OWASP Secure TDD Project

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP Secure TDD Project
The OWASP Secure TDD Project allows organizations to integrate security into the Test Driven Development (TDD) lifecycle. When utilizing TDD, it is important to clarify to the developers that this process will change the way they think, since they need to cover all tests prior development, which is different from the unit testing approach. The OWASP Secure TDD Project contains an open source tool written for .NET developers in order to allow generation of the most common tests out of the box and enable developers to consciously improve the project by developing additional tests or extensions.

Introduction
About TDD

TDD is about writing a test which will fail, then writing the minimum amount of code required to make it run and then refactoring the code to make it clean. This is done in cycles, fail -> pass -> refactor, adding a new test for each known requirement for the code. A TDD test expresses the task of the application functionality that needs to be implemented next and the criterion for success. TDD is not about testing. TDD uses tests to drive the design of the code. This can be done with unit tests, functional tests and acceptance tests. Usually, all three are used. The tests tell you what to do, what to do next and when you are done. They tell you what the API is going to be, what the design is. The tests permit you to refactor safely, ensuring that the desired behavior continues to work while you adjust your design. The tests also guide you to testable code, promoting smaller methods, shorter parameter lists, and overall much simpler design than other methodologies lead you to.

Difference between TDD and Unit Tests

Unit Testing is about testing individual units of behavior. An individual unit of behavior is the smallest possible unit of behavior that can be individually tested in isolation. You can write unit tests before you write your code, after you write your code or while you write your code.

So how does a TDD test differ from a unit test?

Unlike a unit test, a TDD test is used to drive the design of an application. A TDD test is used to express what application code should do before the application code is actually written. TDD is less about testing, and more about designing the code. Unit tests are then used to set the expectations for the end code. When the end code is written, and passes tests (specifications), you have a code that was designed using tests. Like unit tests, TDD tests can be used for regression testing. You can use TDD tests to immediately determine whether a change in code has broken existing application functionality. However, unlike a unit test, a TDD test does not necessarily test one unit of code in isolation. You can do unit testing without doing test driven development. However you can't do test driven development without using unit tests. When you do traditional unit testing, you write test after you wrote your code. Test driven development approach is to write unit test before writing code.

How do we solve the problem by implementing STDD?

TDD will help with the following:

- Tests can be written to verify the threat. - A solution can be implemented to block the threat, and quickly be confirmed to be working. - Provided all other tests still pass, you can quickly verify that all other security measures and all other functionality still behave correctly.

Basically TDD assists in allowing a quick turnaround time from when a threat is discovered to when a solution becomes available.

TDD is not going to protect you from unknown threats. By its very nature, you have to know what you want to test in order to write the test in the first place. However, Secure Test Driven Development (STDD) will help us Defend against existing threats and help developers secure their product by reducing and eliminating vulnerabilities in software before deployment while using the TDD life cycle. TDD favors highly localized (unit testing). As a result you could easily test that:

GetSafeSQLParam would correctly guard against SQL injection or that SecureZeroMemory would correctly erase a password from RAM. However, it becomes more difficult to verify that all developers have used the correct method in every place that it's required. Our STDD tool solves this problem, discovering security threats and vulnerabilities in software while writing the code.

Description
STDD is a tool that will ensure secure coding using an Add-On for Microsoft Visual Studio, by creating auto generated STDD tests, assisting us to find vulnerabilities, exploits and security bugs inside the code while using the TDD life cycle. The tests we will be focusing on are prevention against SQL injection and XSS attacks.

The benefits of such a tool will save time, money and keep code safe from security vulnerabilities.

Installation Guide
Requirements:  1. Microsoft Visual-Studio 2013 SDK  (http://www.microsoft.com/en-us/download/details.aspx?id=40758)  2. Microsoft Visual-Studio 2013 and above 

Setup:  1. Download the installer file from: [link] (MD5: fb3acea9c9943e37f88ff28fcdeb22d0) 2. Select destination folder 3. Select the product you want to install (Microsoft Visual-Studio 2013 and above)  4. Launch Visual-Studio, click on Tools > Secure TDD Wizard 

Licensing
The OWASP Secure TDD Project is free to use. It is licensed under the Apache 2.0 License.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

What is the OWASP Secure TDD Project?
The OWASP Secure TDD Project provides:


 * Secure testing --> Secure coding
 * Efficient coding which saves alot of time and money

Presentation
OWASP IL October 2013

Project Leader
Nir Valtman

Related Projects

 * OWASP_CISO_Survey


 * valign="top" style="padding-left:25px;width:200px;" |

Quick Download
https://github.com/SecureTDD/VisualStudio
 * Download source from Github:

News and Events

 * [20 Nov 2013] News 2
 * [30 Sep 2013] News 1

In Print
This project can be purchased as a print on demand book from Lulu.com

Classifications

 * }

=FAQs=


 * What is Secure STDD?
 * Secure Test Driven Development (STDD) will help us Defend against existing threats and help developers secure their product by       reducing and eliminating vulnerabilities in software before deployment while using the TDD life cycle.


 * How to benefit from STDD?
 * The benefits of such a tool will save time, money and keep code safe from security vulnerabilities. This tool does not require a thorough understanding of the possible Security threats thus making it easier for the Programmer to generate such Security tests. STDD tests also guide you to testable code, promoting smaller methods, shorter parameter lists, and overall much simpler design than other methodologies lead you to.


 * How to install the STDD tool?


 * How to use the STDD tool?
 * (link to description page)

= Acknowledgements =

Volunteers
The OWASP Secure TDD Project is developed by a worldwide team of volunteers. The primary contributors to date have been:


 * Lauren Tabak
 * Niran Yadai
 * Tal Darsan
 * Ofir Melinger
 * Kobi Barzilay

= Road Map and Getting Involved = As of March 2014, the priorities are:


 * Visual Studio Add-On
 * Configuration test support
 * SQLi and XSS Security tests

Involvement in the development and promotion of the OWASP Secure TDD Project is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:


 * Additional Security tests

=Project About=