Chief Information Security Officers (CISOs) are responsible for application security from governance, compliance and risk perspectives. The Application Security Guide For CISOs seeks to help CISOs... More > manage application security programs according to their own roles, responsibilities, perspectives and needs. Application security best practices and OWASP resources are referenced throughout the guide.< Less
The OWASP Application Security Codes of Conduct set out to define a set of minimal requirements for other organizations specifying the most effective ways they could support OWASP's mission. There... More > are six codes - for Government Bodies, for Educational Institutions, for Standards Groups, for Trade Organizations, for Certifying Bodies and for Development Organizations.< Less
The purpose of this project is to create custom Modsecurity rulesets that, in addition to the Core Set, will protect WebGoat 5.1 from as many of its vulnerabilities as possible (the goal is 90%)... More > without changing one line of source code. To ensure that it will be a complete 'no touch' on WebGoat and its environment, ModSecurity will be configured on Apache server as a remote proxy server. For those vulnerabilities that cannot be prevented (partially or not at all), I will document my efforts in attempting to protect them. Business logic vulnerabilities will be particularly challenging to solve.
For more information, please check out the project home page at OWASP Securing WebGoat using ModSecurity Project.< Less