add more references to the Security Culture project

Author: jgadsden

draft/04-foundations/00-toc.md

@@ -24,6 +24,12 @@ software security for the application or system under development.
 This Developer Guide can only give a brief overview of these concepts,
 for in-depth knowledge refer to the many texts on security such as the [The Cyber Security Body Of Knowledge][cbok].
 
+If changes are being introduced to the security culture of an organization
+then make sure there is management buy-in and clear goals to achieve.
+Without these then attempts to improve the security posture will probably fail - see the
+[Security Culture][culturegoal] project for the importance of getting management,
+security and development teams working together.
+
 Sections:
 
 2.1 [Security fundamentals](#security-fundamentals)  
@@ -37,6 +43,7 @@ Sections:
 The OWASP Developer Guide is a community effort; if there is something that needs changing then [submit an issue][issue0400].
 
 [cbok]: https://www.cybok.org/
+[culturegoal]: https://owasp.org/www-project-security-culture/stable/3-Goal_Setting_and_Security_Team_Collaboration/
 [issue0400]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2004-foundations/00-toc
 
 \newpage

draft/04-foundations/02-secure-development.md

@@ -26,6 +26,8 @@ permalink: /draft/foundations/secure_development/
 
 Secure development is described in the OWASP Software Assurance Maturity Model [(SAMM)][samm]
 [Design][sammd], [Implementation][sammi] and [Verification][sammv] business functions.
+Also refer to the [Security Culture][culturewhy] for a good explanation
+on why adding security into the software development lifecycle is important.
 
 #### Prelude
 
@@ -204,6 +206,7 @@ then [submit an issue][issue0402] or [edit on GitHub][edit0402].
 [csproject]: https://owasp.org/www-project-cheat-sheets/
 [csrfguard]: https://owasp.org/www-project-csrfguard/
 [culture]: https://owasp.org/www-project-security-culture/
+[culturewhy]: https://owasp.org/www-project-security-culture/stable/2-Why_Add_Security_In_Development_Teams/
 [cyclone]: https://owasp.org/www-project-cyclonedx/
 [depcheck]: https://owasp.org/www-project-dependency-check/
 [deptrack]: https://dependencytrack.org/

draft/04-foundations/toc.md

@@ -35,6 +35,12 @@ software security for the application or system under development.
 This Developer Guide can only give a brief overview of these concepts,
 for in-depth knowledge refer to the many texts on security such as the [The Cyber Security Body Of Knowledge][cbok].
 
+If changes are being introduced to the security culture of an organization
+then make sure there is management buy-in and clear goals to achieve.
+Without these then attempts to improve the security posture will probably fail - see the
+[Security Culture][culturegoal] project for the importance of getting management,
+security and development teams working together.
+
 Sections:
 
 2.1 [Security fundamentals](01-security-fundamentals.md)  
@@ -49,5 +55,6 @@ The OWASP Developer Guide is a community effort; if there is something that need
 then [submit an issue][issue0400] or [edit on GitHub][edit0400].
 
 [cbok]: https://www.cybok.org/
+[culturegoal]: https://owasp.org/www-project-security-culture/stable/3-Goal_Setting_and_Security_Team_Collaboration/
 [edit0400]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/04-foundations/toc.md
 [issue0400]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2004-foundations/00-toc

draft/06-design/01-threat-modeling/01-threat-modeling.md

@@ -29,6 +29,8 @@ The deliverables from threat modeling take various forms including system models
 mitigations or assumptions, meeting notes, and more.
 This may be assembled into a single threat model document; a structured representation of all the information
 that affects the security of an application.
+A good overview of this activity is given in the [Security Culture][culturetm] project section on threat modeling.
+
 In essence, it is a view of the application and its environment through security glasses.
 
 Threat modeling is a process for capturing, organizing, and analyzing all of this information
@@ -267,6 +269,7 @@ then [submit an issue][issue060101] or [edit on GitHub][edit060101].
 [corncards]: https://owasp.org/www-project-cornucopia/
 [ccsnet]: https://cheatsheetseries.owasp.org/cheatsheets/Network_Segmentation_Cheat_Sheet
 [cstm]: https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet
+[culturetm]: https://owasp.org/www-project-security-culture/stable/6-Threat_Modelling/
 [eop]: https://shostack.org/games/elevation-of-privilege
 [edit060101]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/06-design/01-threat-modeling/01-threat-modeling.md
 [issue060101]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2006-design/01-threat-modeling/01-threat-modeling

draft/08-verification/00-toc.md

@@ -37,6 +37,9 @@ These activities are supported by:
 * Vulnerability management
 * Checklists
 
+Verification is an activity central to the secure software development lifecycle.
+Refer to the [Security Culture][culturetest] project section for the various types of security testing.
+
 Sections:
 
 6.1 [Guides](#verification-guides)  
@@ -58,6 +61,7 @@ Sections:
 
 The OWASP Developer Guide is a community effort; if there is something that needs changing then [submit an issue][issue0800].
 
+[culturetest]: https://owasp.org/www-project-security-culture/stable/7-Security_Testing/
 [issue0800]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2008-verification/00-toc
 [samm]: https://owaspsamm.org/about/
 [sammv]: https://owaspsamm.org/model/verification/

draft/08-verification/04-vulnerability-management/01-defectdojo.md

@@ -59,10 +59,12 @@ and with time more integrations with threat modeling tools will become available
 
 #### How to use it
 
-Testing or installing DefectDojo is straight forward using the [installation instructions][defectdojo-install].
-An instance of DefectDojo can be setup using [docker compose][defectdojo-docker] along with the associated scripts
-that handle the dependencies, configure the database, create users and so on.
-Refer to the DefectDojo [documentation][defectdojo-docs] for all the information on alternative deployments,
+Testing or installing DefectDojo is straight forward using the [installation instructions][defectdojo-install];
+the recommended way to run DefectDojo is using a container.
+
+To set up an instance of DefectDojo follow the [docker compose][defectdojo-docker] instructions along with
+the associated scripts that handle the dependencies, configure the database, create users and so on.
+Refer to the DefectDojo [documentation][defectdojo-docs] for further information on alternative deployments,
 setting up, usage and integrations.
 
 #### References
@@ -77,9 +79,9 @@ The OWASP Developer Guide is a community effort; if there is something that need
 then [submit an issue][issue080401] or [edit on GitHub][edit080401].
 
 [defectdojo]: https://www.defectdojo.com/
-[defectdojo-docs]: https://defectdojo.github.io/django-DefectDojo/
+[defectdojo-docs]: https://documentation.defectdojo.com/
 [defectdojo-docker]: https://github.com/DefectDojo/django-DefectDojo/blob/dev/readme-docs/DOCKER.md
-[defectdojo-install]: https://defectdojo.github.io/django-DefectDojo/getting_started/installation/
+[defectdojo-install]: https://documentation.defectdojo.com/getting_started/installation/
 [defectdojo-project]: https://owasp.org/www-project-defectdojo/
 [defectdojo-tools]: https://www.defectdojo.com/integrations
 [edit080401]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/08-verification/04-vulnerability-management/01-defectdojo.md

draft/08-verification/toc.md

@@ -48,6 +48,9 @@ These activities are supported by:
 * Vulnerability management
 * Checklists
 
+Verification is an activity central to the secure software development lifecycle.
+Refer to the [Security Culture][culturetest] project section for the various types of security testing.
+
 Sections:
 
 6.1 [Guides](01-guides/toc.md)  
@@ -70,6 +73,7 @@ Sections:
 The OWASP Developer Guide is a community effort; if there is something that needs changing
 then [submit an issue][issue0800] or [edit on GitHub][edit0800].
 
+[culturetest]: https://owasp.org/www-project-security-culture/stable/7-Security_Testing/
 [edit0800]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/08-verification/toc.md
 [issue0800]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2008-verification/00-toc
 [samm]: https://owaspsamm.org/about/

draft/09-training-education/00-toc.md

@@ -26,7 +26,13 @@ development, testing, or auditing of the applications and systems.
 In addition a Learning Management System or equivalent should be in place to track
 the employee training and certification processes.
 
-OWASP provides various resources and environments that can help with this security training and education.
+It is important to provide activities for development teams;
+we are all human and our security knowledge can become stale without a plan for refreshing it.
+The [Security Culture][cultureacts] project describes various activities that can help developers
+keep up to date and motivated.
+
+OWASP provides various resources and environments that can help with this security training and education
+ranging from vulnerable applications, training platforms and gamification.
 
 Sections:
 
@@ -48,6 +54,7 @@ Sections:
 
 The OWASP Developer Guide is a community effort; if there is something that needs changing then [submit an issue][issue0900].
 
+[cultureacts]: https://owasp.org/www-project-security-culture/stable/5-Activities/
 [issue0900]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2009-training-education/00-toc
 [sammg]: https://owaspsamm.org/model/governance/
 [sammgeg]: https://owaspsamm.org/model/governance/education-and-guidance/

draft/09-training-education/06-mobile-top-ten.md

@@ -73,9 +73,9 @@ but they can be applied at any time during development.
 The Mobile Top 10 was [first released in 2014][mobile10-2014], [updated in 2016][mobile10-2016]
 with the latest version [released in 2024][mobile10-2023].
 
-The list of mobile application [controls][mobile10controls] were originally published in 2011
-as the '[Smartphone Secure Development Guideline][ssdg-2011]'. This was then revised during 2016
-and [released in February 2017][ssdg-2017] to inform the latest set of mobile application controls.
+The list of mobile application [controls][mobile10controls] were originally published in 2011 by [ENISA][enisa]
+as the 'Smartphone Secure Development Guideline'.
+This was then revised during 2016, released in February 2017, to inform the latest set of mobile application controls.
 
 ----
 
@@ -101,7 +101,5 @@ then [submit an issue][issue0906] or [edit on GitHub][edit0906].
 [mobile10-2023]: https://owasp.org/www-project-mobile-top-10/2023-risks/
 [mobile10controls]: https://owasp.org/www-project-mobile-top-10/#div-controls
 [mobile10repo]: https://github.com/OWASP/www-project-mobile-top-10/blob/master/README.md
-[ssdg-2011]: https://www.enisa.europa.eu/publications/smartphone-secure-development-guidelines/at_download/fullReport
-[ssdg-2017]: https://www.enisa.europa.eu/publications/smartphone-secure-development-guidelines-2016
 
 \newpage

draft/09-training-education/toc.md

@@ -37,7 +37,13 @@ development, testing, or auditing of the applications and systems.
 In addition a Learning Management System or equivalent should be in place to track
 the employee training and certification processes.
 
-OWASP provides various resources and environments that can help with this security training and education.
+It is important to provide activities for development teams;
+we are all human and our security knowledge can become stale without a plan for refreshing it.
+The [Security Culture][cultureacts] project describes various activities that can help developers
+keep up to date and motivated.
+
+OWASP provides various resources and environments that can help with this security training and education
+ranging from vulnerable applications, training platforms and gamification.
 
 Sections:  
 
@@ -60,6 +66,7 @@ Sections:
 The OWASP Developer Guide is a community effort; if there is something that needs changing
 then [submit an issue][issue0900] or [edit on GitHub][edit0900].
 
+[cultureacts]: https://owasp.org/www-project-security-culture/stable/5-Activities/
 [edit0900]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/09-training-education/toc.md
 [issue0900]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2009-training-education/00-toc
 [sammg]: https://owaspsamm.org/model/governance/