[Owasp-guide] Further revised dev guide outline
Boberski, Michael [USA]
boberski_michael at bah.com
Thu Apr 1 08:56:33 EDT 2010
Ok, let's do this, since Dave wishes to keep the cheat sheets separate, and to clarify some additional items now that people have started digging into this in earnest:
# OWASP-0500 Input Validation
* Build or buy?
o OWASP-0501 Verify that the runtime environment is not susceptible to buffer overflows, or that security controls prevent buffer overflows
+ OWASP-0502-DG-01 Define a positive validation pattern for all input
+ OWASP-0502-DG-02 Apply a positive validation pattern to all input
o Input validation worksheet
* See also
For "# OWASP-0500 Input Validation", there shall be a brief explanation about what input validation is and examples of related vulnerabilities, containing recycled or new content.
For "Build or buy", this shall be the guts of each section, containing recycled or new content, according to ASVS requirement and derived guide requirement. The reader should be able to determine if available solutions are sufficient, whether they'll have to build or buy, after reading through this section, that is the "sanity check" that will be performed when reviewing this section. Subsections shall refer to any available worksheets in the next section.
For "Worksheets", there shall be one or more worksheets per section. This will be entirely new content.
For "See also", there shall be references to cheat sheets and other sections and OWASP materials as appropriate.
This structure will also allow us to insert a "Sample code" section later on, but I do not wish to confuse matters by trying to juggle code and content at this point.
Make it so! :-)
Mike B. <-- looks like kind of Star Trek Captain Picard after a "really" hard day.
From: Boberski, Michael [USA]
Sent: Thursday, April 01, 2010 8:27 AM
To: 'Tom Stripling'; 'Theo Van Niekerk'
Cc: owasp-guide at lists.owasp.org; 'Abe'
Subject: RE: [Owasp-guide] progress
I agree, some further adjustment of the outline is required. Stay tuned.
More information about the Owasp-guide