10 ms·

I think most should be actually checking the "OWASP Application Security Verification Standard Project" [1] instead of just the Top 10 list. The application se

I think most should be actually checking the "OWASP Application Security Verification Standard Project" [1] instead of just the Top 10 list. The application security verification standard has quite clear requirements that you can just feed into your software development process. The requirements are split to three different levels, L1, L2 and L3. L1 requirements are more or less straightforward, standard application development stuff. L2 and L3 go more into processes. The idea is also that the L1 requirements can be verified by external penetration testing, without access to source code. I would say the L1 requirements are something everybody involved in creating web apps professionally should check. Maybe some the requirements don't make sense for your particular application, but for those cases it is a good exercise to write down why not. [1] https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project https://www.owasp.org/index.php/Category:OWASP_Application_S... (the document can be downloaded from the links on the right side)

lol768 7y ago
ASVS is a good idea, but it has forever lost its credibility for me after the following recommendation appeared in one of its published documents (2.13 I believe, level 1 ASVSv3): >Verify that account passwords make use of a sufficient strength encryption routine and that it withstands brute force attack against the encryption routine I think this has been fixed, but I don't understand why encryption (which implies reversibility) was ever advocated over a proper password hashing method such as BCrypt or PBKDF2. And no, using terms like "one way encryption" would not be any better - it shows a general lack of understanding.
- tptacek 7y ago
  There is a general lack of understanding. OWASP is a shambolic volunteer project and its outputs are uneven at best. I would be particularly wary of OWASP when it comes to specialist topics, and cryptography is a great example of that.
  - rtempaccount1 7y ago
    OWASP may be a shambolic volunteer project, but it's interesting that, in many areas, it's still the best thing available for the last 18 years...
    - tptacek 7y ago
      Is that interesting? Are other aspects of computing more mature? I look at the kind of stuff Kyle Kingsbury finds with Jepsen and wonder.
      - rtempaccount1 7y ago
        Well I find it interesting :) A huge quantity of value flows through web applications, they're used by pretty much every business sector in the world for a wide range of purposes. Security vulnerabilities in Web applications have been a major cause of big losses at a large number of these companies. Despite that, the most authoritative, best funded, Web application security group is OWASP. A group with a full-time staff of < 10, and an annual budget of well under $10M. It's interesting to me anyway, that the wider IT industry doesn't see value in trying to establish security practices and tooling which could be used to reduce some of these losses. Even if they don't like OWASP itself for any reason, that they don't look to establish something else to achieve the same goal.
    - jammygit 7y ago
      Anybody have any other sites or books/resources that they would recommend?
  - blowski 7y ago
    That’s a bit disheartening. OWASP isn’t perfect, but it’s definitely a step up the ladder for the kind of teams that aren’t using HTTPS, and storing passwords in plain text. Having an official set of fairly specific instructions helps move the discussion away from the subjective “single quotes are more secure than double quotes” type discussions.
    - 7y ago
- rtempaccount1 7y ago
  Errors and mistakes are somewhat inevitable in larger projects, and ASVS covers a lot of ground. One of the benefits is that it's open source, so you're free to contribute to improve it.
jammygit 7y ago
Did not know this existed. Very cool

lol768 7y ago

ASVS is a good idea, but it has forever lost its credibility for me after the following recommendation appeared in one of its published documents (2.13 I believe, level 1 ASVSv3): >Verify that account passwords make use of a sufficient strength encryption routine and that it withstands brute force attack against the encryption routine I think this has been fixed, but I don't understand why encryption (which implies reversibility) was ever advocated over a proper password hashing method such as BCrypt or PBKDF2. And no, using terms like "one way encryption" would not be any better - it shows a general lack of understanding.

tptacek 7y ago
There is a general lack of understanding. OWASP is a shambolic volunteer project and its outputs are uneven at best. I would be particularly wary of OWASP when it comes to specialist topics, and cryptography is a great example of that.
- rtempaccount1 7y ago
  OWASP may be a shambolic volunteer project, but it's interesting that, in many areas, it's still the best thing available for the last 18 years...
  - tptacek 7y ago
    Is that interesting? Are other aspects of computing more mature? I look at the kind of stuff Kyle Kingsbury finds with Jepsen and wonder.
    - rtempaccount1 7y ago
      Well I find it interesting :) A huge quantity of value flows through web applications, they're used by pretty much every business sector in the world for a wide range of purposes. Security vulnerabilities in Web applications have been a major cause of big losses at a large number of these companies. Despite that, the most authoritative, best funded, Web application security group is OWASP. A group with a full-time staff of < 10, and an annual budget of well under $10M. It's interesting to me anyway, that the wider IT industry doesn't see value in trying to establish security practices and tooling which could be used to reduce some of these losses. Even if they don't like OWASP itself for any reason, that they don't look to establish something else to achieve the same goal.
  - jammygit 7y ago
    Anybody have any other sites or books/resources that they would recommend?
- blowski 7y ago
  That’s a bit disheartening. OWASP isn’t perfect, but it’s definitely a step up the ladder for the kind of teams that aren’t using HTTPS, and storing passwords in plain text. Having an official set of fairly specific instructions helps move the discussion away from the subjective “single quotes are more secure than double quotes” type discussions.
  - 7y ago
rtempaccount1 7y ago
Errors and mistakes are somewhat inevitable in larger projects, and ASVS covers a lot of ground. One of the benefits is that it's open source, so you're free to contribute to improve it.

jammygit 7y ago

Did not know this existed. Very cool