From colin.watson at owasp.org  Fri May 10 12:11:53 2013
From: colin.watson at owasp.org (Colin Watson)
Date: Fri, 10 May 2013 14:11:53 +0200
Subject: [Owasp-secure-coding-practices] OWASP Requirements Numbering
Message-ID: <CAAxdBB=iRVqKWOP=JmS0T8HR8m=FHr4R4E7GpWtGsbYpmUpO5w@mail.gmail.com>

The Cornucopia Ecommerce Website Edition card deck references the
Secure Coding Practices Quick Reference Guide (SCPQRG) by requirement
number (1-202). There are no identifiers in the SCPQRG, so I have
produced this XML file that defines IDs for each check box in v2.0 of
the SCPQRG:

   v0.01
   https://www.owasp.org/index.php/File:Owasp-requirements-numbering.zip

This was uploaded as a ZIp because XML is not allowed. Each item has an ID like:

   OWASP-nnnn

The ID is unique and has no other meaning. New items are simply given
the next higher unused number. Categorisations of any type can be
applied to any/all items.

The file does not duplicate all the content in the SCPQRG, but is
intended to be used for cross-referencing. In fact the requirement
titles (preferred terms) could perhaps be shortened, with the detail
left in the SCPQRG. I have added mappings to the SCPQRG categories and
some more general appsec security principles e.g.

<requirement>
    <identifier>OWASP-0139</identifier>
    <preferredterm lang="en">Disable auto complete features on forms
expected to contain sensitive information, including
authentication</preferredterm>
     <categorisation type="principle">Session Management</categorisation>
     <categorisation type="scpqrg">Data Protection</categorisation>
</requirement>

This XML format is not set or anything special, and it might make
sense for it to be compatible with ISO 25964, but that is further down
the line. It will be easy to use XSLT to convert the file to a new
schema or into other formats such as YAML.

I intend to add mapping to other identities such as those used in the
OWASP Testing Guide v3 and ASVS.

Colin