6 ms·

ASVS is a good idea, but it has forever lost its credibility for me after the following recommendation appeared in one of its published documents (2.13 I believ

by lol768 7y ago

ASVS is a good idea, but it has forever lost its credibility for me after the following recommendation appeared in one of its published documents (2.13 I believe, level 1 ASVSv3): >Verify that account passwords make use of a sufficient strength encryption routine and that it withstands brute force attack against the encryption routine I think this has been fixed, but I don't understand why encryption (which implies reversibility) was ever advocated over a proper password hashing method such as BCrypt or PBKDF2. And no, using terms like "one way encryption" would not be any better - it shows a general lack of understanding.

tptacek 7y ago
There is a general lack of understanding. OWASP is a shambolic volunteer project and its outputs are uneven at best. I would be particularly wary of OWASP when it comes to specialist topics, and cryptography is a great example of that.
- rtempaccount1 7y ago
  OWASP may be a shambolic volunteer project, but it's interesting that, in many areas, it's still the best thing available for the last 18 years...
  - tptacek 7y ago
    Is that interesting? Are other aspects of computing more mature? I look at the kind of stuff Kyle Kingsbury finds with Jepsen and wonder.
    - rtempaccount1 7y ago
      Well I find it interesting :) A huge quantity of value flows through web applications, they're used by pretty much every business sector in the world for a wide range of purposes. Security vulnerabilities in Web applications have been a major cause of big losses at a large number of these companies. Despite that, the most authoritative, best funded, Web application security group is OWASP. A group with a full-time staff of < 10, and an annual budget of well under $10M. It's interesting to me anyway, that the wider IT industry doesn't see value in trying to establish security practices and tooling which could be used to reduce some of these losses. Even if they don't like OWASP itself for any reason, that they don't look to establish something else to achieve the same goal.
  - jammygit 7y ago
    Anybody have any other sites or books/resources that they would recommend?
- blowski 7y ago
  That’s a bit disheartening. OWASP isn’t perfect, but it’s definitely a step up the ladder for the kind of teams that aren’t using HTTPS, and storing passwords in plain text. Having an official set of fairly specific instructions helps move the discussion away from the subjective “single quotes are more secure than double quotes” type discussions.
  - tptacek 7y ago
    If you're at that level of security immaturity, pretty much any mainstream resource is going to be helpful and will work out for you; OWASP is fine.
    - pas 7y ago
      What's the next step up?
      - tptacek 7y ago
        That's a big question, and I don't want to crud the thread up. My point was just, if you're at the point where you're arguing about single quotes versus double quotes, OWASP is just fine as a starting point.
      - eganist 7y ago
        As of now? ASVS v4: https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security... At least for software security, this is probably the best single reference you'll find to get from level 1 to 2 (assuming zero is your origin), regardless of ptacek's largely unfalsifiable objections. Absent from these comments are any other software-security-specific recommendations -- though if you're looking for something more holistic rather than just being siloed to software security specifically, you may consider following NIST CSF to start and then exploring mitigating common patterns exposed in the ATT&CK framework. If you're looking more for guidance on what other companies are doing for securing development pipelines, probably BSIMM. Bear in mind it's the product of a consulting firm, and all it does is tell you the things others do, not necessarily what's actually effective (descriptive v. prescriptive). The result is that it may be tuned to steer consulting traffic their way. Full disclosure: I've consumed that consulting service at two firms thus far.
- eganist 7y ago
  > OWASP is a shambolic volunteer project and its outputs are uneven at best. Have you considered contributing recently?
  - tptacek 7y ago
    No.
rtempaccount1 7y ago
Errors and mistakes are somewhat inevitable in larger projects, and ASVS covers a lot of ground. One of the benefits is that it's open source, so you're free to contribute to improve it.

by lol768 7y ago

tptacek 7y ago

There is a general lack of understanding. OWASP is a shambolic volunteer project and its outputs are uneven at best. I would be particularly wary of OWASP when it comes to specialist topics, and cryptography is a great example of that.

rtempaccount1 7y ago
OWASP may be a shambolic volunteer project, but it's interesting that, in many areas, it's still the best thing available for the last 18 years...
- tptacek 7y ago
  Is that interesting? Are other aspects of computing more mature? I look at the kind of stuff Kyle Kingsbury finds with Jepsen and wonder.
  - rtempaccount1 7y ago
    Well I find it interesting :) A huge quantity of value flows through web applications, they're used by pretty much every business sector in the world for a wide range of purposes. Security vulnerabilities in Web applications have been a major cause of big losses at a large number of these companies. Despite that, the most authoritative, best funded, Web application security group is OWASP. A group with a full-time staff of < 10, and an annual budget of well under $10M. It's interesting to me anyway, that the wider IT industry doesn't see value in trying to establish security practices and tooling which could be used to reduce some of these losses. Even if they don't like OWASP itself for any reason, that they don't look to establish something else to achieve the same goal.
- jammygit 7y ago
  Anybody have any other sites or books/resources that they would recommend?
blowski 7y ago
That’s a bit disheartening. OWASP isn’t perfect, but it’s definitely a step up the ladder for the kind of teams that aren’t using HTTPS, and storing passwords in plain text. Having an official set of fairly specific instructions helps move the discussion away from the subjective “single quotes are more secure than double quotes” type discussions.
- tptacek 7y ago
  If you're at that level of security immaturity, pretty much any mainstream resource is going to be helpful and will work out for you; OWASP is fine.
  - pas 7y ago
    What's the next step up?
    - tptacek 7y ago
      That's a big question, and I don't want to crud the thread up. My point was just, if you're at the point where you're arguing about single quotes versus double quotes, OWASP is just fine as a starting point.
    - eganist 7y ago
      As of now? ASVS v4: https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security... At least for software security, this is probably the best single reference you'll find to get from level 1 to 2 (assuming zero is your origin), regardless of ptacek's largely unfalsifiable objections. Absent from these comments are any other software-security-specific recommendations -- though if you're looking for something more holistic rather than just being siloed to software security specifically, you may consider following NIST CSF to start and then exploring mitigating common patterns exposed in the ATT&CK framework. If you're looking more for guidance on what other companies are doing for securing development pipelines, probably BSIMM. Bear in mind it's the product of a consulting firm, and all it does is tell you the things others do, not necessarily what's actually effective (descriptive v. prescriptive). The result is that it may be tuned to steer consulting traffic their way. Full disclosure: I've consumed that consulting service at two firms thus far.
eganist 7y ago
> OWASP is a shambolic volunteer project and its outputs are uneven at best. Have you considered contributing recently?
- tptacek 7y ago
  No.

rtempaccount1 7y ago

Errors and mistakes are somewhat inevitable in larger projects, and ASVS covers a lot of ground. One of the benefits is that it's open source, so you're free to contribute to improve it.