Difference between revisions of "OWASP Top 10 2010 AppSecDC"

From OWASP
Jump to: navigation, search
m (moved OWASP Top 10 2009 AppSecDC to OWASP Top 10 2010 AppSecDC: It will actually be the 2010 release, not the 2009 release.)
 
(One intermediate revision by one user not shown)
Line 2: Line 2:
  
 
[[Image:Owasp_logo_normal.jpg|right]]
 
[[Image:Owasp_logo_normal.jpg|right]]
This presentation will cover the next update to the [[OWASP Top 10]] that is currently under development. The OWASP Top 10 was originally released in 2003 to raise awareness of the importance of application security. As the field evolves, the Top 10 needs to be periodically updated to keep with up with the times. The Top 10 was updated in 2004 and the last update was in 2007, where it introduced Cross Site Request Forgery (CSRF) as the big new emerging web application security risk.
+
This presentation will cover the [[OWASP Top 10]] - 2010 Release Candidate that is being released at the OWASP DC Conference. The OWASP Top 10 was originally released in 2003 to raise awareness of the importance of application security. As the field evolves, the Top 10 needs to be periodically updated to keep with up with the times. The Top 10 was updated in 2004 and the last update was in 2007, where it introduced Cross Site Request Forgery (CSRF) as the big new emerging web application security risk.
  
 
This update will be based on more sources of web application vulnerability information than the previous versions were when determining the new Top 10. It will also present this information in a more concise, compelling, and consumable manner, and include strong references to the many new openly available resources that can help address each issue, particularly OWASP's new [[ESAPI|Enterprise Security API (ESAPI)]] and [[ASVS|Application Security Verification Standard (ASVS)]] projects.
 
This update will be based on more sources of web application vulnerability information than the previous versions were when determining the new Top 10. It will also present this information in a more concise, compelling, and consumable manner, and include strong references to the many new openly available resources that can help address each issue, particularly OWASP's new [[ESAPI|Enterprise Security API (ESAPI)]] and [[ASVS|Application Security Verification Standard (ASVS)]] projects.
  
A significant change for this update will be that the OWASP Top 10 will be focused on the Top 10 '''Risks''' to Web Applications, not just the most common vulnerabilities. At the conference will be the debut of a release candidate of the new Top 10, which will open up a 60 day comment period. After that time, a final version will be produced and released in early 2010.
+
A significant change for this update will be that the OWASP Top 10 will be focused on the Top 10 '''Risks''' to Web Applications, not just the most common vulnerabilities. At the conference will be the debut of the release candidate of the new Top 10, which will open up a 60 day comment period. After that time, a final version will be produced and released in early 2010.
 +
 
 +
== Follow Up ==
 +
 
 +
The release candidate for the OWASP Top Ten for 2010 has been officially released at the OWASP AppSec DC Conference today (Nov 13, 2009). This document is now up for open comment until Dec 31, 2009. We will then update the document and release a final version in early 2010, hopefully January. Please send all comments to: dave.wichers@owasp.org.
 +
 
 +
The conference presentation which describes the changes, and goes through each item in the new Top 10 can be downloaded here: ([http://www.owasp.org/images/a/a1/AppSec_DC_2009_-_OWASP_Top_10_-_2010_rc1.pptx OWASP Top 10 - 2010 rc1 Presentation]).
 +
 
 +
[http://www.owasp.org/index.php/File:OWASP_T10_-_2010_rc1.pdf Click here to download the OWASP Top 10 - 2010 rc1] itself.
  
 
== The Speaker ==
 
== The Speaker ==

Latest revision as of 19:08, 13 November 2009

The Presentation

Owasp logo normal.jpg

This presentation will cover the OWASP Top 10 - 2010 Release Candidate that is being released at the OWASP DC Conference. The OWASP Top 10 was originally released in 2003 to raise awareness of the importance of application security. As the field evolves, the Top 10 needs to be periodically updated to keep with up with the times. The Top 10 was updated in 2004 and the last update was in 2007, where it introduced Cross Site Request Forgery (CSRF) as the big new emerging web application security risk.

This update will be based on more sources of web application vulnerability information than the previous versions were when determining the new Top 10. It will also present this information in a more concise, compelling, and consumable manner, and include strong references to the many new openly available resources that can help address each issue, particularly OWASP's new Enterprise Security API (ESAPI) and Application Security Verification Standard (ASVS) projects.

A significant change for this update will be that the OWASP Top 10 will be focused on the Top 10 Risks to Web Applications, not just the most common vulnerabilities. At the conference will be the debut of the release candidate of the new Top 10, which will open up a 60 day comment period. After that time, a final version will be produced and released in early 2010.

Follow Up

The release candidate for the OWASP Top Ten for 2010 has been officially released at the OWASP AppSec DC Conference today (Nov 13, 2009). This document is now up for open comment until Dec 31, 2009. We will then update the document and release a final version in early 2010, hopefully January. Please send all comments to: dave.wichers@owasp.org.

The conference presentation which describes the changes, and goes through each item in the new Top 10 can be downloaded here: (OWASP Top 10 - 2010 rc1 Presentation).

Click here to download the OWASP Top 10 - 2010 rc1 itself.

The Speaker

Dave Wichers is a member of the OWASP Board, the OWASP Conferences Chair, and a coauthor, along with Jeff Williams, of all previous versions of the OWASP Top Ten.

Dave is also the Chief Operating Officer (COO) of Aspect Security (www.aspectsecurity.com), a company that specializes in application security services. Mr. Wichers brings over twenty years of experience in the information security field. Prior to cofounding Aspect, he ran the Application Security Services Group at a large data center company, Exodus Communications.

His current work involves helping customers, from small e-commerce sites to Fortune 500 corporations and the U.S. Government, secure their applications by providing application security design, architecture, and SDLC support services: including code review, application penetration testing, security policy development, security consulting services, and developer training.