Re: OWASP Top Ten - My Case For Updating It

[Ralf Durkee <rd () rd1 net>]

Mark Curphey wrote:
> I think the OWASP Top Ten needs a serious re-think. Here is my simple case
> for discussion / consideration. 
. . . <snip> . . .
> Proposal for improvement
>
> Create a set of T10's that are fit for purpose;
>
> T10 - Attack Patterns
> T10 - Common Vulnerabilities
> T10 - Root Causes of Insecure Web Applications 
> T10 - Things a company should have as part of its software security program
> T10 - Things to look for in a protection system
> T10 - Things to look for in an assessment system
>
> The FUD in the application security marketing is continuing to increase at
> an alarming rate and measures like this in my humble opinion are urgently
> needed to recover some credibility and prevent a pandemic. 
>
> Cheers,
>
> Mark

Wow, well thought out and I think on target. At least I agree with 95% 
of it, especially the FUD and misuse. Everyone is looking for a list to 
check off to ensure they are "covered".  It has been too much of an 
obstacle in too many situations for me to convince my clients management 
to make the jump from "PCI requires OWASP 10 top" to doing basics like 
design and code reviews. They are too expensive in the typical 
management view and there's no accepted standard (such as the OWASP top 
10) or regulation that requires the reviews. Such views lead to 
decisions such as "we will run an web scanner and were covered", or 
"we'll hire an inexperienced pen tester and were covered".

One question remains for me is that I'm NOT seeing a significant 
difference between #1 "T10 Attack patterns" and #2 "T10 Common 
vulnerabilities", isn't it just a matter of wording as to whether each 
of these is an attack pattern or a vulnerability?  I'm also curious to 
see as we work these out, if "T10 root causes ... " and "T10 things a 
company should do... ", may have a 1-to-1 mapping.

There a huge demand for the above, especially I think "T10 Things a 
company should have ..." however one fall back to limiting the list to 
10, is that it will become the new "Do this and we are covered" thought 
process, but on the other hand we need to start somewhere, and certainly 
the web would be much better off if we could get companies to implement 
a top 10 things to do.


-- Ralf Durkee, CISSP, GSEC, GCIH
Principal Consultant
http://rd1.net