a status quo for companies to make sure their software follow OWASP top 10 like a checklist?
by kingofpee 7y ago
Never heard of OWASP before
Do programmers really follow it? Is it a status quo for companies to make sure their software follow OWASP top 10 like a checklist?
- statictype 7y agoYes. Its an important bullet point in RFPs for enterprise software.
- kingofpee 7y agoSo OWASP compliance is a thing as much as GDPR compliance in the enterprise world?
- ownagefool 7y agoNot really. GDRP results in major fines thus has major funding. OWASP is something someone might tack on, but most of the people involved have little to no ability to check.
- tptacek 7y agoNo. There is no such thing as OWASP certification. The only teeth OWASP "compliance" might have is a contractually agreed MUSTFIX disposition for vulnerabilities that are on the OWASP Top 10 (which would be pretty silly and is not something I've ever seen done).
- Jedi72 7y agoYes, I'm guessing you haven't ever Googled 'web app security' or similar.
- rtempaccount1 7y agoOWASP is a not-for-profit industry group not a governmental initiative. However it's generally the most used "standard" for web application security and some regulations will use OWASP projects as references for what things should be considered for security
- Nursie 7y agoWe use their dep check on java microservices, to make sure we're up to date on mitigations.