LoginSignup
2
2

More than 5 years have passed since last update.

@kshibamo

第18回 OWASP Night のメモ

Posted at

第18回 OWASP Night に参加したので、 OWASP が公開している資料についてまとめておきます。

はじめに

ここでは、仲田翔一さん（@shonantoka）の「Outreach Activities ＋ α」で紹介された OWASP のドキュメントを中心に抜粋しました。

発表では

OWASP のドキュメントやツールはウェブシステムのライフサイクルにも活用できるのでは？

という視点から

要件定義　⇒　設計・開発　⇒　テスト　⇒　運用・保守

というフェーズごとに「こんなドキュメントやツールを利用してみては」と提案されていました。

以下は、各フェーズごとに利用できそうな資料のリストです。

要件定義で利用できそうな資料

  • ウェブシステム・ウェブアプリケーションセキュリティの要件書 1

設計・開発で利用できそうな資料

  • OWASP Proactive Controls 2 （現在、仲田さんにより翻訳済・精査中とのこと）
  • OWASP ASVS (Application Security Verification Standard) 3 4 5
  • OWASP Cheat Sheet Series 6 （現在、正式に公開されているものは 33 件、草稿段階のものが 14 件）

テストで利用できそうな資料

  • OWASP Zed Attack Proxy 7 8
  • OWASP Testing Guide 9
  • OWASP OWTF (Offensive Web Testing Framework) 10

運用・保守で利用できそうな資料

  • OWASP ModSecurity Core Rule Set Project 11
  • OWASP AppSensor 12
  • OWASP Dependency Check 13

その他

  • OWASP Top 10 14 15
  • OWASP Mobile Top 10 16 17
  • OWASP IoT Top 10 18 （現在、仲田さんにより翻訳済とのこと）
  • OWASP Snakes and Ladders 19 20 21 22
  • OpenSAMM (Software Assurance Maturity Model) 23 24 25

補遺

以下は OWASP が公開しているチートシート（OWASP Cheat Sheet Series）のリストです。

Developer Cheat Sheets (Builder)

  • Authentication Cheat Sheet 26
  • Choosing and Using Security Questions Cheat Sheet 27
  • Clickjacking Defense Cheat Sheet 28
  • C-Based Toolchain Hardening Cheat Sheet 29
  • Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet 30
  • Cryptographic Storage Cheat Sheet 31
  • DOM based XSS Prevention Cheat Sheet 32
  • Forgot Password Cheat Sheet 33
  • HTML5 Security Cheat Sheet 34
  • Input Validation Cheat Sheet 35
  • JAAS Cheat Sheet 36
  • Logging Cheat Sheet 37
  • .NET Security Cheat Sheet 38
  • Password Storage Cheat Sheet 39
  • Pinning Cheat Sheet 40
  • Query Parameterization Cheat Sheet 41
  • Ruby on Rails Cheatsheet 42
  • REST Security Cheat Sheet 43
  • Session Management Cheat Sheet 44
  • SAML Security Cheat Sheet 45
  • SQL Injection Prevention Cheat Sheet 46
  • Transaction Authorization Cheat Sheet 47
  • Transport Layer Protection Cheat Sheet 48
  • Unvalidated Redirects and Forwards Cheat Sheet 49
  • User Privacy Protection Cheat Sheet 50
  • Web Service Security Cheat Sheet 51
  • XSS (Cross Site Scripting) Prevention Cheat Sheet 52

Assessment Cheat Sheets (Breaker)

  • Attack Surface Analysis Cheat Sheet 53
  • XSS Filter Evasion Cheat Sheet 54
  • REST Assessment Cheat Sheet 55

Mobile Cheat Sheets

  • IOS Developer Cheat Sheet 56
  • Mobile Jailbreaking Cheat Sheet 57

OpSec Cheat Sheets (Defender)

  • Virtual Patching Cheat Sheet 58

Draft Cheat Sheets

  • OWASP Top Ten Cheat Sheet 59
  • Access Control Cheat Sheet 60
  • Application Security Architecture Cheat Sheet 61
  • Business Logic Security Cheat Sheet 62
  • PHP Security Cheat Sheet 63
  • Secure Coding Cheat Sheet 64
  • Secure SDLC Cheat Sheet 65
  • Threat Modeling Cheat Sheet 66
  • Web Application Security Testing Cheat Sheet 67
  • Grails Secure Code Review Cheat Sheet 68
  • IOS Application Security Testing Cheat Sheet 69
  • Key Management Cheat Sheet 70
  • Insecure Direct Object Reference Prevention Cheat Sheet 71
  • Content Security Policy Cheat Sheet 72

おわりに

個人的に、発表スライドの「Outreach Activities（研究成果の公開）」というタイトルからは「OWASP が公開している情報をもっと活用してほしい」という意気込みを感じました。

脚注

  1. https://www.owasp.org/images/8/88/Web_application_security_requirements.pdf ↩

  2. https://www.owasp.org/index.php/OWASP_Proactive_Controls ↩

  3. https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project ↩

  4. https://github.com/OWASP/ASVS ↩

  5. https://drive.google.com/folderview?id=0B4xgbqJzimL4fm11WTdIc2JBUkozTkdsbmZhQk5LTDR4TFgyYlBfQkhQbnZjVlZqQWVaSzA&usp=sharing ↩

  6. https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series ↩

  7. https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project ↩

  8. https://docs.google.com/file/d/0B1e1Cma1GUllazNUNVp6OWdGYzg/edit ↩

  9. https://www.owasp.org/index.php/OWASP_Testing_Project ↩

  10. https://www.owasp.org/index.php/OWASP_OWTF ↩

  11. https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project ↩

  12. https://www.owasp.org/index.php/OWASP_AppSensor_Project ↩

  13. https://www.owasp.org/index.php/OWASP_Dependency_Check ↩

  14. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project ↩

  15. https://www.owasp.org/images/7/79/OWASP_Top_10_2013_JPN.pdf ↩

  16. https://www.owasp.org/index.php/OWASP_Mobile_Security_Project ↩

  17. https://docs.google.com/document/d/1QOWOrsAo-33bHLdAZksKa4F_8_A_6XndoDF6ri4na_k/edit ↩

  18. https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project ↩

  19. https://www.owasp.org/index.php/OWASP_Snakes_and_Ladders ↩

  20. https://www.owasp.org/images/c/c1/OWASPSnakesAndLadders-MobileApps-JA.pdf ↩

  21. https://twitter.com/OWASPSnakesWeb ↩

  22. https://twitter.com/OWASPSnakesMob ↩

  23. https://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model ↩

  24. http://www.opensamm.org/ ↩

  25. http://www.opensamm.org/downloads/SAMM-1.0-ja_JP.pdf ↩

  26. https://www.owasp.org/index.php/Authentication_Cheat_Sheet ↩

  27. https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet ↩

  28. https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet ↩

  29. https://www.owasp.org/index.php/C-Based_Toolchain_Hardening_Cheat_Sheet ↩

  30. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet ↩

  31. https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ↩

  32. https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet ↩

  33. https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet ↩

  34. https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet ↩

  35. https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet ↩

  36. https://www.owasp.org/index.php/JAAS_Cheat_Sheet ↩

  37. https://www.owasp.org/index.php/Logging_Cheat_Sheet ↩

  38. https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet ↩

  39. https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet ↩

  40. https://www.owasp.org/index.php/Pinning_Cheat_Sheet ↩

  41. https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet ↩

  42. https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet ↩

  43. https://www.owasp.org/index.php/REST_Security_Cheat_Sheet ↩

  44. https://www.owasp.org/index.php/Session_Management_Cheat_Sheet ↩

  45. https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet ↩

  46. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet ↩

  47. https://www.owasp.org/index.php/Transaction_Authorization_Cheat_Sheet ↩

  48. https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet ↩

  49. https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet ↩

  50. https://www.owasp.org/index.php/User_Privacy_Protection_Cheat_Sheet ↩

  51. https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet ↩

  52. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet ↩

  53. https://www.owasp.org/index.php/Attack_Surface_Analysis_Cheat_Sheet ↩

  54. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet ↩

  55. https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet ↩

  56. https://www.owasp.org/index.php/IOS_Developer_Cheat_Sheet ↩

  57. https://www.owasp.org/index.php/Mobile_Jailbreaking_Cheat_Sheet ↩

  58. https://www.owasp.org/index.php/Virtual_Patching_Cheat_Sheet ↩

  59. https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet ↩

  60. https://www.owasp.org/index.php/Access_Control_Cheat_Sheet ↩

  61. https://www.owasp.org/index.php/Application_Security_Architecture_Cheat_Sheet ↩

  62. https://www.owasp.org/index.php/Business_Logic_Security_Cheat_Sheet ↩

  63. https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet ↩

  64. https://www.owasp.org/index.php/Secure_Coding_Cheat_Sheet ↩

  65. https://www.owasp.org/index.php/Secure_SDLC_Cheat_Sheet ↩

  66. https://www.owasp.org/index.php/Threat_Modeling_Cheat_Sheet ↩

  67. https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet ↩

  68. https://www.owasp.org/index.php/Grails_Secure_Code_Review_Cheat_Sheet ↩

  69. https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet ↩

  70. https://www.owasp.org/index.php/Key_Management_Cheat_Sheet ↩

  71. https://www.owasp.org/index.php/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet ↩

  72. https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet ↩

2
2
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
2
2