OWASP ISO IEC 27034 Application Security Controls Project

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP ISO/IEC 27034 Application Security Controls Project
OWASP ISO/IEC 27034 Application Security Controls Project is an effort to do the conversion of OWASP related documentations and best practices, such as the OWASP Top 10, in Application Security Controls (ASCs) as defined in ISO/IEC 27034. This will enable 27034 stakeholders to use formal structure of OWASP content.

Introduction to ISO/IEC 27034
ISO/IEC 27034 offers guidance on information security to those specifying, designing/programming or procuring, implementing and using application systems, in other words business and IT managers, developers and auditors, and ultimately the end-users of application systems. The aim is to ensure that computer applications deliver the desired/necessary level of security in support of the organization’s Information Security Management System.

It is aimed at architects, analysts, programmers, testers, IT Team, DBA, Admins, etc., who need to know what and when Application Security Controls should be applied, integrate Application Security Controls in their activities, meet the requirements of the Application Security Controls associated measurements, get access to tools and best practices and facilitate peer review.

It can also be used by auditors, in order to know the scope and process of verification measurements for the corresponding Application Security Controls, make audit results repeatable, identify a list of verification measurements which can generate supporting evidence to demonstrate that the application has reached the required level of trust authorized by the management and standardize the application security verification.

27034 is based upon the following key principles:
 * Security is a requirement
 * Application security is context-dependent
 * Appropriate investment for application security
 * Application security must be demonstrated

http://www.iso27001security.com/html/27034.html

Description of the OWASP project
ISO/IEC 27034 do not propose any Application Security Controls by itself, nor any coding/testing best practices. OWASP is a good match to 27034 because it is proposing many best practices and technical details that can be used to create ASCs.

At the beginning of our roadmap, the focus will be upon the conversion of the latest OWASP Top 10 into ASCs.

Licensing
OWASP ISO/IEC 27034 Application Security Controls are free to use. It is licensed under the GNU LGPL v3 License (http://www.gnu.org/licenses/lgpl.html) that is similar to GPL but modified for use with libraries that may be called by other proprietary programs.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

What is XXX?
OWASP XXX provides:


 * xxx
 * xxx

Presentation
Link to presentation

Project Co-Leaders

 * Luc Poulin
 * Jonathan Marcil

Related Projects

 * OWASP_Top_Ten_Project


 * valign="top" style="padding-left:25px;width:200px;" |

Quick Download

 * Link to page/download

News and Events

 * [20 Nov 2013] News 2
 * [30 Sep 2013] News 1

In Print
This project can be purchased as a print on demand book from Lulu.com

Classifications

 * }

=FAQs=


 * Q1
 * A1


 * Q2
 * A2

= Acknowledgements =

Volunteers
XXX is developed by a worldwide team of volunteers. The primary contributors to date have been:


 * xxx
 * xxx

Others

 * xxx
 * xxx

= Road Map and Getting Involved = As of XXX, the priorities are:
 * xxx
 * xxx
 * xxx

Involvement in the development and promotion of XXX is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:
 * xxx
 * xxx

=Project About=