| layout | title | tags | level | type | auto-migrated |
|---|---|---|---|---|---|
col-sidebar |
OWASP Proactive Controls |
example-tag |
0 |
documentation |
1 |
Software developers are the foundation of any application. In order to achieve secure software, developers must be supported and helped by the organization they author code for. As software developers author the code that makes up a web application, they need to embrace and practice a wide variety of secure coding techniques. All tiers of a web application, the user interface, the business logic, the controller, the database code and more – all need to be developed with security in mind. This can be a very difficult task and developers are often set up for failure. Most developers did not learn about secure coding or crypto in school. The languages and frameworks that developers use to build web applications are often lacking critical core controls or are insecure by default in some way. It is also very rare when organizations provide developers with prescriptive requirements that guide them down the path of secure software. And even when they do, there may be security flaws inherent in the requirements and designs. When it comes to software, developers are often set up to lose the security game.
The OWASP Top Ten Proactive Controls 2018 is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number 1 being the most important. This document was written by developers for developers to assist those new to secure development.
- Define Security Requirements
- Leverage Security Frameworks and Libraries
- Secure Database Access
- Encode and Escape Data
- Validate All Inputs
- Implement Digital Identity
- Enforce Access Controls
- Protect Data Everywhere
- Implement Security Logging and Monitoring
- Handle All Errors and Exceptions
For more information, see the complete document in the tab to the right.
The OWASP Proactive Controls document is free to use under the Creative Commons ShareAlike 3 License.
- Top 10 Proactive Controls 2018 PDF: EN | PL | Ru
- Top 10 Proactive Controls 2018 PPT Download
- Top 10 Proactive Controls 2018 DOCX Download
- Mapping to other OWASP and IEEE Top 10 Lists PDF Download
- Top 10 Proactive Controls 2018 Chinese PDF Download
- Top 10 Proactive Controls 2018 Russian PDF Download
- Top 10 Proactive Controls 2018 Polish PDF Download
- Top 10 Proactive Controls 2016 Traditional Chinese Translation PDF Download
- Top 10 Proactive Controls 2016 Simplified Chinese Translation PDF Download
- Top 10 Proactive Controls 2016 Japanese Translation PDF Download
- Top 10 Proactive Controls 2016 Hebrew Translation PDF Download
- [Aug 2018] 3.0 Polish Translation Released!
- [May 2018] 3.0 Released!
- [June 2016] Featured in A Transformative Approach to Secure Systems Delivery
- [June 2016] Featured in DevOpsSec
Please see the [/index.php/OWASP_Proactive_Controls?refresh=123#tab=News News] tab for more.
- [/index.php/OWASP_Proactive_Controls_2014 Proactive Controls 2014]
- [/index.php/OWASP_Proactive_Controls_2016 Proactive Controls 2016]
Keep up-to-date, participate or ask questions via the Project Email List.
|
The OWASP Top Ten Proactive Controls describes the most important control and control categories that every architect and developer should absolutely, 100% include in every project. The OWASP Top Ten Proactive Controls describes the most important control and control categories that every architect and developer should absolutely, 100% include in every project. Use the extensive project presentation that expands on the information in the document. Use the extensive project presentation that expands on the information in the document.
|
OWASP Proactive Controls 2018 is currently available in the following formats.
- Top 10 Proactive Controls 2018 [/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf PDF version]
- Top 10 Proactive Controls 2018 [/images/1/13/OWASP_Top_Ten_Proactive_Controls_v3.pptx PPT download].
- Top 10 Proactive Controls 2018 [/images/7/79/OWASP_Top_10_Proactive_Controls_V3.docx DOCX download].
Wiki version- is currently work in progress .
- [ July 2019] Featured in Coursera course from UCDavies Identifying Security Vulnerabilities
- [23 June 2019] Featured on HackerCombat: Implement OWASP Proactive Controls to Work
- [7 June 2019] Feature on OWASP DevSlop Show Proactive Controls
- [15 May 2019] Featured in TechBeacon: Put OWASP Top 10 Proactive Controls to work
- [2 Mar 2019] Webinar: The OWASP Top Ten Proactive Controls with Jim Manico
- [Dec 2018] Featured as the resource for Security “Shifting to the Left”! in the ISC2 course: "DevSecOps: Integrating Security into DevOps”
- [20 Sep 2018 Featured in TechBeacon: OWASP Top 10 Proactive Controls 2018: How it makes your code more secure
- [17 Sep 2018] Binary Blogger Podcast Episodes: OWASP Top 10 Proactive Controls Podcast Episodes
- [9 May 2018] Featured in Developer's security guide: 50 online resources to shift left
- [7 May 2018] 3.0 released!
- [11 Aug 2017] Presented at Northeast PHP Conference
- [25 July 2017] Podcast about at OWASP Top 10 Proactive Controls
- [12 May 2017] Presented at AppSec EU'17 - Belfast
- [14 Feb 2017] Featured in Managing Cloud Infrastructure to Prevent Security Gaps
- [Feb 2017 ] Featured in "Application Security Program: Protect Against Data Breaches"
- [ 1 Oct 2016] Presented at PHPNW16
- [5 July 2016] Featured in Incorporating Security Best Practices into Agile Teams
- [June 2016 ] Featured in A Transformative Approach to Secure Systems Delivery
- [2 June 2016] Featured in DevOpsSec - Securing Software through Continuous Delivery
- [30 Apr 2016] Added Hebrew Translation for 2016 version
- [28 Apr 2016] Added Chinese Translations for 2016 version
- [12 Apr 2016] Added Hebrew translation for 2016 version
- [29 Feb 2016] Added Japanese Translation
- [14 Jan 2016] 2.0 released!
- [5 Dec 2015] Began final edit process for 2.0
- [29 Mar 2015] Added Hebrew Translation
- [27 Jan 2015] Added Top Ten Mapping
- [31 Oct 2014] Project presentation uploaded
- [10 Mar 2014] Request for review
- [04 Feb 2014] New Wiki Template!
- Michael Leung - Management consultant with Canadian Cybersecurity Inc.
- "Giving developers guidance that was practical was challenging. The OWASP Top 10 Proactive Controls helped a lot."
Disclaimer
Organizations listed are not accredited by OWASP. Neither their products or services have been endorsed by OWASP.
How to get listed
Please let us know how your organization is using OWASP Top 10 Proactive Controls. Include your name, organization's name, and brief description of how you use the project. The project lead can be reached here.
- OWASP-2018-C1: Define Security Requirements
- OWASP-2018-C2: Leverage Security Frameworks and Libraries
- OWASP-2018-C3: Secure Database Access
- OWASP-2018-C4: Encode and Escape Data
- OWASP-2018-C5: Validate All Inputs
- OWASP-2018-C6: Implement Digital Identity
- OWASP-2018-C7: Enforce Access Controls
- OWASP-2018-C8: Protect Data Everywhere
- OWASP-2018-C9: Implement Security Logging and Monitoring
- OWASP-2018-C10: Handle All Errors and Exceptions
- OWASP-2016-C1: Verify for Security Early and Often
- OWASP-2016-C2: Parameterize Queries
- OWASP-2016-C3: Encode Data
- OWASP-2016-C4: Validate All Inputs
- OWASP-2016-C5: Implement Identity and Authentication Controls
- OWASP-2016-C6: Implement Appropriate Access Controls
- OWASP-2016-C7: Protect Data
- OWASP-2016-C8: Implement Logging and Intrusion Detection
- OWASP-2016-C9: Leverage Security Frameworks and Libraries
- OWASP-2016-C10: Error and Exception Handling
- OWASP-2014-C1: Parameterize Queries
- OWASP-2014-C2: Encode Data
- OWASP-2014-C3: Validate All Inputs
- OWASP-2014-C4: Implement Appropriate Access Controls
- OWASP-2014-C5: Establish Identity and Authentication Controls
- OWASP-2014-C6: Protect Data and Privacy
- OWASP-2014-C7: Implement Logging, Error Handling and Intrusion Detection
- OWASP-2014-C8: Leverage Security Features of Frameworks and Security Libraries
- OWASP-2014-C9: Include Security-Specific Requirements
- OWASP-2014-C10: Design and Architect Security In
- Top 10 Proactive Controls 2018 Russian Translation: PDF Download
- Top 10 Proactive Controls 2018 Polish Translation: PDF Download
- Top 10 Proactive Controls 2016 Traditional Chinese Translation PDF Download
- Top 10 Proactive Controls 2016 Simplified Chinese Translation PDF Download
- Top 10 Proactive Controls 2016 Japanese Translation PDF Download
- Top 10 Proactive Controls 2016 Hebrew Translation PDF Download
- Hebrew and French translations of the Top 10 Proactive Controls 2014 can be found on the 2014 archive tab.
Welcome to the OWASP Top 10 Proactive Controls Project!
- Create new PowerPoint and other artifacts for 2018 version (done)
- Create wiki for 2018 version (work in progress)
- Create new PowerPoint and other artifacts for 2016 version (done)
- Proactive Control Mapping to Cheatsheet (done)
- February 21, 2014 Moved 2014 info to archive tab
- January 15, 2016: 2016 Proactive Controls Released!
- August 6, 2015: Kickoff for 2.0 effort, in progress
- March 10, 2014: We released an early beta of this document to the OWASP leaders list for review and commentary.
- February 3, 2014: We are currently working towards a beta release of this document and have begun working with a designer for the final release PDF.
NOTOC
OWASP Proactive Controls Category:OWASP_Builders Category:OWASP_Defenders Category:OWASP_Document