File tree Expand file tree Collapse file tree 6 files changed +9
-16
lines changed
06-design/02-web-app-checklist Expand file tree Collapse file tree 6 files changed +9
-16
lines changed Original file line number Diff line number Diff line change @@ -16,7 +16,7 @@ permalink:
1616
1717## 3. Requirements
1818
19- Referring to the OWASP [ Top Ten Proactive Controls ] [ control1 ] , security requirements are statements of
19+ Security requirements are statements of
2020security functionality that ensure the different security properties of a software application are being satisfied.
2121Security requirements are derived from industry standards, applicable laws, and a history of past vulnerabilities.
2222Security requirements define new features or additions to existing features to solve a specific security problem
@@ -50,7 +50,6 @@ Sections:
5050
5151The OWASP Developer Guide is a community effort; if there is something that needs changing then [ submit an issue] [ issue0500 ] .
5252
53- [ control1 ] : https://owasp.org/www-project-proactive-controls/v3/en/c1-security-requirements
5453[ issue0500 ] : https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2005-requirements/00-toc
5554[ samm ] : https://owaspsamm.org/about/
5655[ sammd ] : https://owaspsamm.org/model/design/
Original file line number Diff line number Diff line change @@ -37,11 +37,6 @@ but there is no wrong time to consider these security requirements and add new o
3737
3838#### Software requirements
3939
40- The OWASP [ Top Ten Proactive Controls] [ proactive10 ] describes the most important categories of controls
41- that architects and developers should include in every project.
42- At the head of the list of controls is [ C1: Define Security Requirements] [ control1 ]
43- and this reflects the importance of software security requirements: without them the development will not be secure.
44-
4540Defining security requirements can be daunting at times,
4641for example they may reference cryptographic techniques that can be misapplied,
4742but it is perfectly acceptable to state these requirements in everyday language.
@@ -120,7 +115,6 @@ then [submit an issue][issue0501] or [edit on GitHub][edit0501].
120115
121116[ asvs ] : https://owasp.org/www-project-application-security-verification-standard/
122117[ csabuse ] : https://cheatsheetseries.owasp.org/cheatsheets/Abuse_Case_Cheat_Sheet
123- [ control1 ] : https://owasp.org/www-project-proactive-controls/v3/en/c1-security-requirements
124118[ issue0501 ] : https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2005-requirements/01-requirements
125119[ mas ] : https://mas.owasp.org/
126120[ edit0501 ] : https://github.com/OWASP/www-project-developer-guide/blob/main/draft/05-requirements/01-requirements.md
Original file line number Diff line number Diff line change @@ -16,7 +16,7 @@ permalink: /draft/design/web_app_checklist/secure_database_access/
1616
1717Ensure that access to all data stores is secure, including both relational databases and NoSQL databases.
1818
19- Refer to proactive control [ C3: Secure Database Access ] [ control3 ] and its [ cheatsheets] [ csproactive-c3 ]
19+ Refer to proactive control [ C3: Validate all Input & Handle Excpetions ] [ control3 ] and its [ cheatsheets] [ csproactive-c3 ]
2020for more context from the OWASP Top 10 Proactive Controls project,
2121and use the list below as suggestions for a checklist that has been tailored for the individual project.
2222
@@ -58,11 +58,11 @@ The OWASP Developer Guide is a community effort; if there is something that need
5858then [ submit an issue] [ issue060203 ] or [ edit on GitHub] [ edit060203 ] .
5959
6060[ csproactive-c3 ] : https://cheatsheetseries.owasp.org/IndexProactiveControls.html#c3-secure-database-access
61- [ control3 ] : https://owasp.org/www-project-proactive-controls/v3/en/ c3-secure-database
61+ [ control3 ] : https://top10proactive. owasp.org/the-top-10/ c3-validate-input-and-handle-exceptions/
6262[ csdb ] : https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet
6363[ csquery ] : https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet
6464[ edit060203 ] : https://github.com/OWASP/www-project-developer-guide/blob/main/draft/06-design/02-web-app-checklist/03-secure-database-access.md
6565[ issue060203 ] : https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2006-design/02-web-app-checklist/03-secure-database-access
66- [ proactive10 ] : https://owasp.org/www-project-proactive-controls /
66+ [ proactive10 ] : https://top10proactive. owasp.org/
6767
6868\newpage
Original file line number Diff line number Diff line change @@ -17,7 +17,7 @@ permalink: /draft/design/web_app_checklist/access_controls/
1717Access Control or [ Authorization] [ csauthz ] is the process of granting or denying specific requests
1818from a user, program, or process.
1919
20- Refer to proactive control [ C7: Enforce Access Controls] [ control7 ] and its [ cheatsheets] [ csproactive-c7 ]
20+ Refer to proactive control [ C1: Implement Access Controls] [ control1 ] and its [ cheatsheets] [ csproactive-c7 ]
2121for more context from the OWASP Top 10 Proactive Controls project,
2222and use the list below as suggestions for a checklist that has been tailored for the individual project.
2323
@@ -54,10 +54,10 @@ The OWASP Developer Guide is a community effort; if there is something that need
5454then [ submit an issue] [ issue060207 ] or [ edit on GitHub] [ edit060207 ] .
5555
5656[ csproactive-c7 ] : https://cheatsheetseries.owasp.org/IndexProactiveControls.html#c7-enforce-access-controls
57- [ control7 ] : https://owasp.org/www-project-proactive-controls/v3/en/c7-enforce-access-controls
57+ [ control1 ] : https://top10proactive. owasp.org/the-top-10/c1-accesscontrol/
5858[ csauthz ] : https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet
5959[ edit060207 ] : https://github.com/OWASP/www-project-developer-guide/blob/main/draft/06-design/02-web-app-checklist/07-access-controls.md
6060[ issue060207 ] : https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2006-design/02-web-app-checklist/07-access-controls
61- [ proactive10 ] : https://owasp.org/www-project-proactive-controls /
61+ [ proactive10 ] : https://top10proactive. owasp.org/
6262
6363\newpage
Original file line number Diff line number Diff line change @@ -60,7 +60,7 @@ The OWASP Developer Guide is a community effort; if there is something that need
6060then [ submit an issue] [ issue060208 ] or [ edit on GitHub] [ edit060208 ] .
6161
6262[ csproactive-c8 ] : https://cheatsheetseries.owasp.org/IndexProactiveControls.html#c8-protect-data-everywhere
63- [ control8 ] : https://top10proactive.owasp.org/the-top-10/c2-crypto/
63+ [ control2 ] : https://top10proactive.owasp.org/the-top-10/c2-crypto/
6464[ cscs ] : https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet
6565[ cssm ] : https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet
6666[ edit060208 ] : https://github.com/OWASP/www-project-developer-guide/blob/main/draft/06-design/02-web-app-checklist/08-protect-data.md
Original file line number Diff line number Diff line change @@ -61,6 +61,6 @@ then [submit an issue][issue060209] or [edit on GitHub][edit060209].
6161[ csvocabulary ] : https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet
6262[ edit060209 ] : https://github.com/OWASP/www-project-developer-guide/blob/main/draft/06-design/02-web-app-checklist/09-logging-monitoring.md
6363[ issue060209 ] : https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2006-design/02-web-app-checklist/09-logging-monitoring
64- [ proactive10 ] : https://top10proactive.owasp.org/the-top-10/
64+ [ proactive10 ] : https://top10proactive.owasp.org/
6565
6666\newpage
You can’t perform that action at this time.
0 commit comments