Transcript OWASP Secure Coding Practices Quick Reference Guide Project leader Keith Turpin [email protected] OWASP August, 2010 Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this.

OWASP
Secure Coding Practices
Quick Reference Guide
Project leader
Keith Turpin
[email protected]
OWASP
August, 2010
Copyright © The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the OWASP License.
The OWASP Foundation
http://www.owasp.org
About Me
 Secure Coding Practices Quick Reference
Guide project leader
 Application security assessments team
leader at The Boeing Company
 United States delegate to the IEC/ISO
SC27 subcommittee on cyber security
 Member of the Software Assurance
Working Group
OWASP
2
Some Background
 Goal: Build a secure coding kick-start tool, to help
development teams quickly understand secure coding
practices
 Originally developed for use inside The Boeing Company
 July 2010, Boeing assigned copyright to OWASP
 August 2010, project goes live on owasp.org
OWASP
3
Guide Overview
 Technology agnostic coding practices
 What to do, not how to do it
 Compact, but comprehensive checklist format
 Focuses on secure coding requirements, rather
then on vulnerabilities and exploits
 Includes a cross referenced glossary to get
developers and security folks talking the same
language
OWASP
4
Sections of the Guide
 The bulk of the document is in the checklists, but it
contains all of the following:
Introduction
Table of contents
Software Security Principles Overview
Secure Coding Practices Checklist
Links to useful resources
Glossary of important terminology
OWASP
5
Checklist Sections
 Data Validation
 Authentication and Password Management
 Authorization and Access Management
 Session Management
 Sensitive Information Storage or Transmission
 System Configuration Management
 General Coding Practices
 Database Security
 File Management
 Memory Management
OWASP
6
Checklist Practices
 Short and to the point.
 Straight forward "do this" or "don't do that"
 Some practices will require coded solutions. When they
do, use tested, standardized managed code whenever
possible
 Some practices are conditional recommendations that
depend on the criticality of the system or information
 The security implications of not following any of the
practices that apply to the application, should be clearly
understood
OWASP
7
Using the guide
 Scenario #1: Developing Guidance Documents
Coding Practices
Guiding Principles
Security
Policies
What to do
Application
Security
Procedures
How to do it
Application
Security
Coding
Standards
OWASP
8
Using the guide continued
 Scenario #2: Support Secure Development Lifecycle
What to do
Application
Security
Requirements
How you should do it
Application
Development Practices
What you did
Review
Solutions
Did it work
Test Solution
Implementation
Standardized Libraries
Standard Guidance for
non-Library Solutions
Coding Practices
OWASP
9
Using the guide continued
 Scenario #3: Contracted Development
 Identify security requirements to be added to outsourced
software development projects.
 Include them in the RFP and Contract
How do I
make it work
Coding Practices
We can build
anything
I need
cool
Software
RFP
Best
Contract
Software
Best
Ever
Software
Ever
Programmer
Salesman
Customer
OWASP
10
Summary
 Make it easier for development teams to quickly
understand secure coding practices
 Does not specify what should or must be done, as all of
these practices can be contributing factors to the overall
security profile of an application and often it is the
combination of flaws, rather than any single one, which
leads to an exploitable situation
OWASP
11
A Secure Development Framework
Guidance on implementing a secure software development framework
is beyond the scope of the Quick reference Guide, however the
following OWASP projects can help:
 Implement a secure software development lifecycle
 OWASP CLASP Project
 Establish secure coding standards
 OWASP Development Guide Project
 Build a re-usable object library
 OWASP Enterprise Security API (ESAPI) Project
 Verify the effectiveness of security controls
 OWASP Application Security Verification Standard (ASVS)
Project)
 Establish secure outsourced development practices including
defining security requirements and verification methodologies in
both the RFP and contract
 OWASP Legal Project
OWASP
12
Questions
OWASP
13